This policy explains how HanziMemo collects, uses and protects your personal data, in accordance with the General Data Protection Regulation (GDPR) and the French Data Protection Act.
1. Data controller
Alice Hitchon (sole trader), publisher of HanziMemo. Contact: hanzimemo.contact@gmail.com.
2. Data collected
Data you provide
- Email address and password (hashed) at sign-up
- Username and interface language
- Your custom review lists and preferences (voice, algorithm)
Data generated by your usage
- Learning progress (words seen, success rate, FSRS intervals)
- Mock exam results and scores
- Login stats (streak, XP, leaderboard)
Technical data
- Minimal server logs (truncated IP, browser) for security
3. Purposes and legal bases
- Providing the service (account, progress, sync) — basis: contract performance
- Security (fraud prevention, backups) — basis: legitimate interest
- Product improvement (aggregated, anonymous stats) — basis: legitimate interest
HanziMemo does no targeted advertising and never sells your data.
4. Retention
- Active account: as long as you use the app
- Inactive account: automatic deletion after 3 years without sign-in
- Data deleted on request: within 30 days maximum
5. Your rights (GDPR)
At any time you have the following rights:
- Access: obtain a copy of your data
- Rectification: correct inaccurate data
- Erasure: delete your account and all your data
- Portability: receive your data in a readable format
- Objection and restriction of processing
To exercise these rights, write to hanzimemo.contact@gmail.com. You can also delete your account directly from the app settings.
In case of a dispute, you may file a complaint with the CNIL (French data protection authority): www.cnil.fr.
6. Sub-processors
HanziMemo relies on technical providers bound by data processing agreements (DPA):
- Supabase (database, authentication) — EU infrastructure (Frankfurt)
- Cloudflare (hosting, CDN) — USA, Standard Contractual Clauses (SCC)
- Microsoft Azure (speech synthesis for pronunciation) — EU region
- Stripe Payments Europe, Ltd. (web payment processing) — Ireland/USA, SCC + PCI-DSS Level 1
- Apple Inc. (iOS in-app purchases) — USA, App Store DPA
- Google LLC (Android in-app purchases, Gemini API, Gmail support) — USA, SCC
- Resend (transactional email delivery) — DPA signed
7. California residents (CCPA/CPRA)
If you are a California resident, the California Consumer Privacy Act (as amended by the CPRA) gives you the following rights over the personal information HanziMemo collects about you:
- Right to know what personal information we collect, how we use it, and with which service providers we share it (see sections 2, 3 and 6 above).
- Right to delete your personal information — available directly in the app (Account → Delete my account) or by writing to us.
- Right to correct inaccurate personal information.
- Right to data portability — export available in the app (Account → Export my data).
- Right to limit the use of sensitive personal information — HanziMemo does not process sensitive personal information for inferring characteristics.
- Right to opt out of sale or sharing — HanziMemo does not sell or share your personal information for cross-context behavioral advertising, and has not done so in the preceding 12 months. No opt-out mechanism is required because no such activity occurs.
- Right to non-discrimination — exercising any of the above rights will never trigger denial of service, different pricing, or reduced quality.
Categories of personal information collected (CCPA §1798.140): identifiers (email, user ID), internet activity (learning progress, session logs), inferences drawn from usage (recommended review intervals). We do not collect biometric, geolocation, protected classification, or sensitive personal information as defined by the CCPA.
To exercise any California right, email hanzimemo.contact@gmail.com with "California privacy request" in the subject. We verify your identity via the email address associated with your account and respond within 45 days.
8. Security
TLS encryption for all exchanges, hashed passwords, data access restricted by Row Level Security at the database layer. As no transmission is 100% secure, you are encouraged to use a strong password.
9. Minors
The app is open from age 15. Users under 15 must obtain authorization from a parent or legal guardian. HanziMemo does not knowingly collect personal information from children under 13 (COPPA); if we learn we have, we delete it.
10. Changes
This policy may be updated. Any substantial change will be notified within the app.