Your privacy in Bunshu

Last updated 5 October 2026

This policy covers bunshu.com and, from launch, the Bunshu apps for iPhone, Android and the web. The short version: your cards are yours and shown to no one but you; guests share nothing at all; we collect only what Bunshu needs to work; your material is never used to train AI; and the website sets no cookies.

1. Who is responsible

Ninki Gen Studio (UEN 53527055X), a sole proprietorship of Lim Ying Min registered in Singapore, at 60 Paya Lebar Road, #11-22, Paya Lebar Square, Singapore 409051, is responsible for your personal data in Bunshu, and handles it under Singapore's Personal Data Protection Act 2012.

Data Protection Officer: Lim Ying Min, hello@ninkigenstudio.com. For anything else about Bunshu: bunshu@ninkigenstudio.com.

2. Guests share nothing

On the phone you can use Bunshu with no account. As a guest, your cards and everything about them stay on your phone. Nothing of yours reaches our servers or anyone else's: no sync, no analytics, no crash reports, no AI.

3. What we collect, and why

What	Why
The waitlist: your email address, and whether you ticked the optional line for news and offers	To email you when Bunshu launches, with the odd update before then, with your consent. We email you once to say you've joined. Every email we send, that one included, has an unsubscribe link. The one in that email takes you off the waitlist, and off the news and offers if you ticked the optional line. The optional line is a separate consent, to news and offers from Bunshu and Ninki Gen Studio; to stop only those, reply to any of our emails.
Your account: email address, sign-in method, username, and the profile you choose to fill in	To sign you in, keep your account secure, and show your username on what you publish.
Your content: cards, decks, images, recordings, tags, settings and your review history	To sync Bunshu across your devices, schedule your reviews and back up your work.
Your devices: the platform, app version, device name, time zone and the token for notifications	To sync, send you the notifications you've switched on, and tell you about a new sign-in.
Purchases: your plan and its renewal date	To give you Plus. Payment details go to the seller (Apple, Google or Paddle), never to us.
Materials you give Bunshu's AI features, and the text of cards being drafted	To draft your cards, with your consent. Deleted 14 days after upload.
What you publish, rate, review or report, and feedback you send	To run the public shelf, handle reports and answer you.
Crash reports	To fix problems, only with your consent: during the beta, through its terms; after launch, only when you choose to send one with feedback.
Server logs: request details, never your cards' text	To keep Bunshu secure and working.

We use your data to provide the service you've asked for, with your consent where we ask for it, and to keep Bunshu secure. We don't sell your data, we don't show ads, and the apps carry no analytics trackers.

4. Who receives what

We use a small number of service providers, each receiving only what its job needs:

Supabase stores your account and synced content, and runs sign-in.
Cloudflare hosts bunshu.com and the web app, and stores your images and recordings.
Apple and Google, if you sign in with them, buy through their stores, or receive notifications on their phones.
Expo delivers notifications to your phone.
RevenueCat keeps track of your plan, under an account number that isn't your email.
Paddle, our Merchant of Record, sells Plus on the web and handles its payment, tax and receipts.
Brevo sends our emails: the waitlist, sign-in codes, receipts and replies to feedback.
Sentry receives crash reports, only with your consent.
The AI model providers we use to read materials and draft cards receive the material you chose and the text being drafted. They process it only to do the job and keep nothing afterwards. We'll name each one here once the models are chosen, and the consent sheet in the app names them before your first upload.
Google receives the text of a card to turn it into a spoken clip, when you ask for one.
Openverse, Pexels and Pixabay receive the word of a vocabulary card, to find it a picture.

None of them may use your data for anything else, and your material is not used to train AI models. We may also disclose data where the law requires it.

5. Data outside Singapore

Some of these providers process data outside Singapore. Where they do, we make sure your data gets protection comparable to Singapore's law, through our agreements with them.

6. How long we keep it

Your account and content: until you delete them. Deleted cards and decks stay in the bin for 30 days so you can restore them.
Materials for AI drafting: 14 days after upload.
Messages in Activity: 90 days. Server logs: 30 days.
The waitlist: until you unsubscribe, or until we stop the list.
When you delete your account, its data is removed straight away, and leaves our backups within 30 days.

7. Your rights

You can see, correct and export your data, and delete your account, inside the app. You can withdraw any consent at any time: unsubscribe from emails with the link in each one, and stop AI features or crash reports in the app. You can also email our Data Protection Officer to ask what data we hold about you, or to correct it, and we'll answer within 30 days. If you're unhappy with our answer, you can complain to Singapore's Personal Data Protection Commission.

8. Security

Your data is encrypted on its way to us and on our servers. Each account can reach only its own data, and our staff see only what you publish, report or send us, never your private cards. Media is served through links that expire.

9. Cookies

bunshu.com sets no cookies and uses no analytics. The web app keeps your cards and your sign-in in your browser's own storage, which it needs to work, especially offline.

10. Children

Bunshu is for people aged 13 and older, and we don't knowingly collect data from anyone younger.

11. Changes

If we change this policy, we'll update the date at the top, and tell you in the app or by email before a change that matters takes effect.