In short: Lamplet keeps your study on our servers so it can schedule your reviews and follow you between devices. Your books, videos, recordings and photos stay on your device. When you ask for AI help, a translation, generated captions or speaking practice, the text or audio involved goes to the AI providers listed below, without your name or email. We use no analytics, advertising or tracking, and you can export or delete everything from Settings at any time.
Who we are
Lamplet is made by Ryan Thompson, a sole trader in the United Kingdom, who is the data controller for the personal data described here. This policy covers the Lamplet apps for iPhone, iPad and Mac, the Lamplet browser extension, and the websites lamplet.app and hanzi.mitomeru.com (where password-reset and friend links open). Write to support@lamplet.app with any question about it.
What we collect
| Data | Why |
|---|---|
| Account: your email address and a password (stored only as a hash by our sign-in provider) | To sign you in and send a password reset when you ask for one. |
| Settings: your time zone, when your study day starts, display and audio choices, reminder times, study days | To schedule reviews on your own days and show the app the way you set it. |
| Study record: the words you study, every answer you give and how long it took, your schedule, lists, tags, notes, sessions, placement result, Anki imports | Scheduling reviews is the core of Lamplet: it needs your history to work out when each word comes back. |
| Saved sentences: the sentence a word came from, its translation, and the title and address of its source | To show the word in context when it comes back for review. |
| Library details: the title, address and kind of each book, video or page in your library, your place in it, bookmarks and the passages you bookmarked | So your library and place follow you between devices. The files themselves are not uploaded. |
| Activity counts: words looked up (at most once an hour per word), minutes watched or listened, books finished, seals, runs | For your progress, seals and streak. |
| Usage counters: how many times you used each AI feature in a minute and a day | To keep fair use limits and protect the service from abuse. |
| Friends (only if you turn them on): the name you choose, a drawn avatar, your friend code, friend requests, blocks and reports | To let you and your friends see each other's week. |
We do not collect your real name, phone number, location, contacts, photos, advertising identifier or payment details, and we do not keep the IP address of your requests in our database.
What stays on your device
- Your books, comics, PDFs, videos, audio, photos and recordings, including Live Transcript recordings. Only their titles and your place in them sync.
- Text recognition in photos, comics and the camera runs on your device.
- Live Transcript uses Apple's speech recognition rather than ours, and its recording stays on your device. Only if you ask for its recap is a sample of the transcript sent to the AI providers below.
- Captions written for your podcasts and files are kept on your device, though the audio is sent to be transcribed (see below).
- The browser extension reads the pages you visit inside your browser. It sends page text to our servers only when you ask it to: looking up or saving a word (the word, its sentence, and the page's title and address), turning on contextual glosses (the sentence), or asking for AI help.
- The apps' readers send the passage you are reading to our servers to split it into words. It is used to answer the request and not stored.
Who else handles your data
We use these services to run Lamplet. None of them receives your name or email from us.
| Service | What it receives | When |
|---|---|---|
| Supabase (database, sign-in and server functions; servers in Ireland) | Everything in “What we collect” | Always, as our main host |
| OpenRouter (USA), which passes each request to OpenAI or xAI, or to DeepInfra, Together, Fireworks or Groq, which run open models such as DeepSeek and Whisper; all in the USA | The word and sentence you asked about, your question, subtitle lines, a podcast's title and notes, your known and recent words for stories and plans, your speaking-practice audio and conversation, and audio from videos, podcasts or files you ask to caption | Only when you use AI help, translation, contextual glosses, generated captions, stories, study plans or speaking practice |
| Microsoft Azure Speech | The word or sentence to be read aloud | When you play audio we do not already have |
| Apple (podcast directory) | Your podcast search | When you search for a podcast. Episodes then download from their publisher. |
| YouTube and Bilibili | Whatever those sites normally receive when you watch them, including your Bilibili sign-in if you use it inside the app | When you watch them in Lamplet or with the extension |
| Vercel and Cloudflare | Ordinary web requests to our websites | When you visit lamplet.app or hanzi.mitomeru.com |
Sentences you play aloud are kept in a shared audio cache, with no link to your account, so they can be played again without being generated twice. Translations and glosses are cached the same way.
Data outside the UK
Our main servers are in Ireland. AI requests and speech go to providers in the USA, as listed above; none goes to China. Where personal data leaves the UK, we rely on the safeguards available under UK data protection law. What we send to AI providers is the content of your request, not your account, but it can still be personal if you include personal details in what you ask or record.
Friends and public lists
Friends are off until you turn them on. A friend sees your chosen name and avatar, your week day by day (reviews, minutes, words saved, speaking replies and points) and your run. They never see your words, lists or characters. Your week runs on your own calendar, which hints at your time zone. If you publish a list to the community, the name you chose is shown with it to anyone, signed in or not. If someone reports you, we read the report to decide whether to act on it.
Our websites
lamplet.app sets no cookies and runs no analytics. It remembers your choice of Copybook or Night Market in your browser's local storage, and loads fonts from Google Fonts and the lantern animation from jsDelivr, which see your IP address like any website you load files from. hanzi.mitomeru.com loads nothing from anyone else.
Why we may use it
- To provide Lamplet to you (performing our agreement with you): your account, study record, library details, settings and the features you use.
- Our legitimate interests: usage limits, security, and handling reports about friends, balanced against your interests.
- Your consent: friends, publishing a list, and the microphone and camera, which the app asks for before first use. You can withdraw it at any time in Settings or your device's settings.
How long we keep it
We keep your data while you have an account. Speaking-practice day counts are deleted after 60 days, and conversations are not stored at all. When you delete your account, everything linked to it is deleted at once, except lists you published to the community, which stay without your name. Copies may survive in our host's backups until those expire.
Your rights
Under UK data protection law you can ask to see, correct, export or delete your data, to restrict or object to how we use it, and to withdraw consent. Most of this you can do yourself:
- Export: Settings › Your data (Settings › Data on the Mac) gives you everything about your account in one file.
- Delete your account: in the same place. It is immediate and permanent, and signs you out everywhere.
- Anything else: write to support@lamplet.app. We will reply within one month.
If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk, though we would like the chance to put it right first.
Children
Lamplet is for people aged 13 and over. If you are under the age at which you can agree to this yourself where you live, a parent or guardian must agree for you. If we learn that someone under 13 has an account, we will delete it.
Security
Connections are encrypted. Each person's data is walled off from everyone else's in the database itself, your sign-in is kept in your device's keychain or the extension's private storage, and server logs record errors without the content of your requests.
Changes
If this policy changes, we will update the date at the top. Before a change that affects how your data is used takes effect, we will tell you by email or in the app.