Privacy Policy

Effective August 16, 2026

1. Who we are

Learn Mandarin is operated by SproutVest, LLC, a Washington limited liability company doing business as Learn Mandarin ("Learn Mandarin", "we", "us", "our"). This policy explains how we handle personal information on learnmandarin.app and its related services.

2. Information we collect

Information you give us

Email address

Collected only if you create an account. It identifies your account, allows you to sign in, and lets us send password-reset messages.

Password

Stored only as a salted PBKDF2 hash. We never store, log, or have access to your password in readable form, and we cannot recover it for you — we can only help you reset it.

Study progress

Which words you have studied, your review scheduling data, streaks, and counters. If you are signed in, this is synced to our servers so it is available on your other devices.

Information collected automatically

On-device storage

If you use Learn Mandarin without an account, your progress is stored only in your browser (IndexedDB) and is never transmitted to us. Clearing your browser data removes it.

Session cookie

When signed in, we set one strictly necessary cookie. It is HttpOnly and cryptographically signed, is not readable by scripts, and is used solely to keep you signed in.

Analytics

We use Google Analytics 4 to understand how the service is used in aggregate — which screens are visited, general device and browser type, and approximate location derived from IP address. Google Analytics sets its own cookies. We do not use it for advertising, and Google Signals and ad personalization are not enabled.

Advertising

Adverts are served by Google AdSense (Google LLC). To show them, Google receives your IP address and information about your device and browser, and may set or read cookies and similar identifiers. Whether it may use those to personalise what you see depends entirely on your answer to the consent banner: if you agree, adverts are personalised; if you decline, or if your browser sends a Global Privacy Control signal, you are shown untargeted adverts instead. Until you have answered, no advert is shown at all.

Server logs

Our hosting provider processes standard request data, including IP address and user agent, to deliver the service and protect it from abuse.

3. How we use information

• To provide the service: your account, your progress, and syncing between your devices.
• To send transactional email you request, such as password resets. We do not send marketing email.
• To keep the service secure, prevent abuse, and diagnose faults.
• To understand aggregate usage so we can improve the app.

Where the UK GDPR or EU GDPR applies, our legal bases are performance of a contract (running your account), legitimate interests (security, fault diagnosis, and aggregate analytics), and consent where required.

4. Service providers

We do not sell personal information. If you agree to personalised advertising, information about your device and your browsing is made available to our advertising provider in the way California law calls sharing for cross-context behavioral advertising; you can decline in the consent banner, and change your answer afterwards from the consent settings in the app, without losing any part of it. We rely on a small number of processors:

We may also disclose information if required by law, or to protect the rights, safety, or property of our users or ourselves.

5. Data retention

We keep your account and synced progress until you delete them. You can do that yourself at any time, from the Account section of the Progress screen, and it takes effect immediately — Delete your account sets out exactly what is removed and what stays on your device. If you ask us by email instead, we remove your account and associated progress within 30 days. Either way we may retain something where we must to comply with a legal obligation. Progress stored only on your device is under your control and can be cleared at any time from the Progress screen or by clearing your browser data.

6. Your choices and rights

You can export your progress to a file, import it, or reset it at any time from the Progress screen — no account required. If you have an account, you can delete it and everything synced to it from that same screen. To access or correct account data, or to delete an account you can no longer sign in to, email us at [email protected].

Depending on where you live, you may have rights to access, correct, delete, or receive a portable copy of your personal information, to object to or restrict certain processing, and to withdraw consent. Residents of California may request disclosure of the categories of personal information collected and its deletion; we do not sell personal information, and we share it for cross-context behavioral advertising — as California law defines that term — only where you have agreed to personalised adverts, which you may withdraw at any time from the consent settings in the app. We will not discriminate against you for exercising any right. Residents of the UK or EEA may also lodge a complaint with their local supervisory authority. We respond to verified requests within the time required by applicable law.

You can opt out of Google Analytics using Google's browser opt-out add-on, or by blocking analytics cookies in your browser. You can refuse personalised advertising in the consent banner, change what Google shows you at My Ad Center, and read how Google uses information from sites that use its services. We honour Global Privacy Control. The app works fully either way — refusing costs you nothing but the targeting.

7. Children

Learn Mandarin is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has given us personal information, contact us and we will delete it. We never knowingly show personalised advertising to anyone under 16, whatever they have agreed to. We do not ask your age and do not store one, so in the ordinary case we do not know it — this is a promise about what we do knowingly, not a claim to have verified anybody.

8. Security

All traffic is served over HTTPS. Passwords are stored only as salted PBKDF2 hashes, session cookies are HttpOnly and signed, and changing your password invalidates existing sessions. No system can be guaranteed perfectly secure, but we aim to hold only what the service actually needs.

9. International transfers

We are based in the United States and our providers process data in the United States and other countries. If you access the service from outside the United States, you understand that your information will be processed there.

10. Changes to this policy

We may update this policy from time to time. We will change the effective date above and, for material changes affecting your rights, take reasonable steps to notify account holders.

11. Contact

Questions or requests about privacy: [email protected]