Katsuyō Academy has no accounts and nothing to sign up for, so for most of what you do here the honest answer is nothing. But that isn't the whole answer, and the parts where it isn't are worth writing down plainly rather than burying.
Last updated 21 September 2026 · Brandon Gilmore, sole operator
Everything the site remembers about your learning lives in your browser's local storage. It never reaches a server, I cannot read it, and it does not follow you to another device. That includes:
The trade-off: clearing your browser data clears all of it, permanently. There is no backup, because there is nowhere for a backup to live. Your phone will not know what your laptop has done.
Four things send data out. Each one is listed here with exactly what goes, where, and what comes back.
What is sent: the message or answer you typed, plus the context the feature needs to reply — which verb and form you were drilling, the story you are reading, the scenario you chose, and the recent turns of the current conversation.
Where it goes: a small proxy I run on Vercel, which forwards it to Anthropic (the Claude API) and returns the reply. The proxy exists so the API key never has to sit in the page.
What I keep: nothing. I don't log the contents of these requests. Vercel and Anthropic keep their own operational records under their own policies — see Vercel's privacy policy and Anthropic's.
If you'd rather not: simply don't use them. Every other tool on the site — the drills, the charts, the dictionary, the flashcards, the reading library — works without ever contacting a server.
What is sent: when you press Listen or turn on read-aloud, the Japanese text to be spoken. When you use the microphone in Talk, a recording of what you said, so it can be transcribed and scored for pronunciation.
Where it goes: the same proxy, then Microsoft Azure Speech. Audio is processed to produce the transcript and the accuracy and fluency scores; it is not stored by me.
If you'd rather not: the microphone only ever opens when you press the button, and your browser will ask you first. Typing works everywhere the microphone does.
What is sent: the name, email address, subject and message you fill in.
Where it goes: Web3Forms, which turns it into an email to me. I keep the email so I can reply to you and so I don't lose a bug report.
If you'd rather not: email me directly instead — same inbox, one fewer service in the middle.
What is sent: only if you choose it.
Where it goes: the same Vercel proxy, into a Neon Postgres database.
What I keep: exactly what's listed above, until you delete the account.
If you'd rather not: don't make an account.
Like any website, opening a page tells the servers that serve it your IP address and browser. For this site that means GitHub Pages (hosting), Google Fonts (the two typefaces) and Ko-fi (the support button in the corner). Ko-fi only sees anything more than that if you actually click through and donate, which happens entirely on their site — no payment details ever touch this one.
Two measurement tools load on every page. I'd rather spell out what they do than let you find out from a browser extension.
Both are here for one purpose: working out what to fix next. This site is built by one person in his spare time, with no feedback loop other than the handful of people who use the contact form. Knowing that forty people opened the Conjugator and thirty-five left on the first question tells me something is wrong with that first question — which is the kind of thing nobody ever writes in to report.
What they are not for. No advertising, no ad networks, no selling or sharing with data brokers, no profile of you built up over time, and no attempt to work out who you are. There is no account here to attach any of it to, and I have never used this data for anything other than deciding what to build and what to fix.
Counts visits. It records which pages are opened, roughly where in the world from (city level, from your IP — the IP itself is not stored by Google Analytics 4), what device and browser, how long a page is open, and what site you arrived from. It sets cookies to tell a returning visitor from a new one.
Why: so I know which tools are actually used, and which pages people give up on. That is genuinely how this site gets its priorities.
Clarity does more than count. It records a playback of the page — cursor movement, clicks, taps, scrolling, the layout you saw — and builds heatmaps from it. It is not video and it is not your screen; it is a reconstruction of the page from the site's own code.
What it does not capture: text you type. Clarity masks every input and dropdown on the site, which cannot be switched off. On top of that, the Talk conversation and the Katsu chat window are explicitly marked as masked in the site's own code, so your Japanese practice and your questions to Katsu are not in the recordings.
Why: the same reason. When a drill confuses people I can see where they get stuck rather than guess.
Microsoft's own account of what Clarity collects is in their documentation, and their use of it falls under the Microsoft Privacy Statement.
Turning it off: both tools respect an ad or tracker blocker, and neither is needed for anything on the site to work — block them and every page behaves identically. Global Privacy Control and Do Not Track signals are honoured by the vendors where their own policies say so.
The site itself sets none. It uses local storage for your progress, which is similar technology but stays on your machine and is never sent with a request.
Cookies that do get set come from Google Analytics, Microsoft Clarity and the Ko-fi widget, for the purposes described above. Clearing your site data removes them — along with your learning progress, since they live in the same place.
Because there's no account, most of what a privacy policy usually promises you can simply do yourself:
Where the data goes. The services above are run by companies in the United States, so if you're using the site from elsewhere, that is where the analytics and the AI requests are processed.
Children. The site is open to anyone and collects no names or ages, but it isn't designed or directed at children under 13, and I don't knowingly collect anything from them. If you believe a child has sent me something through the contact form, tell me and I'll delete it.
Security. The site is served over HTTPS and holds no credentials, because there are none to hold. The API keys for Katsu and speech live in server environment variables and are never in any page you download.
Changes. If I add a feature that sends data somewhere new, it gets a section here and the date at the top changes. I won't quietly broaden this.
Not a lawyer. This is an accurate description of what a small, free site actually does, written by the person who built it. It is not legal advice, and it isn't a substitute for one if you need certainty about a specific regulation.
Ask. I'd rather explain than have you wonder.
Get in touch →© 2025-2026 Brandon Gilmore