PRIVACY POLICY
Last updated: 9 October 2026
This Privacy Policy outlines how we collect, use, and disclose information when you use HanziLab (also published under the project name "EasyChinese"), our mobile application available on the Apple App Store (the "App"), and related services. It also explains your privacy rights and the legal protections afforded to you. We are committed to safeguarding the personal information of our users.
By using the App or services, you consent to the handling of information as described in this policy.
Before the legal details, here is what you can rely on whenever you use HanziLab:
HanziLab is free, with no in-app purchases and no advertising. The current release contains no paid subscriptions, no consumable purchases, no advertising SDKs, and no advertising identifiers.
Most of HanziLab runs on your device. Flashcard scheduling, handwriting recognition, offline text-to-speech, offline pronunciation scoring, dictionary lookup, reading practice, and your personal review state are stored and processed on your iPhone or iPad. Your learning history, mined vocabulary, and settings are kept locally in Apple's on-device storage (SwiftData and GRDB/SQLite).
We collect limited product-usage and diagnostic data. HanziLab uses Google Firebase Analytics, Firebase Crashlytics, Firebase Cloud Messaging (FCM), Adjust, and OneSignal so we can understand which features are used, diagnose crashes, deliver optional reminder notifications, and measure install-attribution. This data is aggregated and is not used to build an advertising profile of you. We do not request App Tracking Transparency (IDFA) authorization in the current release.
Voice features send audio off-device only when you choose the cloud model. The in-app "Speak" drill offers two engines: an offline engine (Sherpa-ONNX, fully on-device) and an online engine (Microsoft Azure Speech — Pronunciation Assessment). When the online engine is active, your voice sample for the current drill is transmitted to Microsoft Azure to compute a pronunciation score and is then discarded. Audio is not stored on our servers.
Handwriting stays on your device. Chinese character handwriting recognition uses Google ML Kit Digital Ink Recognition, which runs entirely on your device. Your strokes are not transmitted off-device.
We never sell your data. We do not sell, rent, or share your information with third parties for advertising or marketing.
These commitments reflect how the App actually operates today. If we introduce features that change how data is handled (for example, server-side cloud sync of your deck, in-app purchases, advertising, or additional analytics providers), we will update this Privacy Policy and reflect the change in the App Store privacy label before those features are released.
Learning content and progress. HSK level choice, deck selections, FSRS spaced-repetition scheduler state, review history, mined vocabulary from the Immersion Reader, daily-mission state, pinyin / tone / handwriting / stroke drill results, and settings (theme, voice, playback speed, reminder time, new-cards-per-day). This content is stored locally on your device using Apple's on-device data frameworks (SwiftData, GRDB/SQLite, and UserDefaults). It does not leave your device unless you actively use a feature that requires network (for example, cloud pronunciation scoring or support contact).
Device identifier. On first launch we generate an opaque device identifier that is stored in the iOS Keychain. This identifier is used to deduplicate anonymous telemetry and to associate server-side preferences with your installation. It is not linked to your Apple ID, name, or email.
Support communications. If you contact us at heyku.studio@gmail.com or through the in-app Intercom messenger, we receive the information you include in your message (such as your name, email address, device information, and the description of the issue). We use it solely to respond to your inquiry.
Voice samples (Speak drill, online engine only). When you tap "Speak" and the online engine is enabled, a short recording of your spoken drill answer is transmitted to Microsoft Azure Speech for Pronunciation Assessment. The audio is used solely to compute a per-syllable pronunciation score and is not retained by us.
HanziLab integrates the following services to help us improve the App and operate basic engagement features. Data collected through these services is aggregated and is not used to track you across other companies' apps or websites (we do not request App Tracking Transparency authorization and do not collect the IDFA).
Google Firebase Analytics. Anonymous events describing how the App is used — for example: which screen you are on, which drill you open, whether you complete onboarding, and which HSK level you select.
Google Firebase Crashlytics. Crash traces, non-fatal errors, session length, app version, device model, iOS version, language, and region. These help us diagnose bugs and stability issues.
Google Firebase Cloud Messaging (FCM). A device push token used to deliver remote notifications (for example, re-engagement notices or product announcements). You can disable push notifications at any time in iOS Settings.
Adjust. Install-source and install-time attribution metadata used to measure which marketing channels bring new users. We use Adjust in a privacy-respecting configuration (no IDFA, no cross-app tracking) in the current release.
OneSignal. Push-notification delivery, segmentation (for example, "users who have not opened the app in 7 days"), and per-notification open/click metrics for the notifications we send.
Firebase / Adjust / OneSignal pseudonymous identifiers. Pseudonymous per-install identifiers used by these services to deduplicate events for the installation. They are not the advertising identifier (IDFA), are scoped to the App, and are reset when the App is reinstalled.
Intercom. When you open the in-app support chat, Intercom receives a pseudonymous installation identifier, your conversation messages, and basic device metadata (app version, iOS version, language). Intercom is used solely to deliver customer support.
We do not collect any of the following:
Your Apple ID, email, name, or any other sign-in credential (no account sign-up is required to use the App).
Contacts, calendar, location, health data, motion data, or photo library.
Biometric identifiers or face-recognition data.
The advertising identifier (IDFA) or any other cross-app tracking data.
The content of your handwriting strokes (handwriting recognition is on-device).
Any voice sample beyond the single-drill payload sent to Microsoft Azure when the online pronunciation engine is active.
Payment, billing, or purchase information (the current release has no in-app purchases).
The following device features are used locally by the App:
Microphone (Speak drill). Used to capture your spoken drill answer. If the offline engine is active, audio is processed entirely on-device by Sherpa-ONNX. If the online engine is active, the audio sample is transmitted to Microsoft Azure Speech for pronunciation scoring and then discarded. The microphone is used only while a Speak drill is active.
Local notifications (daily reminder). If you enable the daily reminder in Settings, iOS will schedule a local notification at the time you choose. No server is involved for the daily reminder itself.
Remote notifications (FCM / OneSignal). Used to deliver optional re-engagement notifications and product updates. You can disable these at any time in iOS Settings.
Speaker and audio playback. Used to play example audio, text-to-speech output, and the Chen Wang native-speaker syllable bundle you optionally download from Settings.
Background download sessions. Used to download the optional offline voice-model bundles (Chen Wang audio, Sherpa VITS text-to-speech, Sherpa Zipformer CTC ASR) when you tap "Download" in Settings. Only the files you explicitly request are downloaded.
HanziLab requests only the minimum iOS permissions needed to provide the features described above.
Privacy — Microphone Usage. Requested when you tap "Speak" for the first time. Used solely to capture your spoken answer so it can be scored. Audio is either processed fully on-device (offline engine) or transmitted to Microsoft Azure Speech for pronunciation scoring and then discarded (online engine). The microphone is not used at any other time.
Privacy — Notifications. Requested when you enable the daily reminder, or on first launch if the App needs to deliver re-engagement notifications. You may decline, and you can revoke this permission at any time in iOS Settings.
HanziLab does not request App Tracking Transparency (ATT), camera, photo-library, location, contacts, calendar, health, or motion permissions in the current release.
You can review or change any granted permission at any time in the iOS Settings app.
The current release of HanziLab is free of charge and contains no in-app purchases, subscriptions, or advertising. We do not integrate any advertising SDK and we do not collect any data for advertising purposes.
If we introduce in-app purchases, subscriptions, or advertising in a future release, we will update this Privacy Policy and the App Store privacy label accordingly before the change is shipped.
We do not build advertising profiles of you, do not personalize advertising, and do not sell or share data with data brokers.
The limited information handled by the App is used only to:
Provide, maintain, and support the App and its features (including spaced-repetition scheduling, handwriting recognition, pronunciation scoring, dictionary lookup, Immersion Reader mining, and daily missions).
Understand — in aggregate — which features are used, where learners drop off, and how the App performs, so that we can improve it (via Firebase Analytics).
Diagnose crashes, non-fatal errors, and performance issues (via Firebase Crashlytics).
Deliver optional reminder and re-engagement notifications (via local notifications, Firebase Cloud Messaging, and OneSignal).
Measure install-attribution for our marketing campaigns in a privacy-respecting configuration (via Adjust).
Respond to your questions, requests, and support inquiries (via email and in-app Intercom).
Comply with applicable laws, regulations, legal processes, and legitimate governmental requests.
Detect, prevent, and address fraud, security risks, or misuse of the App.
Enforce our Terms of Use.
We do not use any information you provide to train artificial intelligence or machine-learning models.
We do not share personal information with third parties for advertising, marketing, profiling, or sale.
We may disclose information only in these limited situations:
With your consent. For example, when you tap a share button to export a drill result or share a link.
Service providers acting on our behalf. In the current release, the service providers who may process data on our behalf are:
Apple, Inc. — App Store distribution, push-notification delivery, and system services (notifications, permissions). Apple acts under its own privacy terms.
Google LLC — Firebase Analytics, Firebase Crashlytics, Firebase Cloud Messaging, and ML Kit Digital Ink Recognition (the ML Kit model runs on-device; no stroke data is sent to Google). See <https://firebase.google.com/support/privacy> and <https://policies.google.com/privacy>.
Microsoft Corporation — Azure Speech (Pronunciation Assessment) when the online Speak engine is active. See <https://privacy.microsoft.com/en-us/privacystatement>.
Adjust GmbH — install-attribution. See <https://www.adjust.com/terms/privacy-policy/>.
OneSignal, Inc. — push-notification delivery. See <https://onesignal.com/privacy_policy>.
Intercom, Inc. — in-app customer support messaging. See <https://www.intercom.com/legal/privacy>.
Legal compliance and protection of rights. If required to comply with a valid legal process (search warrant, court order, subpoena) or to protect the rights, property, or safety of our users, us, or the public, as permitted or required by law.
Business transfers. In the event of a merger, acquisition, reorganization, or sale of company assets, information may be transferred as part of the transaction. Any successor entity will be bound by this Privacy Policy or a materially equivalent one.
We do not share, sell, or disclose your on-device learning content (deck state, review history, mined vocabulary, handwriting strokes) to any third party.
HanziLab is designed to keep your learning content on your device. When you use the online pronunciation engine, contact our support team, or receive a push notification, the data involved may be processed by our service providers in jurisdictions outside your country of residence (including the United States and the European Union). We apply appropriate safeguards (such as encryption in transit and the use of reputable processors that offer standard contractual clauses or equivalent protections) to such transfers, consistent with this Privacy Policy.
On-device data. Your deck, review history, mined vocabulary, and preferences remain on your device until you delete them from the App or uninstall the App. Uninstalling the App removes all locally stored data.
Server-side data. The server-side data we hold is limited to the pseudonymous device identifier, server-side preferences, and anonymous telemetry events. We retain this data for as long as the installation is active and for a limited period thereafter to meet legal and operational requirements, after which it is deleted or anonymized.
Support communications. We retain support emails and Intercom conversations only as long as needed to resolve the issue and to comply with any legal or business obligations, after which they are deleted or anonymized.
Voice samples (Speak drill, online engine). Transmitted to Microsoft Azure for the single scoring operation and discarded; not stored by us.
If we introduce features in the future that involve storing additional personal data on our servers, we will describe the applicable retention periods in an updated version of this Privacy Policy.
Depending on your jurisdiction (for example, under the EU GDPR, the UK GDPR, the California CCPA/CPRA, Brazil's LGPD, or similar laws), you may have rights to:
Access the personal data we hold about you.
Correct inaccurate or incomplete data.
Delete your data, subject to lawful exceptions.
Object to or restrict certain processing.
Withdraw consent where processing is based on consent.
Port your data to another service, where applicable.
Lodge a complaint with a data protection authority in your jurisdiction.
Because HanziLab does not maintain a traditional account for you (no email sign-up) and relies on an opaque device identifier, most of these rights are exercised directly through your device — for example, by deleting content in the App, revoking permissions in iOS Settings, or uninstalling the App. For any additional request, contact us at heyku.studio@gmail.com and include enough information for us to locate your installation (for example, the pseudonymous installation identifier shown in Settings, if available).
We apply appropriate technical and organizational measures to protect information that we do handle, including encryption in transit (HTTPS/TLS) for network communications, scoped iOS keychain storage for the device identifier, and standard iOS platform protections for on-device data. However, no method of transmission over the internet or method of electronic storage is completely secure. While we strive to use commercially acceptable means to protect information, we cannot guarantee its absolute security.
HanziLab is intended for a general audience of language learners and is rated 4+ on the Apple App Store. The App does not knowingly collect personal information from children under 13 (or the equivalent minimum age in your jurisdiction) beyond the limited diagnostic and product-usage data described above. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at heyku.studio@gmail.com and we will take appropriate steps to address the request in accordance with applicable law.
We may revise this Privacy Policy from time to time to reflect changes in our practices or service offerings. When updates are made, we will update the "Last updated" date at the top of this document, and, for significant changes (including changes that affect the App Store privacy label), we will also display a prominent notice within the App or on our platform.
We encourage you to review this Privacy Policy periodically to stay informed of how we are protecting information. Continued use of the App after any updates signifies your agreement to the revised policy.
If you have any questions about our Privacy Policy or wish to make a request regarding your personal information, please contact us at:
HEYKU STUDIO
Email: heyku.studio@gmail.com