Privacy Policy for DracoChinese

Introduction

Welcome to DracoChinese ("we," "our," or "us"). We are committed to protecting your privacy and ensuring transparency about how we collect, use, and safeguard your information. This Privacy Policy explains our practices regarding data collection and usage in our mobile application.

DracoChinese is a Chinese language learning application available on iOS and Android platforms. We take your privacy seriously and comply with applicable data protection laws, including the General Data Protection Regulation (GDPR) and California Consumer Privacy Act (CCPA).

Information We Collect

1. Personal Information You Provide

Account Information:

When you create an account with DracoChinese, we collect:

• Email address
• Password (encrypted and securely stored)
• Username or nickname (optional)
• Language preference

Authentication Information:

• If you sign in with Google OAuth, we receive your basic profile information (name, email) from Google
• If you sign in with Apple Sign In, we receive your basic profile information (name, email) from Apple

Support Communications:

• When you contact our support team, we collect the content of your messages and any information you choose to provide

2. Automatically Collected Information

Usage Data:

• Features you use within the app (articles read, characters practiced, flashcards studied, missions completed, course lessons and pronunciation exercises)
• Learning progress and statistics
• Session duration and frequency
• Feature access attempts and permission status

Device Information:

• Device type and model
• Operating system version
• Device identifiers (for crash reporting and analytics)
• App version
• Language and region settings

Performance Data:

• Crash reports and error logs
• App performance metrics
• API response times

3. User-Generated Content

Learning Data:

• Words from articles you save to favorites
• Flashcard study progress and ratings (Mastered/Review Needed/Not Familiar)
• Writing practice history
• Mission progress and scores
• Study session records

Important: All learning data is private to your account and is not shared with other users. DracoChinese does not have user-generated content features where content is shared publicly.

4. Information We Do NOT Collect

We do not collect:

• Payment information (handled by Apple App Store or Google Play Store)
• Biometric data
• Precise geolocation data
• Contacts or address book information
• Photos or media files (except when you explicitly use OCR scanning feature)
• Permanent microphone recordings — audio captured during pronunciation exercises is processed in real-time for scoring and immediately discarded; it is never stored on our servers
• Health or fitness information

How We Use Your Information

1. Core Service Delivery

Account Management:

• Create and maintain your user account
• Authenticate your identity
• Manage your subscription status (free vs. premium)

Learning Features:

• Provide personalized learning content
• Track your learning progress
• Synchronize your data across devices
• Enable flashcard study system with progress tracking
• Provide text-to-speech pronunciation
• Deliver articles with translations and audio

Content Delivery:

• Display Chinese articles with pinyin and translations
• Provide character stroke order animations
• Deliver gamified mission content
• Offer multi-language dictionary lookups

2. Service Improvement

Analytics and Optimization:

• Understand how users interact with our app
• Identify and fix bugs and errors
• Improve app performance and user experience
• Develop new features based on usage patterns

3. Communication

Service Communications:

• Send account-related notifications
• Provide customer support responses
• Send password reset emails
• Notify about account status changes (e.g., deletion recovery window)

Marketing Communications (Optional):

• Send promotional offers and updates about new features
• You can opt out of marketing emails at any time

4. Legal Compliance

• Comply with applicable laws and regulations
• Respond to legal requests and prevent fraud
• Enforce our Terms of Service
• Protect our rights and the rights of our users

Third-Party Services and Data Sharing

We integrate several third-party services to provide full functionality. These services may collect and process data according to their own privacy policies.

1. Backend and Authentication

Supabase (Database and Authentication)

• Purpose: Store user accounts, learning data, content
• Data Shared: Email, username, user preferences, learning progress
• Data Location: Cloud-hosted PostgreSQL database
• Privacy Policy: https://supabase.com/privacy

Google OAuth

• Purpose: Alternative sign-in method
• Data Shared: Email, basic profile information
• Privacy Policy: https://policies.google.com/privacy

2. Monetization Services

RevenueCat (In-App Purchase Management)

• Purpose: Manage subscription status and purchases
• Data Shared: User ID, subscription status, purchase history
• Privacy Policy: https://www.revenuecat.com/privacy

Google AdMob (Advertising)

• Purpose: Display advertisements to free users
• Data Shared: Advertising ID, device information, app usage
• GDPR Compliance: EU users are presented with consent dialog via Google User Messaging Platform (UMP)
• Personalized vs. Non-Personalized Ads: Users can control ad personalization in Privacy Settings
• Privacy Policy: https://policies.google.com/privacy

Important Note for Free Users:

• Advertisements are only shown to free-tier users
• Premium subscribers do not see any advertisements
• You can manage ad consent and personalization in Settings > Privacy & Ad Settings

3. Content and Feature Services

Google Cloud Text-to-Speech

• Purpose: Generate audio pronunciation for Chinese text
• Data Shared: Chinese text strings for pronunciation
• Data Retention: Audio files cached locally on device
• Privacy Policy: https://cloud.google.com/terms/cloud-privacy-notice

Youdao Dictionary API

• Purpose: Provide word definitions and translations
• Data Shared: Search queries (words and characters)
• Privacy Policy: https://www.youdao.com/terms/privacy.html

Tencent Cloud ASR (Speech Recognition)

• Purpose: Recognize spoken Chinese for pronunciation scoring in course lessons
• Data Shared: Short audio clips (WAV/AMR format, typically 1–5 seconds) captured during pronunciation exercises
• Usage: Only activated when you tap the microphone button in a pronunciation exercise
• Data Retention: Audio is processed in real-time and not stored by us or Tencent after recognition
• Privacy Policy: https://cloud.tencent.com/document/product/301/11470

Google Cloud Speech-to-Text

• Purpose: Alternative speech recognition provider for pronunciation scoring
• Data Shared: Short audio clips captured during pronunciation exercises
• Usage: Used as a fallback when primary provider is unavailable
• Data Retention: Audio is not retained after transcription per Google's API terms
• Privacy Policy: https://cloud.google.com/terms/cloud-privacy-notice

Microsoft Azure Speech Service

• Purpose: Fallback speech recognition for iOS pronunciation scoring
• Data Shared: Short audio clips captured during pronunciation exercises on iOS
• Usage: Only activated when primary providers are unavailable
• Data Retention: Audio is not retained after transcription per Microsoft's API terms
• Privacy Policy: https://privacy.microsoft.com/privacystatement

Tencent OCR Service

• Purpose: Recognize Chinese characters from images (OCR scanning feature)
• Data Shared: Images you explicitly scan using the writing feature
• Usage: Only activated when you use the scan function
• Data Retention: Images are not stored; processed in real-time
• Privacy Policy: https://cloud.tencent.com/document/product/301/11470

Cloudflare CDN

• Purpose: Host and deliver audio files for articles
• Data Shared: Standard web request information (IP address, user agent)
• Privacy Policy: https://www.cloudflare.com/privacypolicy/

4. Analytics and Error Tracking

Expo Application Services

• Purpose: App updates, build management, crash reporting
• Data Shared: Device information, crash logs, app version
• Privacy Policy: https://expo.dev/privacy

PostHog (Product Analytics)

• Purpose: Analyze anonymous usage patterns to improve app experience
• Data Shared: Anonymous user ID, in-app events (e.g. screen views, feature usage), device type, OS version
• Data Location: PostHog cloud servers
• Note: No personally identifiable information (name, email, etc.) is sent to PostHog
• Privacy Policy: https://posthog.com/privacy

5. Data Shared with Third Parties

We do NOT:

• Sell your personal information to third parties
• Share your learning data with advertisers
• Provide your email or contact information to third parties for marketing
• Share your data with data brokers

We MAY share anonymized, aggregated data that cannot identify you personally for industry research and reports, partnership discussions, and service improvement analysis.

Your Privacy Rights

1. Access and Portability

You have the right to:

• Access your personal information stored in our systems
• Request a copy of your data in a portable format
• View your learning progress and saved content within the app

2. Correction and Update

You can:

• Update your username/nickname in Settings > Account
• Change your email address in Settings > Account
• Modify your password in Settings > Account
• Change language preferences in Settings

3. Deletion

Account Deletion:

• You can delete your account via Settings > Account > Delete Account
• Smart Recovery System: Account marked for deletion with 30-day recovery window
• During 30 days: Login is blocked, but you can contact support to restore
• After 30 days: All data is permanently deleted

What Gets Deleted:

• User account and profile
• All learning progress and saved content
• Flashcard study records
• Favorites and bookmarks
• User preferences and settings

4. Opt-Out Rights

Marketing Communications:

• You can opt out of promotional emails via the unsubscribe link in emails
• Account-related emails (password reset, deletion notices) cannot be opted out

Personalized Advertising:

• EU users: Manage via Settings > Privacy & Ad Settings
• iOS users: Use "Limit Ad Tracking" in iOS Settings > Privacy > Advertising
• Android users: Use "Opt out of Ads Personalization" in Google Settings

5. Data Retention

Active Accounts:

• We retain your data as long as your account is active
• Learning data is stored indefinitely to preserve your progress

Deleted Accounts:

• 30-day recovery period for account restoration
• Permanent deletion after 30 days
• Some data may be retained in backups for up to 90 days

6. GDPR Rights (EU Users)

If you are located in the European Union, you have additional rights:

• Right to restriction of processing
• Right to object to processing
• Right to lodge a complaint with a supervisory authority
• Right to withdraw consent at any time

7. CCPA Rights (California Users)

If you are a California resident, you have rights under CCPA:

• Right to know what personal information is collected
• Right to know if personal information is sold or disclosed
• Right to opt out of sale of personal information (Note: We do not sell personal information)
• Right to deletion (subject to certain exceptions)
• Right to non-discrimination for exercising CCPA rights

Data Security

Security Measures

We implement industry-standard security measures to protect your data:

Technical Safeguards:

• Encryption in transit (HTTPS/TLS for all network communications)
• Encryption at rest (database encryption via Supabase)
• Secure password hashing (using bcrypt or similar algorithms)
• Secure API authentication with token-based access

Access Controls:

• Role-based access control for backend systems
• Multi-factor authentication for administrative access
• Regular security audits and vulnerability assessments

Data Isolation:

• User data is isolated at the database level
• No cross-user data access

Limitations

While we take reasonable measures to protect your data:

• No method of transmission over the internet is 100% secure
• No method of electronic storage is 100% secure
• You are responsible for maintaining the confidentiality of your password

Our Website and Free Tools

This section applies to our website www.dracochinese.com, including the free tools under /tools (such as the Chinese Name Generator).

1. No Cookies, No Advertising

• Our website does not set cookies and does not store any identifiers in your browser's local storage
• Our website does not display advertising and does not use advertising or cross-site tracking services

2. Website Analytics (PostHog)

• Purpose: Understand which pages and tools are used, so we can improve them
• Data Collected: Page views, tool usage events (e.g. a name was generated, a name card was saved), clicks on app store buttons, browser and device type
• Analytics run in a cookieless mode: each page visit is treated as a new anonymous visitor, and visits cannot be linked to you
• IP addresses are not stored, and data is stored on servers in the European Union
• Privacy Policy: https://posthog.com/privacy

3. Chinese Name Generator

• The name and gender preference you enter are sent to our server and processed by Anthropic (Claude API) to generate your Chinese name
• We do not store the names you enter or the generated results
• Your IP address is held temporarily in memory only to enforce a daily usage limit
• Name cards are created entirely in your browser; they are only shared if you choose to share them
• Anthropic Privacy Policy: https://www.anthropic.com/legal/privacy

Children's Privacy

DracoChinese is not directed to children under the age of 13 (or the minimum age in your jurisdiction).

Age Verification:

• We do not knowingly collect personal information from children under 13
• We do not have age verification mechanisms in place
• Parents/guardians are responsible for supervising children's use

If We Learn of Child Data:

• If we become aware that we have collected data from a child under 13, we will delete it promptly
• Parents can contact us to request deletion of their child's data

International Data Transfers

Data Location:

• Our backend services (Supabase) may store data in various regions
• Data may be transferred to and processed in countries other than your own
• We ensure appropriate safeguards are in place for international transfers

EU-US Data Transfers:

• We comply with applicable data transfer frameworks
• We use Standard Contractual Clauses (SCCs) where required

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our data practices, new features or services, legal or regulatory requirements, and user feedback.

Notification of Changes:

• We will update the "Last Updated" date at the top of this policy
• For material changes, we will notify you via in-app notification, email to your registered address, or prominent notice on our website

Your Continued Use:

• Continued use of the app after changes constitutes acceptance of the updated policy
• If you do not agree with changes, you may delete your account