Jimaku — Privacy Policy

Updated: 30 October 2026

Jimaku adds subtitles to YouTube videos. This policy covers the Chrome extension, the patch for the YouTube app on Android, the website, optional accounts, payments and support. Jimaku does not sell your data or use it for advertising or analytics.

The person responsible for your data (the controller) is Felix Keller, trading as Felix Design. For privacy questions, email contact@jimaku.app. The controller's postal address is provided in the Impressum — postal address, which forms part of this policy's controller contact information.

What data Jimaku uses

• Subtitles: when you open a YouTube video, Jimaku sends its video ID to check for available subtitles, without an installation or account identifier. It does not save a history of these lookups. When you request new subtitles, Jimaku processes the video ID, title, language, duration and subtitle mode, together with the audio or YouTube captions needed to create them. The request is linked to your installation and any minutes used from your balance. Audio, captions and titles may contain personal information about people in the video. Standard captions are read through your browser's YouTube session.
• Minutes and accounts: Jimaku uses a random installation identifier and authentication data to manage requests, free allowances and minute balances. Google sign-in links your minutes across browsers and reinstalls. Jimaku keeps Google's account ID, but not your Google name, email, picture, password or sign-in token. It does not request access to Gmail, contacts or Drive. Watching existing subtitles and Standard need no sign-in; claiming promotional minutes and buying minutes require it. Signing in alone does not claim the promotion. If the operator gives your account minutes, Jimaku also keeps the name the operator noted for it and the minutes given.
• Promotion protection: Jimaku records whether your account has claimed. A keyed recognition code derived from the verified Google account ID prevents repeat claims, including after account deletion. Ten-minute account and network counters limit claim attempts. Network codes are derived from the connecting IP address with a secret key that also binds each code to its time window; these records do not store raw IP addresses or use device fingerprinting.
• Payments: Stripe/Link collects billing and payment details on its own checkout page. Jimaku keeps transaction references, amounts, purchased minutes and payment, refund and dispute status to manage your balance and purchases. Jimaku does not receive your card details. The operator can see customer and transaction information made available by Stripe for payment support.
• Service security: hosting providers receive your IP address and request metadata. Jimaku uses a daily code derived from your IP address to limit abuse when new installations are registered, and usage counters to apply allowances. Operational logs and cost records help diagnose failures and run the service.
• Support: if you email Jimaku, it receives your email address, message and any attachments, and uses them to respond to your request.

Jimaku does not access unrelated browsing history or the contents of other websites. Its website uses no advertising or analytics cookies. After checkout, the website passes a transaction reference to the extension, which takes you back to its account page to confirm your payment and show it as a receipt with Stripe's payment ID. The return addresses can remain in browser history and hosting logs.

Who receives data

• Cloudflare hosts the website and service, stores Jimaku's service records and subtitles, and forwards support emails to the operator's mailbox.
• OpenRouter and Microsoft Azure receive video audio to transcribe it for Premium subtitles.
• DeepSeek receives subtitle text and the video title for translation directly through its service. OpenAI can receive translation content when the optional ChatGPT fallback is enabled. These subtitle providers do not receive your Jimaku installation or account identifiers, but the content itself can contain personal information.
• Google handles optional sign-in and hosts the support mailbox in Gmail. YouTube supplies the video's audio and captions.
• SMTP2GO (Sand Dune Mail Ltd, New Zealand) delivers outgoing support emails through its EU sending service. It processes recipient addresses, message content, attachments and delivery information. Email open and click tracking are disabled.
• Stripe/Link handles payments, tax, receipts, fraud checks, refunds, disputes and payment support. Link is the merchant of record for purchases.

Google, OpenAI, SMTP2GO and Stripe explain their processing in their Google, OpenAI, SMTP2GO and Stripe privacy policies.

These services may process data outside the European Economic Area, including in the United States and, for DeepSeek, China. Contact Jimaku for information about the international transfer safeguards applicable to your data.

How long data stays

• Installations, accounts and balances: installation and balance records have no automatic expiry, because minutes do not expire. Account records remain until you request deletion.
• Promotion recognition and attempts: the recognition code remains while the promotion can still accept claims, including during a temporary pause and after account deletion. Once the deadline or total allowance permanently closes it, hourly cleanup removes the code within 24 hours. Attempt counters expire at the end of their ten-minute window and are removed by hourly cleanup within 24 hours. A missed cleanup deadline is a service failure to remedy, not an extension of this retention period. Aggregate issuance totals remain for reporting; a surviving account keeps its claimed status until account deletion. Recognition data is not anonymous and is not a copy of your deleted balance or raw Google identity.
• Purchases: payment, refund and dispute records currently have no automatic deletion schedule. Deleting your account removes its link to these records, but transaction references remain identifiable through Stripe.
• Subtitle requests: records linking a request to your installation and balance are deleted about a day after completion or failure. Original Standard caption text is processed temporarily and is not saved. Standard results are deleted from the service within two days. Premium subtitles and video titles are kept without a fixed expiry so other viewers can use them; the shared archive contains text, not audio or video. Contact Jimaku to request removal of a video's subtitles.
• Usage and operational records: daily usage counters and the daily IP-derived code are cleared when the corresponding activity occurs on a later day. Operational logs are overwritten as their storage fills, with no fixed retention period in days. Separate cost records identify the video and generation outcome, but not your installation or account, and have no fixed expiry.
• Support messages: kept while needed to resolve your request, an open dispute or legal claim, or a specific recordkeeping obligation. SMTP2GO keeps delivery records and email headers for 35 days. It also keeps a sample of sent messages for 35 days to detect abuse.

The extension stores preferences, authentication data, pending requests and recent Standard subtitles in your browser, and the amount of the last checkout it opened until the browser closes. Older subtitles are removed as storage fills; pending requests are cleared when resolved or replaced. Uninstalling removes local extension data, but does not delete your account or server records. Synced preferences are also subject to your browser's sync controls.

The YouTube app on Android

Jimaku's patch for the YouTube app, which you apply yourself with Morphe Manager, handles the same data as the extension, under the same rules above. It sends the video ID and your language to find subtitles, uses a random installation identifier and authentication data for requests and minutes, and for Standard sends the video's YouTube captions, which it reads from YouTube as the app. Its requests carry no YouTube account data or cookies; their User-Agent names only Jimaku and the patch's version.

Signing in and buying minutes happen in your phone's browser: Google sign-in on www.jimaku.app, where a one-time code from the app links its installation to your account, and payment on Stripe's checkout page. No Google sign-in token passes through the app.

The app keeps your preferences, its installation identifier and authentication data, the account details it last read, recent subtitles and a waiting request in the YouTube app's data on your phone. Clearing the YouTube app's storage or uninstalling it removes them, but does not delete your account or server records. Morphe Manager downloads the patch from GitHub; Morphe and GitHub handle that download under their own policies.

Why Jimaku may use this data

Jimaku processes data to provide the subtitles, accounts, purchases and related support you request (performance of a contract, Article 6(1)(b) GDPR). Preventing abuse, protecting the service and keeping necessary operational records serve its legitimate interests in running a reliable service (Article 6(1)(f)). Data needed to meet a specific legal obligation is processed under Article 6(1)(c).

Without the data needed for a requested feature, Jimaku cannot provide that feature. Jimaku does not create advertising profiles or make solely automated decisions with legal or similarly significant effects. Stripe may conduct its own fraud checks.

Your choices and rights

Subject to the applicable conditions, you can ask to access, correct or delete your personal data, restrict its use, or receive a portable copy. You can object to processing based on legitimate interests. If processing relies on consent, you can withdraw it without affecting earlier processing.

Email contact@jimaku.app to exercise these rights. To have your account deleted, include the account ID shown at the foot of the signed-in account page. Jimaku may need to verify that the request concerns your account. Never email passwords, authentication secrets or card details.

Signing out preserves your account and minutes. Account deletion removes your Google account ID and balance, unlinks your installations and removes the account link from purchases. Ask about remaining paid minutes before deletion. The retained payment records and bounded promotion recognition data described above are not immediately deleted. For records held by Stripe/Link, contact Link support.

You can complain to a data protection authority where you live or work, or to the Baden-Württemberg authority responsible for Jimaku.

Jimaku's use and transfer of Google API data follows the Google API Services User Data Policy, including Limited Use. Data handled by the extension is used for its disclosed features in accordance with the Chrome Web Store User Data Policy, including Limited Use.

The date at the top of this policy shows when it was last updated.