Kippu collects nothing by default. No required account, no
analytics, no advertising trackers, no third-party SDKs. Your journey lives on
your phone.
What stays on the device
Your punched tickets, your streak, your station stamps, your settings and
your review cards are written to a file inside the app, on your iPhone. None of
it leaves the device unless you set up a commuter pass.
The commuter pass (定期券), if you set one up
It is optional and exists only to restore your progress on
another device. It uses Sign in with Apple. Apple gives us an opaque
identifier and nothing else: no name, no email address, not even a relayed one.
What the server then keeps, and nothing more:
- that opaque identifier;
- the date the pass was created;
- a copy of your progress exactly as the app writes it, plus the previous
version;
- a device identifier, which you may withhold.
No plain-text email address. No retained IP addresses. No advertising
profile, no sharing with third parties, no resale: those things do not exist
in Kippu.
Purchases
Purchases and the Kippu+ subscription are handled by Apple. We never see
your payment method or your Apple Account. No Kippu account is needed to buy.
Notifications
The daily reminder is scheduled by your iPhone itself. No server sends
notifications, and we do not know whether you have enabled them.
Diagnostics
If you turn them on in Settings, anonymous crash reports may be sent. They
contain neither your tickets nor your words. They stay off until you ask.
Deleting your data
Settings → Ticket counter → Hand back your pass. The account, its
sessions and your saved progress are deleted from the server immediately and
permanently. Your progress remains on your device, where you can also reset
everything.
Retention
For as long as the pass exists. Once handed back, nothing is kept. Encrypted
server backups are rotated out within thirty days.
Contact
For any question, or to exercise your rights, write to the contact address
published on Kippu's App Store listing.