Privacy Policy

RX-36 Services Privacy Policy

Last Updated: July 25, 2026

This Privacy Policy explains how RISE, a sole proprietor based in Japan (the "Operator," "RISE," "we," "us," or "our"), handles information in connection with the following services (collectively, the "Services"):

• the RX-36 website and web games available at https://rx-36.com/ (the "Site"); and
• the Android application RX-36 Job Interview Quest, package name com.rx36.englishgame (the "App").

The App is an English-learning game that uses spoken exercises, AI-assisted transcription and feedback, game progress, and Google Play Billing.

1. Operator and Contact

Operator / Data Controller: RISE (Japan)
Contact: [email protected]

For privacy questions, access requests, correction requests, or deletion requests, contact the address above. Never send us your Google password, Auth0 credentials, payment card number, or other authentication secrets.

2. Information We Handle

We collect or process only the information reasonably necessary to provide, secure, support, and improve the Services.

2.1 Google and Auth0 authentication information

The App uses Sign in with Google through Auth0 by Okta.

Google and Auth0 may process and provide authentication information such as:

• Google Account email address;
• account or provider user identifier;
• profile or display name;
• Auth0 subject identifier;
• authentication tokens, session information, and login timestamps; and
• security and fraud-prevention information associated with authentication.

The English Game backend intentionally uses the Auth0 subject identifier as the stable account key and stores the confirmed Username used in the game. It does not persist the Google Account email address in the English Game user database. The Site may receive and retain an email address where necessary for the Site's separate web-account and support functions.

Authentication credentials and refresh tokens used by the Android App are managed using the Auth0 Android SDK and Android-protected local storage. RISE does not receive or store the user's Google password.

2.2 Username and account settings

We may store:

• the Username selected or confirmed by the user;
• Username confirmation and update timestamps;
• previous and new Usernames in a Username change history;
• usage records needed to enforce Username change limits; and
• account, audio, and game settings.

The Username may be shown inside the Services and, where a ranking or other public feature is provided, may be visible to other users or search engines. Users should not choose a Username that reveals information they do not want to make public.

2.3 Game progress, learning profile, and evaluation information

We may handle or store:

• session identifiers and progress milestones;
• Training Center, Job Interview, ERC, CEFR, and other scene progress;
• completed lesson, interview, and practice-cycle counts;
• questions, answers, corrected answers, scores, feedback, and evaluation metrics;
• CEFR estimates and short evaluation notes;
• selected industry and job-type categories and confidence/status values;
• quotas and usage counters for transcription, text-to-speech, downloads, and paid practice credits;
• generated CSV or document metadata and download status; and
• information needed to resume, reset, authorize, or prevent duplicate completion of a game session.

The long-term learner profile and evaluation records are designed to store structured results rather than raw audio or unrestricted free-form transcripts. For example, employer names, school names, addresses, phone numbers, email addresses, and unrestricted profile summaries are not intentionally stored as part of the structured learner profile.

2.4 Voice input, microphone recordings, and transcription

The App requests Android microphone permission because spoken English exercises are a core feature.

When the user actively starts a speaking exercise, the App may:

1. record microphone audio on the device;
2. hold the recording temporarily in memory;
3. transmit the recording securely to the RISE backend;
4. transmit the audio to OpenAI's API for speech-to-text processing;
5. generate a transcript, correction, evaluation, or AI-assisted response; and
6. return text, scores, feedback, or generated speech to the App.

The App does not intentionally record microphone audio in the background when the user has not started a speaking exercise.

RISE does not intentionally persist raw microphone audio in the English Game primary database or default application storage after request processing. Raw provider transcript fields are also excluded from the long-term learner profile and evaluation records. However, speech-derived text, corrected answers, conversation turns, processing metadata, scores, and feedback may be retained temporarily or stored as necessary to provide session recovery, downloads, progress, evaluations, abuse prevention, and support.

Audio and text sent to an external AI provider are also handled under that provider's terms, privacy notices, security controls, and retention settings. Users should avoid including unnecessary sensitive information in spoken answers.

2.5 Google Play Billing and purchase information

Digital products and practice credits offered in the Android App are processed through Google Play Billing.

We may receive or store:

• product ID and offer information;
• purchase token;
• Google Play order ID;
• purchase time and purchase state;
• acknowledgement or consumption state;
• an obfuscated account identifier that links the purchase to the authenticated game account;
• credits or entitlements granted, used, refunded, revoked, or expired; and
• Real-time Developer Notification event identifiers and processing status.

RISE does not receive or store the user's full payment card number, bank account details, or Google Account payment credentials. Payment method information is handled by Google according to Google's terms and privacy notices.

The web version of the Services may continue to use Polar for web checkout and entitlement management. The Android App uses Google Play Billing and does not invoke the Polar checkout flow.

2.6 Technical, device, error, and security information

We and our infrastructure providers may automatically process:

• IP address;
• device, operating system, browser, WebView, and app-version information;
• request and access timestamps;
• session and request identifiers;
• response status, crash, diagnostic, and error information;
• security, authentication, rate-limit, and abuse-prevention logs; and
• network and service-performance information.

We use this information to operate the Services, investigate failures, maintain security, prevent fraud and abuse, enforce limits, and improve reliability.

2.7 Information stored locally on the device

The App may store the following locally in its WebView or Android-protected storage:

• authentication credentials managed by the Auth0 Android SDK;
• a random game session identifier;
• progress markers needed for session recovery;
• audio and lesson preferences;
• dismissed-notice status;
• download and reset status; and
• other operational settings.

This local information remains on the device until it is cleared by the App, logout or reset behavior, Android settings, app-data deletion, or uninstall, depending on the data type.

2.8 Inquiries and support

If a user contacts us, we may handle the inquiry text, reply email address, attachments, and records of our response for support, security, dispute handling, and recurrence prevention.

2.9 Site cookies and analytics

The Site may use cookies, local storage, Google Tag Manager, Google Analytics, and similar technologies for essential operation, consent management, security, and analytics. Site users can manage non-essential cookie choices through the Site's consent interface and browser settings.

The Android App does not currently include Google AdMob or another third-party advertising SDK. If advertising is introduced, we will update this Policy, the Google Play declarations, and any required consent mechanism before or when the advertising feature is introduced.

3. Purposes of Use

We use information for the following purposes:

• providing Google/Auth0 login and maintaining account security;
• providing game, speaking, transcription, feedback, evaluation, download, and progress features;
• maintaining and synchronizing Username and learner settings;
• processing and verifying Google Play purchases and providing paid entitlements;
• enforcing free, paid, usage, Username-change, download, and practice-cycle limits;
• generating speech, corrections, interview feedback, and learning content;
• restoring sessions and preventing duplicate or unauthorized use;
• responding to inquiries and deletion requests;
• detecting, investigating, and preventing fraud, abuse, security incidents, and technical failures;
• complying with legal, accounting, tax, refund, and dispute-handling obligations; and
• improving the quality, accessibility, safety, and reliability of the Services.

We do not sell users' personal information.

4. Service Providers and Data Sharing

We may disclose or transmit information to service providers only to the extent necessary to provide the Services, including:

• Google: Google Sign-In, Google Play, Google Play Billing, Google Cloud Text-to-Speech, Android platform services, and Site analytics;
• Auth0 by Okta: authentication, session, and token management;
• OpenAI: speech-to-text, text generation, correction, evaluation, and, where configured, text-to-speech;
• OpenRouter, where configured: AI text processing;
• Polar, for web checkout and web entitlement management only;
• Cloudflare and hosting, database, storage, monitoring, and network providers: delivery, security, hosting, storage, and operations; and
• professional advisers, authorities, or other parties when reasonably necessary to comply with law, protect rights and safety, investigate abuse, or complete a business reorganization.

External providers may process information outside Japan and may independently handle some information under their own terms and privacy notices. Relevant notices include:

• Google Privacy Policy: https://policies.google.com/privacy
• Okta Privacy Policy: https://www.okta.com/privacy-policy/
• OpenAI Privacy Policy: https://openai.com/policies/privacy-policy/
• OpenAI Business Data Privacy: https://openai.com/business-data/
• Polar Privacy Policy: https://polar.sh/legal/privacy-policy
• Cloudflare Privacy Policy: https://www.cloudflare.com/privacypolicy/

5. International Processing

Because the Services use providers with international infrastructure, information may be processed or stored in Japan, the United States, Europe, Singapore, or other countries. We take reasonable measures to select and use providers with appropriate contractual, organizational, and technical safeguards, subject to applicable law.

6. Retention

We retain information according to its purpose and sensitivity:

• Account identifier, Username, learner profile, and durable game progress: generally retained while the account remains active or while needed to provide the Services, unless deletion is requested or continued retention is required by law or for security.
• Username change history and quota/limit records: retained as needed to enforce rolling limits, investigate abuse, and maintain an audit trail, then deleted or anonymized when no longer necessary.
• Raw microphone audio: processed for the active request and not intentionally persisted in the English Game primary database or default application storage by RISE.
• Temporary speech-derived text, corrected answers, conversation state, and runtime metadata: retained only for configured short-lived operational periods and automatically expired or deleted by cleanup processes unless selected results must be retained as durable progress or evaluations. Current service defaults use approximately one hour for raw-processing metadata and up to 30 days for temporary canonical conversation turns; these periods may be shortened for security or operational reasons.
• Generated downloads: retained until their configured expiration, user deletion, or service cleanup, as applicable.
• CEFR, lesson, interview, and profile results: retained as account-linked learning history until account deletion or until no longer required to provide the feature.
• Google Play and web billing records: retained while needed to provide entitlements and for refund, chargeback, fraud-prevention, accounting, tax, audit, and legal obligations.
• Technical and security logs: retained for the period reasonably necessary for security, incident response, debugging, rate limiting, and legal compliance, then deleted or anonymized.
• Support records: retained for the period reasonably necessary to resolve the request and prevent recurrence.

Deletion from active systems may not immediately remove encrypted backups. Backup copies are isolated from ordinary use and are deleted or overwritten according to the applicable backup lifecycle. We may retain records that have been anonymized so they can no longer reasonably be linked to a user.

7. Account and Data Deletion

Users may request deletion of their RX-36 account and associated data by emailing [email protected] with the subject:

Account Deletion Request - RX-36 Job Interview Quest

The request should include the Username and enough non-secret information for us to verify the account. Do not send a Google password, authentication token, payment card number, or other secret.

After verifying the request, we will delete or de-identify the account and associated personal data within a reasonable period, except for information that must be retained for legal, tax, accounting, refund, fraud-prevention, security, or dispute-handling purposes. Purchase and security records retained for these purposes will be restricted from ordinary game use.

Uninstalling the App, clearing local App data, or deleting a Google Account does not by itself guarantee deletion of the corresponding RX-36 server account. A separate deletion request is required unless the App provides and the user completes an in-App deletion flow.

8. User Rights and Choices

Subject to applicable law, users may request:

• access to information about themselves;
• correction of inaccurate information;
• deletion or de-identification;
• restriction of or objection to certain processing;
• withdrawal of consent where processing is based on consent; and
• information about applicable cross-border processing.

Users can:

• revoke microphone permission through Android settings;
• sign out through the App;
• manage or remove the App's access in their Google Account settings;
• clear local App data or uninstall the App;
• manage Site cookie preferences through the Site interface or browser; and
• contact [email protected] for privacy requests.

Revoking microphone access disables spoken-answer features but does not affect data already processed or information that must be retained.

9. Security

We use reasonable organizational and technical safeguards, including encrypted network transport, access controls, provider authentication, short-lived runtime data, secure token storage supported by Android/Auth0, and measures intended to reduce unnecessary personal-data storage.

No internet service or storage system can guarantee absolute security. Users are responsible for protecting their Google Account, device unlock method, and App access.

10. Children

The Services are not directed to children under 13. The App is intended primarily for users practicing English for education, employment, and job interviews. If we learn that we have collected personal information from a child under 13 without appropriate authorization, we will take reasonable steps to delete it.

If the target audience or child-directed features change, we will review and update our Google Play declarations, consent mechanisms, and this Policy.

11. Advertising

The Android App does not currently display third-party advertising and does not currently include Google AdMob. The Site may contain links or promotional content, but this is separate from an in-App advertising SDK.

Before introducing personalized or non-personalized advertising in the App, we will update this Policy and applicable Google Play disclosures and implement consent or age-appropriate controls where required.

12. Changes to This Policy

We may update this Policy when features, providers, laws, or data practices change. We will update the "Last Updated" date and provide additional notice where required for material changes.

13. Language

This Policy is provided in English and Japanese. If an interpretation differs, the Japanese version governs to the extent permitted by applicable law.

14. Contact

For privacy questions and requests:

• Operator: RISE (Japan)
• Email: [email protected]
• Privacy Policy URL: https://rx-36.com/privacy-policy/