Privacy Policy

Last updated: July 8, 2026

The short version: You can use Chinese Dictation Buddy without an account, and your study progress still lives only in your own browser. Accounts are optional and only needed for Premium AI features. If you create one, we collect your email and a username, handled by our login provider (Supabase). We don't sell your data or use tracking ads.

1. Who we are

"Chinese Dictation Buddy" ("we," "us," or "the app") is a free web application for practicing Chinese dictation, reading, and listening. This policy explains what data the app touches and how. If you have questions, contact us at wujunhao2029@gmail.com.

2. Who can use the app

Chinese Dictation Buddy is intended for users aged 13 and older. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us personal information, contact us and we will address it promptly.

3. Information we do not collect

We designed the app to be privacy-first. We do not:

require an account to use the core, free features (dictation, practice, reading, and listening all work with no login);
collect your real name, address, phone number, or payment details;
sell, rent, or share personal information with advertisers;
store your study history or answers on our servers.

An account is optional and only unlocks Premium AI features. See Section 5 for the limited account data we collect if you choose to sign up.

4. Information stored on your own device

To make the app useful, we save some information locally in your browser using localStorage. This includes things like your streak count, spaced-repetition review schedule, language and layout preferences, chosen voice, and onboarding status.

This data never leaves your device and is not transmitted to us. You can erase it at any time by clearing your browser's site data for this site, or by using your browser's "clear data" settings. Clearing it resets your progress.

If you log in, your login session (an authentication token from our login provider, Supabase) is also stored in your browser so you stay signed in. Logging out or clearing site data removes it.

5. Information sent to third-party services

Accounts and login (Supabase)

Accounts are optional and only needed for Premium AI features. If you create one, we collect the email address and username you provide, plus a securely hashed password. This is handled by Supabase, our authentication provider, which stores it on our behalf to let you log in and to determine whether your account has Premium access. We use this data only to operate accounts and Premium — not for advertising. Supabase processes it under its own privacy terms. You can ask us to delete your account and its data at any time (see Section 8).

AI features (Google Gemini)

When you use an optional AI feature (for example, the AI Quiz or AI-generated reading and listening items), the vocabulary word list or prompt you choose is sent to our server function, which forwards it to Google's Gemini API to generate or grade the exercise. We send only the study content needed for that request — not your identity. Google processes this data under its own terms and privacy policy. On free API tiers, Google may use submitted prompts to improve its models, so please do not enter sensitive or personal information into AI features.

Hosting (Vercel)

The site is hosted on Vercel. Like most web hosts, Vercel automatically processes standard technical request data (such as IP address, browser type, and timestamps) in server logs for security, abuse prevention, and reliability. We use a short-lived, best-effort per-IP rate limit to prevent abuse of the AI function. This technical data is handled by Vercel under its own privacy policy.

Payments (Stripe)

If you purchase Premium or pay-as-you-go credits, checkout and payment are handled by Stripe, our payment processor. Your card and billing details are entered on Stripe's secure checkout and are processed by Stripe under its own privacy policy — we never see or store your full card number. We receive only what we need to grant access, such as your purchase status and the email associated with the order. See our Refund & Billing Policy for how billing and refunds work.

Bot protection (hCaptcha)

To protect sign-up and login from automated abuse, we may use hCaptcha. hCaptcha processes limited technical signals (such as IP address and browser characteristics) to tell humans from bots, under its own privacy policy. This is used only for security, not advertising.

Educational content sources

The app loads open educational resources — stroke-order data (Hanzi Writer), pinyin conversion (pinyin-pro), example sentences (Tatoeba, CC-BY), and dictionary data (CC-CEDICT) — some of which are delivered from public content-delivery networks. These requests are standard web requests and are not used to profile you.

6. Cookies, analytics, and tracking

We do not use advertising cookies or cross-site tracking pixels, and we do not sell your data. The app relies mainly on local browser storage (described in Section 4) to remember your preferences and, if you log in, to keep your login session.

For product analytics we use Vercel Web Analytics and Speed Insights, which are privacy-friendly and cookieless — they measure aggregate page views and performance without cookies and without building a profile of you. Security tools such as hCaptcha and your login provider (Supabase) may set strictly necessary cookies or local storage so those features work; these are not used for advertising.

7. Data security

The site is served over HTTPS, and our AI API key is stored server-side and never exposed to your browser. No method of transmission or storage is 100% secure, but we take reasonable measures to protect the limited data the app handles.

8. Your choices and rights

For everything stored on your device, you're in control: clear your browser's site data at any time to erase it. If you created an account, you can ask us to delete the account and its associated data (email and username) by emailing us; we'll remove it from our authentication provider. If you are in a region with data-protection rights (such as the EEA, UK, or California), you can request access to, correction of, or deletion of your account data, and we will help where we can.

9. Changes to this policy

We may update this policy from time to time. When we do, we'll change the "Last updated" date above. Significant changes will be reflected on this page.

10. Contact

Questions about privacy? Email wujunhao2029@gmail.com.