桜Hikari PathHana's Little Garden · Hikari StudioBack to the garden

Privacy · プライバシー

Privacy Policy

Effective and last updated: August 18, 2026

1. Scope and operator

This Privacy Policy explains how Hikari Studio (“Hikari Studio,” “we,” “us,” or “our”) handles personal information through Hikari Path and Hana's Little Garden at www.hikari-path.com (the “Service”). Hikari Studio is the operator and personal-information handling business operator for information it controls. This Policy applies to users in the United States and Japan and supplements rights that cannot be waived under applicable law.

2. Information we collect

Depending on the features you use, we may collect the following categories:

We collect information directly from you, automatically from your device when needed to operate and secure the Service, and from processors such as Supabase, Stripe, Cloudflare, and Microsoft when you use their connected features.

3. Why we use information

We use information to provide and personalize lessons; save and synchronize progress; authenticate accounts; process subscriptions; provide pronunciation and speech features; answer requests; prevent fraud, abuse, and attacks; diagnose failures; enforce our Terms; meet legal and accounting duties; protect users and the Service; and improve content and accessibility. For individuals in Japan, these are our stated utilization purposes under the Act on the Protection of Personal Information (“APPI”). We will not materially expand those purposes without notice and any consent required by law.

4. Cookies, local storage, and tracking choices

The Service uses local storage and technically necessary browser storage for sessions, progress, preferences, security, and requested features. We do not use third-party behavioral advertising and do not sell personal information. We do not share personal information for cross-context behavioral advertising. Because we do not track users across unrelated services for targeted advertising, browser “Do Not Track” signals do not change current operation. Where legally required, we honor recognized opt-out preference signals, including Global Privacy Control, for sale or sharing that may be introduced in the future.

5. How we disclose information

We share only the information needed with service providers that help us run accounts and learning features, host and protect the service, provide audio features you request, and process payments and subscriptions.

We may also share information with professional advisers or authorities when reasonably necessary for legal compliance, claims, safety, fraud prevention, or a business reorganization.

Recipients handle information under their applicable privacy obligations. We do not permit service providers to use personal information we control for unrelated advertising.

6. Reviewer privacy and communication

Reviewer legal identity and onboarding records are available only to that reviewer and an authorized Hikari Studio administrator. Students see only the approved alias of the reviewer assigned to their question. Connected reviewers see only each other's approved aliases; Hikari Path does not provide an open reviewer directory. An administrator may moderate reviewer communications and connection status for administration, safety, and support. Reviewer files are private and are delivered only through current account authorization and short-lived access. Reviewer and administrator workforce accounts must use TOTP authenticator MFA before private Team Garden information becomes available.

6A. Employee content work, audio, and lesson resources

An employee’s correction proposal and its private item thread are visible only to that employee and authorized Hikari Studio administration. Hikari Studio may review and moderate a proposal or thread, return work for another look, reject it, or approve selected changes before any canonical learning content is updated. The Service keeps attribution and security events needed to operate that review history; it does not place the employee’s legal name in notification previews.

When an assigned employee intentionally records pronunciation audio, the microphone starts only after browser permission and the employee’s action. Draft takes remain local until the employee chooses “Use this recording.” Hikari Studio stores the submitted candidate privately for owner review. After approval, one final approved recording is linked to that pronunciation target. A later approved recording replaces the earlier final recording; limited replacement, deletion, hash, and audit metadata may remain as needed to complete secure cleanup and document the change. Trusted Voice Contributor status gives eligible employees recording priority and does not approve or publish audio by itself.

Lesson resource access is based on the signed-in account, lesson entitlement, and the access setting chosen by Hikari Studio. Resource access requests are logged for security and authorization. A view-only watermark and short-lived access reduce casual sharing but cannot prevent every form of copying. Download permission is shown separately. Resource metadata may include source attribution and source and license details supplied by Hikari Studio or the relevant rights holder.

7. International handling

Hikari Studio and its providers may process information in the United States, Japan, and other countries where they operate. Privacy protections may differ from those in your location. For personal data relating to people in Japan, we apply APPI requirements to overseas handling, maintain awareness of the external environment, use contractual and technical safeguards where appropriate, and provide information about foreign handling when required. You may contact us for available information about relevant safeguards and service-provider locations.

8. Retention

We retain each category only as long as reasonably necessary for the purposes described above, including providing an active account, resolving requests, maintaining security, enforcing agreements, and satisfying tax, accounting, payment, and legal requirements. Security and audit records are retained only as long as reasonably necessary for those purposes. Local progress remains until you clear site data or the application removes it. Account and synchronized learning data are deleted or de-identified after a valid deletion request and completion of operational deletion, subject to legally required or fraud-prevention records. Learner pronunciation-assessment audio is intended for transient processing and is not intentionally retained by Hikari Studio after the request completes; recognized text and scores may remain with learning progress. Employee pronunciation recordings submitted to the private Voice Library follow the review, approval, replacement, and cleanup process in Section 6A. Provider backups and security logs are removed according to controlled backup and log lifecycles.

9. Security

We use administrative, technical, and organizational measures appropriate to the nature of the Service, including HTTPS, restricted browser permissions, security headers, access controls, secret separation, origin and input validation, rate limiting, service-provider controls, and monitoring. Reviewer and administrator workforce access requires a verified TOTP authenticator and multi-factor assurance. No system is completely secure. If a breach requires notice under applicable law, we will provide notice to affected individuals and authorities as required.

10. Your choices and privacy rights

You may review or update supported account information, remove browser permissions, clear local browser data, cancel a subscription, or request access, correction, deletion, restriction, portability, or cessation of certain processing. We may verify your identity and may deny or limit a request where permitted by law. Authorized agents may submit requests where applicable. We will not discriminate against you for exercising a legal privacy right.

11. Japan privacy rights

If APPI applies, you may request notification of utilization purpose; disclosure of retained personal data or third-party provision records; correction, addition, or deletion of inaccurate retained personal data; and cessation of use, erasure, or cessation of third-party provision where the statutory conditions are met. You may also raise a complaint about our handling. We will respond in accordance with APPI, including any permitted identity verification, fees, exceptions, and explanation of a decision.

12. United States and California disclosures

Residents of U.S. states with applicable privacy laws may have rights to confirm processing, access, correct, delete, obtain a portable copy, opt out of sale, targeted advertising, or certain profiling, and appeal a denied request. These rights apply only when the relevant law covers Hikari Studio.

For California residents, the categories collected in the preceding 12 months are identifiers; customer records; commercial information; internet or other electronic-network activity; approximate location inferred from IP; audio information you submit; and inferences limited to learning progress and preferences. We collect and disclose those categories for the business purposes in Sections 3 and 5. We do not sell personal information, do not share it for cross-context behavioral advertising, and do not knowingly sell or share personal information of users under 16. We use sensitive information, if any, only for permitted service, security, and legal purposes. California residents may request to know/access, correct, delete, and obtain information about disclosure, and may receive equal service when exercising those rights.

13. Children and minors

The Service is a general-audience educational service and is not directed to children under 13. Users under 13 may not create an account or submit personal information. If we learn that we collected personal information from a child under 13 without legally sufficient parental consent, we will delete it. Users who are minors where they live should use the Service only with permission of a parent or legal guardian. A parent or guardian may contact us regarding a minor's information.

14. Changes to this Policy

We may revise this Policy when practices, providers, or laws change. We will post the updated Policy with a new effective date and provide additional notice or obtain consent when required for a material change. Earlier versions are retained with project release records.

15. Contact and requests

Hikari Studio is responsible for this Policy. Submit privacy requests through the Hikari Path contact form and select “Privacy or account.” Include the country or U.S. state relevant to the request, but do not send passwords, payment-card data, government identifiers, or secret keys. If the contact form is unavailable, do not submit sensitive information; return when the service is available. Complaints may also be made to the privacy or consumer-protection authority with jurisdiction, including Japan's Personal Information Protection Commission where applicable.

Verified learner reviews

We request a review only after server-confirmed meaningful use, such as a completed lesson, activity recorded on days at least seven days apart, or an active trial or paid relationship. A verified-use badge describes eligibility, not endorsement. Your original rating and text remain private and unchanged. Publication requires explicit, active publication consent and may use an optional public alias instead of your legal identity. You may send private feedback without publication consent or withdraw consent later. Published reviews use the learner’s exact words; if they contain prohibited content or personal information, Hikari Studio keeps them private or rejects publication instead of rewriting the opinion. Employees and administrators cannot submit customer reviews. If a feedback request is incentivized, the incentive is clearly disclosed with the request and any published review.

Verified use: the badge confirms qualifying activity; it is not an endorsement.