Your journey lives on your phone. Kippu has no required
account, no advertising and no advertising trackers. This page lists
everything that leaves the device, who receives it, and how to stop it.
What stays on the device
Your punched tickets, your streak, your station stamps, your settings and
your review cards are written to a file inside the app, on your iPhone. None of
it is sent anywhere unless you set up a commuter pass.
Anonymous statistics
To understand what helps and what doesn't, the app counts visits: a ticket
printed, a screen opened, an offer shown. Each visit carries a few counters
(streak length, number of tickets, active edition, Kippu+ or not) and the
device's technical context (model, iOS and app version, language, time
zone).
This data goes to PostHog, hosted in the European Union,
under an identifier the app draws at random. That identifier is never linked to
your name, your Apple Account or your commuter pass. IP-based location is turned
off. None of the words you learn is ever sent.
Statistics are on by default and can be switched off at any time in
Settings → Counter → Anonymous statistics. Once off, nothing
more is sent.
Purchases
Purchases and the Kippu+ subscription are handled by Apple. We never see
your payment method or your Apple Account, and no Kippu account is needed to
buy.
To know what you have bought, the app relies on RevenueCat,
which receives your Kippu purchase history from Apple under an anonymous
identifier. If you set up a commuter pass, its opaque identifier is passed on so
your purchases can be found on another device.
The commuter pass (定期券), if you set one up
It is optional and exists only to restore your progress on
another device. It uses Sign in with Apple. Apple gives us an opaque
identifier and nothing else: no name, no email address, not even a relayed one.
What the server then keeps, and nothing more:
- that opaque identifier;
- the date the pass was created;
- a copy of your progress exactly as the app writes it, plus the previous
version.
Notifications
The daily reminder is scheduled by your iPhone itself: no server sends
it.
Notices to travellers (new features, counter closures) come from our
server. If you allow notifications and keep notices on, the app registers the
device's notification token with it, along with its language, the app version,
whether Kippu+ is active and how many days since the app was last opened. The
last two let us write to subscribers or to lapsed travellers without knowing
who they are. The registration is removed when you turn notices off in
Settings.
Crash reports
Kippu does not send any itself. If you have agreed in iOS Settings to share
analytics with app developers, Apple may pass anonymous reports on to us, under
its own rules.
Server logs
Like any web server, ours records each request: the IP address, the time and
the path requested. These logs keep the server running and protect it. They
are not linked to any pass and are deleted by automatic rotation, within
fourteen days at most.
What does not exist
No resale, no advertising profile, no sharing with any third party other
than those named here: Apple, PostHog and RevenueCat.
Deleting your data
For the pass: Menu → Commuter pass → Hand back the pass. The account,
its sessions and your saved progress are deleted from the server immediately
and permanently. Your progress remains on your device, where you can also reset
everything. For statistics: switch them off, then write to us to erase what has
already been sent.
Retention
The pass is kept for as long as it exists. Once handed back, nothing is
kept, and encrypted server backups are rotated out within thirty days.
Contact
For any question, or to exercise your rights, write to the contact address
published on Kippu's App Store listing.