Privacy policy

1. Who we are

The app is run by Chinese Teacher Laura (ChineseTeacherLaura.com), who is the “controller” of your personal data. Contact for anything privacy-related: kennedyusaf@gmail.com.

2. What we collect

• Account: your email address, a hashed password (we never see the password itself) or your Google sign-in identity, your username, and an optional full name (private, printed only on your certificates).
• Learning progress: lessons completed and their accuracy, word review (spaced repetition) boxes, XP per day and streaks, tones-practice scores, exam attempts with your answers, scores and certificates, journey passport stamps.
• Rewards: your red bean balance and history, the ducks and accessories you own, your profile showcase, and redeem codes you used.
• Purchases: PayPal order, capture and subscription IDs, the amount, currency and status, and which content they unlock (see section 4).
• Settings: email preferences, your time zone (so “today” and streak reminders match your day), and the journey-look preference.
• Technical data: our hosting providers keep short-lived server logs (IP address, browser type, the page requested, errors) to run and protect the service. We don't use analytics or advertising trackers.

3. Microphone & speech practice

Speaking exercises are optional and only start when you press the microphone button and allow access. Your recording is analysed inside your browser (pitch and tone scoring) and is never uploaded to us or stored: when the exercise ends, the audio is gone. We only save the result (for example, whether the exercise counted as correct).

Where your browser offers built-in speech recognition (for example Chrome, Edge or Safari), the app also asks it to recognise the Chinese words. Your browser may send that audio to its maker's speech service (such as Google or Apple) under their privacy terms; we never receive it. If you prefer, choose “Can't speak now” and rate yourself instead. Listening exercises use your device's own text-to-speech voices.

4. Payments

The HSK 2 unlock and Supporter subscriptions are paid through PayPal. You enter your payment details on PayPal, not on our site, so we never see or store card or bank details. PayPal tells us the order or subscription ID, amount and status so we can unlock your content. PayPal processes your payment under the PayPal privacy statement and keeps its own transaction records. Billing questions and refunds are covered in the terms.

5. How we use your data (and our legal bases)

• To provide the course: save progress, grade exams on the server, award beans, run leaderboards and certificates (performing our contract with you).
• To unlock and manage paid content and keep payment records (contract; legal obligations such as tax and accounting).
• To send account emails such as password resets and receipts (contract), and optional study reminders you can turn off at any time (legitimate interest / your consent).
• To keep the service secure and fair: rate limits, anti-cheating checks, fixing errors (legitimate interest).

We never sell or rent your personal data, and we don't use it for advertising.

6. What other learners can see

Your username, XP, exam scores, bean totals, ducks, showcase, Supporter badge and passport stamps appear on leaderboards and on your public profile page (/u/your-username), which signed-in learners can open. Your email address and full name are never shown to other learners. Choose a username that doesn't reveal your real name if you prefer.

7. Service providers (processors)

We use a few trusted providers to run the app. They process data only on our behalf, under their own security and data-protection terms:

• Supabase (database and sign-in; servers in Canada, ca-central-1): account and learning data.
• Vercel (website hosting, worldwide edge network): serves the pages and keeps short-lived request logs.
• PayPal (payments): see section 4.
• Google (only if you choose “Continue with Google”): confirms your identity and shares your name and email with us.
• Resend (email delivery, once email is switched on): your email address and the message content.

These providers may process data outside your country (for example in Canada or the United States). Where the law requires it, transfers are covered by the providers' standard contractual clauses or equivalent safeguards.

8. Cookies & local storage

We only use what the app needs to work. There are no advertising, analytics or cross-site tracking cookies, so there is no cookie banner.

• Sign-in cookies (sb-…-auth-token): keep you signed in. Strictly necessary.
• Preference cookies: lcwl_tz (your time zone, for daily goals and streaks) and journey (the China-journey look on or off).
• Local storage on your device: sound settings, whether you already allowed the microphone, whether Laura's helper is minimised, and the progress of a practice test. You can clear it in your browser at any time.
• PayPal sets its own cookies when you open its checkout, under PayPal's cookie policy.

9. Emails

We send account emails (sign-up confirmation, sign-in links, password resets, email-change confirmations), receipts and subscription notices. Study emails (streak reminders, a weekly progress digest) are optional: every one has an unsubscribe link, and you can switch them off in Settings → Email & reminders.

10. How long we keep your data

• Your account and learning data: for as long as your account exists. Delete your account and it is removed from our database straight away.
• Our copies of PayPal order and subscription records are deleted with your account. PayPal keeps its own records of payments as the law requires for tax and accounting.
• Server logs: kept by our hosting providers for a short time (days, not months).
• Backups made by our database provider may hold deleted data for a short time until they are overwritten.

11. Your rights (GDPR, UK GDPR, CCPA and similar laws)

Wherever you live, you can:

• Access and take your data: Settings → Download my data gives you everything we store about you as a JSON file.
• Correct it: change your username and name in Settings, or ask us.
• Delete it: Settings → Delete my account removes your account and data permanently. If you have a Supporter subscription, we cancel it in PayPal for you first.
• Object or withdraw consent: turn study emails off at any time; object to other processing by writing to us.
• Complain to your local data-protection authority (in the EU/UK) if you think we handled your data wrongly.

California residents: we don't sell or “share” personal information for cross-context advertising, and we don't use sensitive personal information beyond what the service needs. You won't be treated differently for using your rights. Write to kennedyusaf@gmail.com for any request we can't handle through Settings; we reply within 30 days.

12. Children

The app is a general-audience language course and is not directed at children under 13. Children under 13 (or under the age of digital consent in their country, up to 16 in parts of the EU) should only use it with a parent or guardian's permission and involvement, ideally on the parent's account. We don't knowingly collect personal data from children under 13 without parental consent. If you are a parent and believe your child has created an account without your consent, write to kennedyusaf@gmail.com and we will delete it.

13. Security

All traffic is encrypted (HTTPS). Passwords are hashed by our sign-in provider. Database rules let each learner read only their own private data, and everything that changes scores, beans or purchases runs on the server. No system is perfect, so please use a unique password.

14. Changes & contact

If we change this policy we update the date at the top, and for important changes we tell you in the app or by email. Questions or requests: kennedyusaf@gmail.com. See also the terms of use and the help page.