Privacy Policy

Effective September 28, 2026

1. Who we are

Learn Mandarin is operated by SproutVest, LLC, a Washington limited liability company doing business as Learn Mandarin ("Learn Mandarin", "we", "us", "our"). This policy explains how we handle personal information on learnmandarin.app and its related services.

2. Information we collect

Information you give us

Email address

Collected only if you create an account. It identifies your account, allows you to sign in, and lets us send password-reset messages. It is stored as soon as it is entered to create an account, before the emailed link that finishes the account is followed.

Password

Stored only as a salted PBKDF2 hash. We never store, log, or have access to your password in readable form, and we cannot recover it for you — we can only help you reset it.

Study progress

Which words you have studied, your review scheduling data, streaks, and counters. If you are signed in, this is synced to our servers so it is available on your other devices.

Purchases

If you buy the HSK 3–4 Unlock, payment is taken by Stripe on Stripe's own page, and we never see or store your card details. Stripe tells us the purchase is complete, and we keep its reference, which product it was, and when, against your account so the unlock follows you to your other devices. We do not store the amount, your card, or your billing address. Stripe keeps its own record of the sale under its own privacy policy.

Information collected automatically

On-device storage

If you use Learn Mandarin without an account, your progress is stored only in your browser (IndexedDB) and is never transmitted to us. Clearing your browser data removes it.

Session cookie

When signed in, we set one strictly necessary cookie. It is HttpOnly and cryptographically signed, is not readable by scripts, and is used solely to keep you signed in.

Analytics

We use Google Analytics 4 to understand how the service is used in aggregate — which screens are visited, general device and browser type, and approximate location derived from IP address. Google Analytics sets its own cookies. We do not use it for advertising: Google Signals and ad personalization are not enabled, and we never give Google the consent signals that would let it use this data to personalise adverts. Because the same pages show adverts, accepting the banner also allows the advertising cookies described under Advertising below.

Our host, Cloudflare, also runs Cloudflare Web Analytics on every page. Cloudflare adds it to a page as it serves it; when the app opens from the copy saved on your device, the app's own code adds the same script, so a return visit is counted too. It measures page loads and how quickly pages render. It sets no cookies, stores nothing in your browser, and builds no profile: it reports aggregate totals only, and we cannot use it to recognise you or follow you between visits. Because it is cookieless and identifies nobody, it runs without the consent banner; the analytics below and our advertising do not.

If you accept the consent banner, we also use HeyCatch (heycatch.ai), a product analytics service built on PostHog's analytics software, to see how people find and use the site. It is not loaded at all until you accept. Once it is loaded, your browser sends HeyCatch, at in.heycatch.ai: each page you open and when you leave it; the buttons and links you click, with their text, recorded automatically, including rapid repeated clicks; the page address and title; the page you came from and the link or campaign that brought you; your browser, operating system, device type, screen and window size, language and time zone; and a few events we send ourselves — when a study session starts and finishes and how many cards it had, when you finish an HSK band, when you are shown the HSK 3–4 Unlock, and when you start a checkout. Like any server your browser contacts, HeyCatch receives your IP address, which may be used to estimate your approximate location. It does not record your screen: session recording is switched off in the HeyCatch software this site uses. It does not record what you type into forms, and never your password.

If you are signed in, HeyCatch is told the random identifier our server gave your account and whether you have bought the HSK 3–4 Unlock, so that your activity on each of your devices is linked to that account. It is never told your email address or your name. When you sign out, it starts again under a new random identifier.

To recognise a return visit, HeyCatch keeps a random identifier in your browser: in a cookie on this site whose name begins ph_ and ends _posthog, and in your browser's local storage, along with a session number that changes after 30 minutes without activity. While you consent, the cookie expires 365 days after your most recent visit and the local storage copy stays until you clear this site's data. You can decline HeyCatch in the consent banner, and withdraw consent later from Cookie settings at the foot of the app. Withdrawing stops HeyCatch from the next page you open — it cannot be switched off inside a page it has already loaded — and deletes HeyCatch's identifier from your browser, the cookie and the local storage copy both, when you withdraw and again as you leave the app. Whenever you open the app while your answer is no, it deletes any such identifier it finds.

Deleting your Learn Mandarin account does not delete what HeyCatch has recorded about it. To have that deleted too, email [email protected] from the address on the account and we will ask HeyCatch to delete it. Ask before you delete the account if you can: once it is gone we may no longer be able to tell which of HeyCatch's records were yours.

Advertising

Adverts are served by Google AdSense (Google LLC). To show them, Google receives your IP address and information about your device and browser, and may set or read cookies and similar identifiers. Adverts are never personalised, for anyone: whatever you answer on the consent banner, we ask Google for non-personalised adverts on every request, so what you see is chosen from the page rather than from your interests or your visits to other sites. If you accept, Google may use its cookies to measure adverts, limit how often you see the same one and detect fraud; if you decline, or if your browser sends a Global Privacy Control signal, it sets none of those. The one cookie such a page can still receive is Google's test_cookie on doubleclick.net, which Google's advert code sets to check whether your browser accepts cookies at all; it carries no identifier and is not used to choose adverts. Until you have answered, no advert is shown at all.

If you are in the European Economic Area, the United Kingdom or Switzerland, the consent question is asked by Google's consent platform (Funding Choices, part of AdSense) rather than by our own banner, as Google requires there. To ask it, that platform loads before you answer: your browser fetches its scripts from fundingchoicesmessages.google.com and one script from pagead2.googlesyndication.com, which means Google receives your IP address and browser details, and it keeps your answer in two cookies on this site, FCCDCF and FCNEC. No advert is requested and no advertising cookie is set until you answer. Everywhere else that platform is not loaded at all. We tell the two cases apart using the country our hosting provider, Cloudflare, derives from your IP address when the page loads; we do not store it.

Server logs

Our hosting provider processes standard request data, including IP address and user agent, to deliver the service and protect it from abuse.

3. How we use information

• To provide the service: your account, your progress, and syncing between your devices.
• To send transactional email: the link that finishes a new account or resets a password, and a notice to your address if somebody tries to create a second account with it. We do not send marketing email.
• To keep the service secure, prevent abuse, and diagnose faults.
• To understand aggregate usage so we can improve the app.

Where the UK GDPR or EU GDPR applies, our legal bases are performance of a contract (running your account), legitimate interests (security, fault diagnosis, and aggregate analytics), and consent where required.

4. Service providers

We do not sell personal information, and because every advert here is non-personalised we do not share it for cross-context behavioral advertising as California law defines it. We rely on a small number of processors:

We may also disclose information if required by law, or to protect the rights, safety, or property of our users or ourselves.

5. Data retention

We keep your account and synced progress until you delete them. You can do that yourself at any time, from the Account section of the Progress screen, and it takes effect immediately — Delete your account sets out exactly what is removed and what stays on your device. If you ask us by email instead, we remove your account and associated progress within 30 days. Either way we may retain something where we must to comply with a legal obligation. Progress stored only on your device is under your control and can be cleared at any time from the Progress screen or by clearing your browser data. Deleting your account does not reach the analytics HeyCatch has recorded; see Analytics above for how to ask for that.

6. Your choices and rights

You can export your progress to a file, import it, or reset it at any time from the Progress screen — no account required. If you have an account, you can delete it and everything synced to it from that same screen. To access or correct account data, or to delete an account you can no longer sign in to, email us at [email protected].

Depending on where you live, you may have rights to access, correct, delete, or receive a portable copy of your personal information, to object to or restrict certain processing, and to withdraw consent. Residents of California may request disclosure of the categories of personal information collected and its deletion; we do not sell personal information, and we do not share it for cross-context behavioral advertising — as California law defines that term — because no advert here is personalised. We will not discriminate against you for exercising any right. Residents of the UK or EEA may also lodge a complaint with their local supervisory authority. We respond to verified requests within the time required by applicable law.

You can opt out of Google Analytics using Google's browser opt-out add-on, or by blocking analytics cookies in your browser. Adverts here are never personalised; you can decline advertising cookies in the consent banner, change what Google shows you elsewhere at My Ad Center, and read how Google uses information from sites that use its services. We honour Global Privacy Control. The app works fully either way — refusing costs you nothing.

7. Children

Learn Mandarin is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has given us personal information, contact us and we will delete it. We never show personalised advertising to anyone under 16, whatever they have agreed to — or to anyone else: every advert here is non-personalised, so this holds without our knowing your age, which we do not ask for or store.

8. Security

All traffic is served over HTTPS. Passwords are stored only as salted PBKDF2 hashes, session cookies are HttpOnly and signed, and changing your password or logging out ends every existing session. No system can be guaranteed perfectly secure, but we aim to hold only what the service actually needs.

9. International transfers

We are based in the United States and our providers process data in the United States and other countries. If you access the service from outside the United States, you understand that your information will be processed there.

10. Changes to this policy

We may update this policy from time to time. We will change the effective date above and, for material changes affecting your rights, take reasonable steps to notify account holders.

11. Contact

Questions or requests about privacy: [email protected]