Privacy Policy

• Effective date: 3 November 2026
• Version: 2026-11-03

1. Who we are

HanUp ("the app") is an app for Vietnamese learners of Chinese following the HSK syllabus, published by HanUp ("we", "us").

• Place of residence: Vietnam
• Contact email: [email protected]
• Policy page: https://hanup.vn/privacy

We decide the purposes and means of the processing of personal data described in this policy.

2. Summary

• You need an account to use the app. You can sign up with email, or sign in with Google or Apple.
• Your learning progress is saved on your device first, then synced to servers in Singapore so you can continue on another device.
• Speech is recognised on your device. Speaking-practice recordings stay on the device and are never uploaded.
• In AI Practice, the text of the conversation is sent through our server to the Qwen model of Alibaba Cloud (Singapore region). We do not store the conversation.
• When you sign up, sign in or reset your password, Cloudflare Turnstile runs an invisible check to block bots.
• Study reminders are notifications scheduled by your own device.
• The app has no ads, uses no third-party analytics or tracking tools, and does not sell your data.
• You can delete your account inside the app.

3. Data we collect

3.1 Account

• Email address.
• Password (when you sign up with email). It is stored hashed on the authentication server; the app does not store your password on the device.
• Name you enter when signing up, also used as your display name.
• 6-digit verification code emailed to you when you sign up or reset your password. Emails are sent from [email protected] through the Resend service.
• Sign in with Google or Apple (if you choose it): the provider shares your email, name (if you allow it) and your account identifier with that provider. With Apple, the email may be an anonymous relay address.
• Your acceptance of the Terms and this Policy: document name, version and time of acceptance.
• Anti-bot data: when you sign up, sign in or reset your password, Cloudflare Turnstile collects information about your device and the browser embedded in the app (for example IP address, browser characteristics, interaction signals) to tell humans from bots. See section 11.
• Technical logs of our servers, such as sign-in times, IP address and device type, used to operate and secure the service.

3.2 Profile

• Display name (up to 30 characters) and short bio (up to 80 characters).
• Profile photo (see section 7).
• Current HSK level.
• Device time zone (e.g. Asia/Ho_Chi_Minh), used to work out "today", study streaks and weekly statistics.
• App language.

3.3 Learning data synced to the server

• Words learned and meaning-recognition results (word ID, correct/incorrect, time).
• Results of each lesson activity: activity ID, correct/incorrect or self-assessment, how it was done (e.g. choosing an answer, ordering a sentence), time. Recordings, drafts and text you type during exercises are not uploaded.
• Where you stopped, completion status and score of each lesson.
• Flashcards: your decks, the cards in them, cards you create (characters, pinyin, meaning, example sentences you enter) and each card's review schedule.
• Daily statistics: study time, activities done and answered correctly, words learned, lessons completed, cards reviewed. Lesson points are calculated by the server from this data.
• Achievements, badges, longest streak.
• Whether you joined the leaderboard (see section 10).
• Settings: study reminder schedule, flashcard review settings, app settings (e.g. voice), order of Home shortcuts.
• A random ID created by the app for each installation, so statistics from several devices add up without overwriting each other. It is not a hardware ID or an advertising ID.
• AI Practice: scenarios you completed (scenario ID, time) and the number of messages you used each day (see section 5).

3.4 Data that stays on the device only

The following data stays in the app's private storage on your device and is not sent to the server. Uninstalling the app deletes it.

• Speaking-practice recordings (see section 6).
• AI Practice conversations — kept only in memory while the conversation is open and lost when you leave it.
• Answer drafts, filters, unfinished review sessions, detailed logs of each card review and each study period.
• Display preferences (e.g. pinyin, translation, hints in AI Practice).
• Downloaded voice packs and generated audio.
• Your sign-in session.

3.5 What we do not collect

• Location (GPS), contacts, calendar, advertising ID, browsing history.
• Payment information. The app is currently free.
• Audio of your voice (see section 6).
• The app contains no advertising, behavioural analytics or automatic crash-reporting libraries that send data to third parties.

4. Purposes and legal bases

We use data to:

• create and maintain your account, verify your email and recover your password;
• save and sync progress across devices and restore data when you reinstall the app;
• calculate streaks, statistics, points and badges; show the leaderboard if you join it;
• send study reminders as device notifications;
• AI Practice: generate replies and feedback; limit the number of messages to prevent abuse and control costs;
• keep the service secure, block bots, spam accounts and point cheating, and handle incidents;
• record your acceptance of the Terms of Use and this Policy.

Legal bases: (a) your consent, given when you create an account and accept this Policy, or when you turn on an optional feature (microphone, profile photo, notifications, leaderboard, Google/Apple sign-in); and (b) performance of the contract with you under the Terms of Use, i.e. providing the features you request. You can withdraw consent at any time (section 13); withdrawal does not affect processing carried out before it, but some features may stop working.

We process data in accordance with Vietnamese law on personal data protection, including the Law on Personal Data Protection and its implementing regulations.

We do not use your data for advertising or marketing and we do not sell it.

5. AI scenario practice

• Requires an account and an internet connection.
• When you send a message, the app sends our server: the scenario ID, the earlier messages in the same conversation, your new message and a progress token signed by the server.
• The server adds the scenario's instructions and sends the text of the conversation to the Qwen model of Alibaba Cloud Model Studio (international edition, Singapore region). Your email, name, account ID and IP address are not sent to Alibaba Cloud.
• We do not store conversations: not on the device after you leave the conversation, and not on the server. Server logs do not record what you or the AI said; they record only the account ID, scenario ID, message count, token count and processing time.
• Alibaba Cloud processes the text it receives under its own terms and privacy policy (https://www.alibabacloud.com/help/en/legal/latest/alibaba-cloud-international-website-privacy-policy) and may temporarily store content under that policy.
• Current limits: up to 4 of your messages per conversation (8 turns including the AI) and up to 50 messages per person per day (Vietnam time). A sent message counts even if the AI could not reply. These limits may change.
• Data stored: scenarios you completed (until you delete your account) and messages used per day (deleted automatically after 14 days).
• When you speak in AI Practice, your speech is turned into text on the device (see section 6); you can review and edit the text before sending. Only the text is sent.
• AI replies can be wrong. Do not enter sensitive personal information (ID numbers, address, health, finances…) in the conversation.

6. Microphone, speech recognition and recording

• The app asks for microphone and speech-recognition permission only when you tap a speak or record button.
• Speaking practice: the app records so you can listen back to yourself. Recordings are kept in the app's temporary folder and deleted when you leave the lesson, switch or delete your account, or the next time the app starts. The app does not upload recordings and does not score pronunciation.
• Reading aloud and speaking in AI Practice: the app uses the operating system's speech recogniser. On iOS, recognition always runs on the device. On Android, the app requests on-device recognition where the device supports it; how Google's recogniser works on a particular phone depends on the device and on Google's policies. The recognised text is compared with the model sentence or used as your message to the AI.
• You can refuse these permissions and still learn by typing or using model sentences, and you can revoke them at any time in your device settings.

7. Profile photo, camera and photo library

• The app asks for camera or photo-library access only when you choose to change your profile photo, and reads only the photo you pick.
• The photo is cropped square and saved as a 220×220-pixel PNG. Metadata of the original photo (e.g. location) is not kept.
• The photo is stored on the device and in private storage on our server. Who can see it: see section 10.
• You can change or remove the photo at any time. Deleting your account deletes your profile photo on the server.

8. Study reminders

• Study reminders are local notifications scheduled by your device at the times and days you choose. The app does not use server push notifications and does not collect push tokens.
• The app asks for notification permission only when you turn reminders on. The reminder schedule is synced with your settings so it can be reused on another device.

9. Downloaded Kokoro voice

• The Kokoro Chinese voice pack (about 91 MB) is downloaded once from a public release page on GitHub when you choose to download it.
• As with any web download, GitHub receives the IP address and technical details of the request. The app does not send account or learning data to GitHub.
• After download, the voice runs entirely on the device. Before that, the app uses the operating system's built-in voice to read lesson content.
• You can delete the voice pack in Settings › Voice.

10. What other learners can see

• Your email, bio, time zone and detailed learning data are never shown to other learners.
• The leaderboard is optional and off by default. Only after you tap "Join the leaderboard" (on the Leaderboard screen) or turn on "Show my name on the leaderboard" (Profile › Settings › Leaderboard) can other signed-in users see your display name, profile photo, HSK level, total points and rank.
• You can turn it off at any time in the same place in Settings; once off, your information no longer appears on the leaderboard.

11. Third-party processors and transfers abroad

Cloudflare Turnstile: Cloudflare processes device and browser data only to distinguish humans from bots, under the Turnstile Privacy Addendum: https://www.cloudflare.com/turnstile-privacy-policy/

The App Store and Google Play process data when you download the app under their own policies.

Apart from the parties above, we disclose data only when required by law or by a competent state authority.

Transfers abroad: Supabase and Alibaba Cloud servers are in Singapore, the email service is in Japan, and Cloudflare, Google, Apple and GitHub operate infrastructure in many countries. Your data is therefore transferred outside Vietnam for processing. By accepting this Policy you consent to these transfers. We transfer only the data each service needs and carry out the procedures for cross-border transfer of personal data required by Vietnamese law.

12. Retention and deletion

Retention periods

• Account, profile, profile photo and synced learning data: until you delete your account.
• Daily AI Practice message counts: deleted automatically after 14 days.
• Technical logs (server, email delivery, bot protection): kept for each provider's retention period, then deleted automatically.
• Database backups made by the server provider (if any): deleted data may remain in a backup until that backup expires under the provider's schedule.

Signing out does not delete data: data on the server remains, and data on the device is kept separately for each account.

Deleting your account in the app: Profile › Settings › Delete account, then type the confirmation word shown ("DELETE" in English, "XÓA" in Vietnamese). Requires an internet connection.

• On the server: revoke Apple sign-in (if used), delete your profile photo, then delete the account and all data linked to it: profile, progress, flashcards, statistics, points, achievements, settings, Terms acceptances, leaderboard and AI Practice data.
• On the device: delete that account's data, profile photo, recordings and study reminders. Data of other accounts that signed in on the same device is kept.
• If the server cannot be reached, the app stops syncing and completes the deletion automatically when it is back online.
• Deleted data cannot be recovered.
• If you cannot delete your account in the app, email [email protected] from your account's email address.

13. Your rights

Under Vietnamese law you have the right to be informed, to give or withdraw consent, to access, correct and delete your data, to restrict or object to processing, and to request a copy of your personal data. In practice:

• View and edit your profile (name, bio, photo) in the app.
• Delete your account and data in the app (section 12).
• Turn off the leaderboard and reminders in the app's Settings.
• Revoke microphone, speech-recognition, camera, photo and notification permissions in your device settings.
• Export a flashcard deck to a file.
• Request a copy of your data, request correction, restrict or object to processing, or withdraw consent: email [email protected]. We respond within 30 days of receiving your request and may need to verify that you own the account.
• Complain to Vietnam's specialised personal data protection authority (Ministry of Public Security) if you believe your rights have been infringed.

14. Age

The app is for people aged 16 or over. People under 16 may not create an account or use the app. The app does not verify age; if we learn that an account belongs to someone under 16, we will delete the account and its data. If you know of such a case, please tell us at [email protected].

15. Security

• All of the app's network connections use HTTPS. When downloading the voice pack, the app checks the SHA-256 hash of the downloaded data.
• Every table on the server has Row Level Security enabled: each account can read and write only its own data. Others can read only what section 10 describes.
• Profile photos are kept in private storage. The server's admin key is not in the app.
• No system is perfectly secure. If personal data is leaked, lost or accessed without authorisation, we will act to limit the harm, notify the competent authority within the time required by law, and notify you when the incident may affect you.

16. Changes to this policy

When we change this Policy, we update the effective date and version at the top, publish the new version at https://hanup.vn/privacy and notify you in the app. For significant changes, the app may ask you to accept again. The app records which version you accepted.

17. Contact

• Publisher: HanUp
• Place of residence: Vietnam
• Email: [email protected]

Back to top ↑