Learn Chinese Privacy Policy
This policy explains how Learn Chinese: New HSK 2026 handles information. It applies to the Learn Chinese mobile app and its support and authentication pages. The separate China Essentials travel app has its own privacy policy.
1. Using the app as a guest
You can use the app without creating an account. Guest study data is stored locally on the device and is not cloud-synchronised unless you later choose to create or link an account through the app’s supported adoption flow.
2. Information processed when you create an account
The app uses Supabase authentication. Depending on how you sign in and which features you use, it processes:
- Account information: email address, display name, Supabase user identifier, authentication provider and account/session timestamps. Passwords are processed by Supabase Auth and are not available to us in readable form.
- Learning progress: card and grammar progress, saved vocabulary, study sessions and resume state, daily activity, XP and learning totals, achievements, assessment results and mock-test attempts or draft responses.
- Content you create: personal deck names and descriptions, custom cards, imported Pleco vocabulary content and deletion markers used to keep synchronised deletions consistent.
- Preferences and sync records: study settings, vocabulary bookmarks, selected learning state, client schema version, last-sync time and other app state needed to restore the account across devices.
- Support information: your email address and anything you choose to include in a support, privacy or deletion request.
3. Information stored only on your device
The app keeps local copies of official study packs, progress, personal decks, imported content, preferences, mock-test drafts and other learning state so the supported parts of the app can work offline and recover after interruption.
If you choose a profile photo, the app reads the selected image, lets you crop it and stores the processed photo locally in the app’s account-scoped storage. The current implementation does not upload that profile photo to Supabase.
4. Cloud synchronisation
When you are signed in and connected, the app synchronises supported account-scoped learning records with Supabase. This includes learning totals and activity, card and grammar progress, saved vocabulary, assessments, study sessions and resume state, personal decks and cards, selected key-value app state and sync status. Mock-test attempts are also stored in Supabase for signed-in users.
Official HSK vocabulary, grammar and mock-test content is retrieved from or updated through Supabase. Downloaded vocabulary and eligible grammar packs are cached on the device. Mock tests are online-only, and private test audio is streamed through time-limited signed links rather than saved as a permanent offline audio pack.
5. How information is used
- to create, authenticate and secure your account;
- to provide flashcards, grammar, themed and personal vocabulary, tests and offline packs;
- to calculate and remember study progress, review scheduling, achievements and learning statistics;
- to synchronise and restore supported learning data across signed-in devices;
- to respond to support, privacy and account-deletion requests; and
- to protect the service and comply with applicable legal obligations.
6. Analytics, advertising and diagnostics
The current app dependencies and implementation do not include a third-party advertising SDK, behavioural analytics SDK or crash-reporting SDK. Learning statistics such as study time, streaks, cards reviewed and assessment results are processed to provide features to you; they are not third-party advertising analytics.
Supabase, app stores and network providers may process standard operational records such as IP address, request time, device or request headers and service logs to deliver, secure and diagnose their services under their own terms and policies.
7. Service providers
Supabase
Supabase provides authentication, the hosted database, cloud synchronisation, server functions and private media delivery. It processes the account and synchronised learning information described above on our behalf.
Cloudflare
Cloudflare hosts these public web pages and static assets. Standard network information such as IP address, request time, requested path and browser or device headers may be processed to deliver and secure the site.
Apple and Google
Apple or Google may process store downloads and, when enabled and chosen, provider sign-in information under their own policies. The app receives only the authentication result and profile fields made available through the sign-in flow.
We do not sell personal information and do not use it for third-party behavioural advertising.
8. Account deletion
To delete an account in the app, go to Profile → Settings → Account → Delete Account, select the confirmation checkbox and choose Delete Account. The flow requires a connection and reports success only after server deletion is confirmed.
Confirmed deletion removes the Supabase Auth account and associated personal cloud records, including personal decks and cards, card and grammar progress, saved vocabulary, study activity and totals, sessions and resume state, sync/key-value state, assessment results and mock-test attempts. It then clears that account’s local preferences, personal files, profile photo and mock-test data on the device. Shared official HSK, grammar and test content is not deleted.
If you cannot access the app, follow the email instructions on the support page. Account deletion is separate from signing out. Uninstalling the app removes local app data from that device but does not by itself delete the cloud account.
9. Retention
Account and synchronised learning data are generally retained while the account is active. Local data remains on a device until removed through normal app use, confirmed account cleanup, clearing app storage or uninstalling the app. Support correspondence may be retained as reasonably needed to answer the request, document its resolution, protect security or meet legal obligations.
Residual copies may remain temporarily in routine service-provider backups until those backups rotate. App-store records are controlled by Apple or Google under their own retention policies.
10. Security and your choices
Access to account data is restricted through authenticated, account-scoped access controls. No internet service can be guaranteed completely secure. Protect access to your device and email account, and contact us if you suspect unauthorised access.
Depending on where you live, you may have rights to access, correct, delete, restrict or receive a copy of personal information. Email support@chinaessentials.app. We may need to verify control of the account.
11. Children
The app is intended for people who can lawfully create and manage their own account, or who use it with any consent required where they live. Contact us if you believe personal information was provided without required consent.
12. Changes and contact
We may update this policy as the app or its data practices change. The current version will be published here with its effective date. Questions can be sent to support@chinaessentials.app.