Last updated: October 24, 2026

This privacy notice explains how Enigma Byte, LLC ("Enigma Byte", "we", "us", or "our"), the company that operates HanyuGuide, processes personal information through HanyuGuide. It applies to the HanyuGuide website, mobile app, and AI assistant connections.

Data Collection and Usage

Website analytics is performed with Cloudflare Web Analytics. From our due diligence, we believe these are the best analytics options for our users' privacy and business needs.

Cloudflare Turnstile is used on registration to prevent bots from registering for accounts. Your IP address will be sent to Cloudflare in this process. Turnstile does not harvest data for ads retargeting.

We use Sentry to investigate errors and reliability problems. Automatic collection of default personally identifiable information is disabled. Error reports can still contain technical information, such as error messages, stack traces, app or browser versions, device and operating-system information, and diagnostic context. Disabling default personal-data collection does not mean that every diagnostic report is anonymous. Sentry does not record website sessions; see Service Improvement for the recordings we make.

We use AI tools from outside providers to help us run HanyuGuide, for example to investigate errors, read our analytics and diagnostic reports, review admin and support records, and draft replies to your emails. When we do, these tools may process personal information we already hold as described in this notice, such as your email address, account and study details, error reports, usage events and messages you send us. These providers handle this information under their own privacy policies.

HanyuGuide stores first-party demo funnel events, such as demo completion and post-demo clicks, under a random visitor ID kept in a cookie for up to 30 days. When you practice in a demo or on a public flashcard page without an account, we also store each card you are shown and your answer: the word, whether you marked it as known, when the card appeared and when you answered, the level you chose, and the site language. We use this to learn which words and demo lengths help people keep learning. If you create an account with the same visitor ID, those events may be associated with your account so we can understand whether the demo helped you decide to sign up. When you open the pricing page or start a checkout, we store that event under the same visitor ID with the HanyuGuide page you came from, the plan you chose, its currency and discount, and how many days ago you signed up, so we can learn which pages help people decide to subscribe. Payment details stay with our payment providers: Stripe, or HitPay for local payment methods such as QR Ph, DuitNow and UPI.

Advertising measurement with Meta

We measure our Facebook and Instagram ads differently on the website and in the Android app. On the website, only visitors who arrived from one of our Meta ads are reported: for them, our servers share events such as signing up or making a purchase, with the ad click identifier, hashed identifiers such as your email address, and technical details such as your IP address and browser. The website does not use the Meta Pixel, and visitors who did not come from a Meta ad and classroom-managed student accounts are not shared.

The Android app includes Meta's software development kit (SDK). For everyone who uses the Android app, however they found it, it tells Meta Platforms, Inc. when the app is installed and opened, when you create an account, when you finish your first lesson and when you buy a plan (with the plan, price and currency), together with your device's advertising ID and basic device information such as the model, operating system, language and IP address. Meta can only tell which installs came from its ads by seeing every install. Meta uses this to tell us which ads led to these actions and to show our ads to people likely to find HanyuGuide useful. The app never sends Meta your email address, your name or what you study. The iPhone app sends nothing to Meta.

In the Android app you can stop this by choosing "Don't record my sessions" in the app's Settings, or by deleting your advertising ID in your phone's settings. See the Meta Privacy Policy.

If you arrive at HanyuGuide from a Google ad, our servers share the same kinds of events with Google Ads, such as starting a lesson, signing up, or making a purchase, so we can measure our ads. These events include only the ad click identifier Google added to the link, the event time, and for purchases the amount and currency. We do not use the Google tag. Visitors who did not come from a Google ad and classroom-managed student accounts are not shared. See the Google Privacy Policy.

Customer lists for advertising

We may also give Meta and Google a list of people who bought a HanyuGuide plan, however they found us, so their ad systems can measure our ads, avoid showing them to existing customers and find new people similar to our customers (Meta Custom Audiences and Google Customer Match). The list holds your email address, hashed on our side before it is sent, and may include your country and what you bought. Meta and Google match it against their own accounts and use it only for our ads. We never include classroom-managed or school student accounts, learners who never paid, or people in the European Economic Area, the United Kingdom or Switzerland. To be left out, email hey@hanyuguide.com.

When you use reading and dictionary tools, HanyuGuide may process Chinese terms from the text you provide to detect new or missing dictionary words. Missing-word detection is limited to Chinese terms; punctuation, Latin text, and mixed non-Chinese text are not stored as dictionary requests.

Your email is collected on signup and login. We may occasionally use your email address to contact you regarding your experience with HanyuGuide, including product updates, feedback requests, and important service announcements. When you opt in to non-essential communications, we may sync your email address, locale, timezone, trial timing, and subscription-suppression status to Resend so Resend can deliver those messages and manage unsubscribe preferences. You may opt out of non-essential communications at any time. The only slightly non-intuitive pieces of data we need are the timezone (which is available to any webpage you visit), which we use to calculate daily study statistics, and the country code (based on your IP address), which we store on your account to calculate PPP pricing and to understand which countries our learners come from. Your study history is stored when you study while logged in. This is necessary for proper functioning of the app and to improve HanyuGuide's educational features. On account deletion, study data and other non-personal data is anonymized. Your email is deleted with your account record.

Google sign-in

If you choose to sign in with Google, Google provides HanyuGuide with your email address, whether Google has verified that email, and a unique identifier for your Google account. Google may also return basic profile information, such as your name and profile picture, during sign-in. We use the account identifier, email, and verification status to create or sign you in to your HanyuGuide account, keep Google sign-in connected to the correct account, and protect the sign-in process. HanyuGuide stores the Google account identifier, the email address Google provided, its verification status, and when the identity was last used. We do not store Google access or refresh tokens, and we do not retain other Google profile details. The stored Google sign-in record is deleted when your HanyuGuide account is deleted. We do not request access to Gmail, Google Drive, contacts, or calendars, or share your Google account identifier for advertising. Any later use of your HanyuGuide account email, including service messages and optional communications, follows the email practices described above.

Educators may provide student names or classroom display names, optional school email addresses, classroom placement, assignments, and seat information when they manage a classroom dashboard. Educators must confirm that they are authorized to provide student information before using those student-management tools. Classroom-managed username accounts use an internal email address only so the login system can operate; that internal address is not a student contact address.

For classroom-managed students, HanyuGuide uses student data only to provide, support, secure, and improve the educational service. Student study activity may be used to improve spaced repetition scheduling, assignment progress, curriculum quality, and learning recommendations, but HanyuGuide does not use student data for targeted advertising, resale, unrelated commercial profiles, or direct marketing to classroom-managed students. Additional classroom terms are available in the Student Data Addendum.

AI Assistant Connections

HanyuGuide offers tools that AI assistants such as ChatGPT and Claude can call through the Model Context Protocol (MCP). Using them requires connecting a free HanyuGuide account; dictionary lookup, pinyin conversion, character strokes, and HSK quiz words are free for every account. When an assistant calls a tool, it sends HanyuGuide only the tool request it prepares, such as the word or text to look up, an HSK level, and a language code. We do not receive your conversation with the assistant. We use the request to return the result, and we use the connected account and the connection's IP address to apply rate limits and prevent abuse.

If you choose to connect a HanyuGuide account, you sign in on HanyuGuide and approve the permissions the assistant requests. We store a record of that authorization: the connecting app, the permissions you approved, and when access expires. Expired and revoked authorizations are removed regularly. With your approval, the assistant can read your study context, such as recently studied and difficult words, a study summary, and your personal study lists, and, if you granted list permissions, add, move, or remove words and create, rename, reorder, archive, or restore personal lists. Connected assistants cannot change your study progress, preferences, or billing. Each list change an assistant makes is recorded with how the list looked before, so we can undo it if you ask; these records are deleted when your account is deleted.

Results HanyuGuide returns to an assistant are then processed by that assistant's provider under its own privacy policy, for example OpenAI or Anthropic. You can disconnect HanyuGuide in your assistant's settings at any time, or email hey@hanyuguide.com and we will revoke the connection.

Mobile App

On-device study and optional account connection

You can use on-device study without creating a HanyuGuide account, subject to the app’s subscription requirements. Study history, saved word lists, learning preferences, and downloaded pronunciation recordings are stored on your phone. Connecting an account through email codes or Google is optional. If you choose to transfer phone progress to an account, the selected words, lists, and study progress are sent to HanyuGuide. Account-based study uses our servers to provide and save your learning activity.

The app downloads pronunciation audio ahead of your study queue and reuses cached recordings. Online dictionary lookups and example requests send the requested search text or word to HanyuGuide. Requests to our servers and audio hosting providers also involve technical connection information, including an IP address. Audio playback does not record your voice.

App Store, Google Play and RevenueCat

Apple processes purchases made through the App Store, and Google processes purchases made through Google Play. HanyuGuide uses RevenueCat to validate purchases, determine subscription access, restore purchases, and understand subscription activity. RevenueCat processes purchase history, product and transaction identifiers, subscription status and dates, and an app user identifier. Without a connected account, this identifier is generated by RevenueCat. When you connect an account, we provide your HanyuGuide account identifier so purchase access can be associated with that account. We do not receive your full payment-card details from Apple or Google.

See RevenueCat’s Privacy Policy Apple’s Privacy Policy, and the Google Privacy Policy for their practices.

Notifications and widgets

Study reminders are optional and scheduled on your phone using your study activity. Allowing study reminders does not opt you into promotional notifications. If you separately enable offers, we register a push token with Expo and store a device registration identifier, the push token, and your promotional consent status and time. These records let us address notifications to your device and honor your choices. Remote notifications use Expo’s push service with Apple’s notification service on iPhone or Firebase Cloud Messaging on Android, which process delivery tokens and notification content.

You can turn study reminders and offers off separately in the app’s Settings, or control notification permission in your phone’s settings. Turning offers off records your opt-out; it does not automatically delete the registration record. On iPhone, widgets and Live Activities share the upcoming word and study-session information with the app’s iOS extension on your device. Information shown on your Lock Screen may be visible to anyone who can see that screen. You can remove widgets and control Live Activities in iOS.

Diagnostics and app updates

The mobile app sends error reports to Sentry with default personal-data collection disabled; we do not set your account identity in mobile Sentry reports or use Sentry session replay. The app's usage analytics and session recordings are described under Service Improvement. The app also contacts Expo to check for and download compatible app updates. Those requests include technical information needed to deliver the correct update, such as the app platform and runtime version, and expose connection information such as an IP address. On Android, the app uses Google Analytics for Firebase to measure our own Google Ads campaigns, as described under Service Improvement; it also includes Meta's SDK, as described under Advertising measurement with Meta. The app shows no ads, and the iPhone app includes neither. See the Sentry and Expo privacy policies.

Service Improvement

To learn where learners get stuck, we may record new learners' website sessions on the day they sign up, and any signed-in learner's visits to the pricing page, using PostHog Session Replay, with recordings stored in the United States. A recording shows the HanyuGuide study, course, dashboard and pricing pages as you saw them, with your taps, clicks, scrolling and page changes, plus technical details such as your browser, device type and the page addresses. Anything you type into a field is hidden before the recording leaves your browser. Recordings are not linked to your name or email address, and we do not record settings, account, classroom or admin pages, the payment pages run by our payment provider, or classroom-managed or school student accounts. PostHog keeps a random identifier in your browser's local storage so one visit's pages form a single recording. We use recordings only to find and fix problems in HanyuGuide, never for advertising, and PostHog keeps them for up to 90 days.

The mobile app uses PostHog the same way. It records which screens you open and the steps you take, such as installing and opening the app, each onboarding and lesson step, viewing plans and starting, finishing or cancelling a purchase, with the plan, price and currency, and it records sessions of the app's screens with your taps. Anything you type is hidden in recordings. Events carry technical details such as the app version, device model, operating system, app language and an approximate location (country and city) that PostHog derives from your IP address. Without a connected account, events use a random identifier PostHog stores on your phone; after you connect an account they use your HanyuGuide account identifier, never your name or email address. We also give RevenueCat this PostHog identifier so purchase and renewal records can be matched to the same events. Team accounts and classroom-managed or school student accounts are not recorded.

When you finish the app's first questions, we save your answers (why you are learning Chinese, the skills you want, how much you know, your HSK level and daily goal) on our servers. We store them with a random identifier for that install, the PostHog identifier described above, the app platform, version and language, and with your account if you are signed in. We use them to set up your study plan and to decide what to build next.

On Android, the app also uses Google Analytics for Firebase so our Google Ads campaigns can learn which ads bring learners who finish their first lesson. It records that the app was installed and opened, how long it was used, and when you finish your first lesson, with your device's advertising ID and an app instance identifier, device model, operating system, app version and approximate location. Google receives this information, including the advertising ID, to measure and improve our ads, and may use it as described in its privacy policy. It is not linked to your name, email address or HanyuGuide account, and we do not sell it. You can reset or delete your advertising ID in your phone's settings, and choosing "Don't record my sessions" in the app's Settings also turns this off on that phone. Unlike the website, which reports only visitors who came from a Google ad, the Android app reports this for everyone who uses it. It is off for classroom-managed and school student accounts.

You can turn recordings off at any time in Settings on the website, or in the app's Settings, by choosing "Don't record my sessions". On the website this stops any recording on your next page; in the app it stops both the usage events and the recordings from that phone, and choosing it on the website also stops them in the app while you are signed in.

Your Data and Deletion Choices

You can delete a connected HanyuGuide account from Settings → Delete account in the app, or from your profile on the website. Account deletion does not erase the separate progress stored on your phone, cancel an Apple or Google Play subscription, or automatically erase records held by Apple, Google or RevenueCat. Removing the app deletes its local study files from that installation; copies may remain in device backups according to your backup settings. Purchase records may remain with the payment and subscription providers under their retention policies and legal obligations. Contact hey@hanyuguide.com to request access to or deletion of service records, including a push registration or purchase-linked records; we may need information to verify and locate those records.

When you delete your account, it is removed from our live database right away. We also back up the database every night so we can recover from data loss, and backups made before you deleted your account still contain your account and study data until they expire. We keep a backup from each of the last 7 days, one from each of the 4 weeks before that, and one from each month for 12 months, so your data is gone from every backup within about 13 months. Backups are encrypted and stored in a private storage bucket at Cloudflare, our storage provider, that only we can access, and we use them only to recover from data loss or damage. To make sure a restore cannot bring a deleted account back, we keep a list of the internal ID numbers of deleted accounts, with no email address or other details, and after any restore we delete those accounts again before the restored data is used.

Security

We use commercially reasonable safeguards to protect personal information, including student data. No method of transmission over the internet or electronic storage is 100% secure, so we cannot guarantee absolute security.

Links to Other Sites

Our Service may contain links to other sites. If you click on a third-party link, you will be directed to that site. Note that these external sites are not operated by us. Therefore, we strongly advise you to review the Privacy Policy of these websites. We have no control over, and assume no responsibility for the content, privacy policies, or practices of any third-party sites or services.

Children's Privacy

HanyuGuide may be used by students when access is created or approved by an authorized educator, parent, guardian, tutoring provider, or organization. We do not knowingly collect personal information from children under 13 outside an authorized classroom or guardian-supported context. Students under 13 should not create independent self-service accounts. If you believe a child under 13 has provided information without appropriate authorization, please contact us so we can review and take appropriate action.

Changes to This Privacy Policy

We may update our Privacy Policy from time to time. Thus, we advise you to review this page periodically for any changes. We will notify you of any changes by posting the new Privacy Policy on this page. These changes are effective immediately, after they are posted on this page.