Legal

Privacy Policy

Last updated: July 2026

Who we are

Soro Soke is built and operated by Japa Reality Technologies Inc. ("we", "our", or "us"), a Canadian company and part of the FumingLyon Network group. For the purposes of data protection law, including the EU and UK General Data Protection Regulation (GDPR), Japa Reality Technologies Inc. is the data controller for personal data processed through Soro Soke.

You can reach us about privacy at japareality@fuminglyonnetwork.com. We do not sell your data — ever.

What we collect

Account information. When you sign in with Google, we receive your name and email address from Google's OAuth service. We store these to identify your account.

Card and deck content. Everything you type into Soro Soke — vocabulary cards, deck names, memory hooks, example sentences — is stored in our database and associated with your account.

Review history. We store your review grades and scheduling data (intervals, ease factors, review dates) so the SM-2 algorithm can schedule future reviews correctly.

Speak Up, Small Talk Lab, and Debate Lab sessions. Session content is processed to generate feedback but is not stored permanently beyond the session unless you choose to save a summary (score, key feedback, transcript).

Doc Lab documents. Documents you paste into Doc Lab are never stored. The text is sent to our AI provider to generate the analysis and is then discarded — it is not written to our database and we keep no copy of it. What we do save is the resulting feedback, the notes you write yourself, and the document's title, so that your session history and progress over time still work. This means you can paste confidential work material — board papers, specs, internal strategy memos — without it being retained by us.

Usage data. Where you've consented (see "Cookies" below), we collect anonymised usage information (pages visited, feature usage) via Google Analytics to understand how the product is used.

Approximate location. On each visit, we record a coarse location (country, region, and city) resolved by our hosting provider from the request — never the IP address itself. This is used only in aggregate, to understand which regions visitors come from, and is not linked to your identity or account.

Legal basis for processing (GDPR Art. 6)

Where GDPR applies, we rely on the following legal bases:

Performance of a contract (Art. 6(1)(b)) — creating your account, storing your cards and sessions, and running the core spaced-repetition and practice features you sign up for.
Consent (Art. 6(1)(a)) — Google Analytics cookies, and push notifications if you opt in. You can withdraw consent at any time (see "Cookies" below).
Legitimate interests (Art. 6(1)(f)) — securing the service against abuse (rate limiting, blocking banned accounts) and understanding aggregate, privacy-preserving usage patterns like approximate visitor location, balanced against your right to privacy.
Legal obligation (Art. 6(1)(c)) — where we're required to retain or disclose information to comply with applicable law.

How we use your information

To provide and operate the Soro Soke service
To personalise your review schedule using the SM-2 algorithm
To generate AI-drafted card content and practice feedback when you request it
To send optional review reminder notifications (only if you opt in)
To improve the product based on aggregated, anonymised usage patterns
To contact you with important service updates (infrequently)
To secure the service and prevent abuse

Cookies

We use session cookies to keep you signed in — these are strictly necessary and can't be switched off, since the service can't function without them. Everything else — currently just Google Analytics — only runs if you consent. We use Google Consent Mode, which defaults every visitor's analytics storage to denieduntil you actively choose otherwise in the banner, and keeps ad-related signals denied permanently — Soro Soke doesn't run ads.

You can change your choice at any time — this isn't a one-time decision:

Third parties and sub-processors

Google. Used for OAuth sign-in and, where consented, Google Analytics. Google's privacy policy governs their handling of the data shared with them.

Anthropic. Powers AI card drafting, and Speak Up, Small Talk Lab, Debate Lab, and Doc Lab feedback. Text you submit for these features is sent to Anthropic for processing. We do not authorise Anthropic to use your content to train their models.

Groq. Powers optional voice transcription in Doc Lab, if you use the microphone input.

Supabase. Hosts our primary database, where your account and content data is stored.

Vercel. Hosts and runs the Soro Soke application itself.

Resend. Sends transactional emails (welcome emails, service notices) on our behalf.

Each of these providers processes data only as needed to deliver their part of the service, under contractual terms consistent with this policy.

International data transfers

Japa Reality Technologies Inc. is based in Canada, and the sub-processors listed above run infrastructure in the European Union, the United Kingdom, the United States, and Canada. Where personal data is transferred out of the EEA or UK to a country not covered by an adequacy decision — such as the United States — we rely on the European Commission's Standard Contractual Clauses (SCCs) and, for transfers from the UK, the UK International Data Transfer Addendum to the SCCs, as implemented through our agreements with each sub-processor.

Data retention

Account and content data. Retained for as long as your account is active. You can delete your account at any time from Settings → Delete account, which permanently removes all decks, cards, review history, session records, and profile data. This action cannot be undone.

Doc Lab document text. Not retained at all — discarded immediately after analysis, as described above.

Approximate location data. Retained only in aggregate form and never linked to your identity or account.

Support correspondence. Retained for as long as needed to resolve your enquiry, and for a reasonable period afterward for our own record-keeping.

Your rights

Depending on where you live, data protection law gives you the right to:

Access the personal data we hold about you
Rectify inaccurate or incomplete data
Erasure — delete your data (self-serve from Settings, or by contacting us)
Portability — receive your data in a portable format
Restriction of how we process your data in certain circumstances
Object to processing based on legitimate interests
Withdraw consent at any time, without affecting processing before the withdrawal (see "Cookies" above)
Lodge a complaint with your local data protection supervisory authority — for example, the ICO in the UK, your national authority in the EU, or the Office of the Privacy Commissioner of Canada

You can access and export your account data at any time from Settings → Download my data. For anything else, contact us at japareality@fuminglyonnetwork.com. We will respond within 30 days.

Children

Soro Soke is not directed at children under 13. We do not knowingly collect personal information from anyone under 13. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

Changes to this policy

We may update this policy from time to time. When we do, we will update the "last updated" date at the top of this page. Continued use of Soro Soke after changes are posted constitutes your acceptance of the updated policy.

Contact

Questions about this policy or your data? Email japareality@fuminglyonnetwork.com or use our contact form and we'll get back to you.