Privacy Policy

Effective July 27, 2026

1. Who we are

Learn Mandarin is operated by SproutVest, LLC, a Washington limited liability company doing business as Learn Mandarin ("Learn Mandarin", "we", "us", "our"). This policy explains how we handle personal information on learnmandarin.app and its related services.

2. Information we collect

Information you give us

Email address

Collected only if you create an account. It identifies your account, allows you to sign in, and lets us send password-reset messages.

Password

Stored only as a salted PBKDF2 hash. We never store, log, or have access to your password in readable form, and we cannot recover it for you — we can only help you reset it.

Study progress

Which words you have studied, your review scheduling data, streaks, and counters. If you are signed in, this is synced to our servers so it is available on your other devices.

Information collected automatically

On-device storage

If you use Learn Mandarin without an account, your progress is stored only in your browser (IndexedDB) and is never transmitted to us. Clearing your browser data removes it.

Session cookie

When signed in, we set one strictly necessary cookie. It is HttpOnly and cryptographically signed, is not readable by scripts, and is used solely to keep you signed in.

Analytics

We use Google Analytics 4 to understand how the service is used in aggregate — which screens are visited, general device and browser type, and approximate location derived from IP address. Google Analytics sets its own cookies. We do not use it for advertising, and Google Signals and ad personalization are not enabled.

Server logs

Our hosting provider processes standard request data, including IP address and user agent, to deliver the service and protect it from abuse.

3. How we use information

• To provide the service: your account, your progress, and syncing between your devices.
• To send transactional email you request, such as password resets. We do not send marketing email.
• To keep the service secure, prevent abuse, and diagnose faults.
• To understand aggregate usage so we can improve the app.

Where the UK GDPR or EU GDPR applies, our legal bases are performance of a contract (running your account), legitimate interests (security, fault diagnosis, and aggregate analytics), and consent where required.

4. Service providers

We do not sell personal information and we do not share it for cross-context behavioral advertising. We rely on a small number of processors:

We may also disclose information if required by law, or to protect the rights, safety, or property of our users or ourselves.

5. Data retention

We keep your account and synced progress until you ask us to delete them. When you request deletion, we remove your account and associated progress within 30 days, except where we must retain something to comply with a legal obligation. Progress stored only on your device is under your control and can be cleared at any time from the Progress screen or by clearing your browser data.

6. Your choices and rights

You can export your progress to a file, import it, or reset it at any time from the Progress screen — no account required. To access, correct, or delete account data, email us at [email protected].

Depending on where you live, you may have rights to access, correct, delete, or receive a portable copy of your personal information, to object to or restrict certain processing, and to withdraw consent. Residents of California may request disclosure of the categories of personal information collected and its deletion; we do not sell or share personal information as those terms are defined under California law, and we will not discriminate against you for exercising any right. Residents of the UK or EEA may also lodge a complaint with their local supervisory authority. We respond to verified requests within the time required by applicable law.

You can opt out of Google Analytics using Google's browser opt-out add-on, or by blocking analytics cookies in your browser. The app works fully either way.

7. Children

Learn Mandarin is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has given us personal information, contact us and we will delete it.

8. Security

All traffic is served over HTTPS. Passwords are stored only as salted PBKDF2 hashes, session cookies are HttpOnly and signed, and changing your password invalidates existing sessions. No system can be guaranteed perfectly secure, but we aim to hold only what the service actually needs.

9. International transfers

We are based in the United States and our providers process data in the United States and other countries. If you access the service from outside the United States, you understand that your information will be processed there.

10. Changes to this policy

We may update this policy from time to time. We will change the effective date above and, for material changes affecting your rights, take reasonable steps to notify account holders.

11. Contact

Questions or requests about privacy: [email protected]