Legal
Last updated: 2026-07-29
This policy describes what HSKLord collects, why we collect it, who processes it, and how you can exercise your rights. We try to keep it short and specific. If anything below is unclear, write to us at rj@hsklord.com.
HSKLord is a spaced-repetition vocabulary tool for Chinese learners, available on the web at hsklord.com and as native iOS and Android applications. References to we, our, and us in this policy mean the HSKLord operating entity. Contact: rj@hsklord.com.
Account data. When you create an account we store your email address and a salted bcrypt hash of your password. We never store passwords in plain text.
Study data. As you study we record which words you have seen, how you rated each card, your streak counters, and the difficulty schedule for upcoming reviews. This is what makes spaced repetition work.
Billing data. If you purchase a subscription or a PDF pack, Stripe (web) or RevenueCat (mobile) handles the payment. We receive only a tokenised reference plus the last four digits of your card and your billing country. We never see your full card number.
Usage and device data. Page views, click events, scroll depth, browser type, language, and Core Web Vitals (LCP, INP, CLS). Before you consent to identified analytics this is captured anonymously by PostHog with no IP address and no geographic information recorded, and stored in memory only so a closed tab leaves no client-side trace. Vercel Web Analytics counts the same page views for traffic reporting, without a cookie and without an identifier that follows you to other sites. If you accept all cookies we then record IP-derived country and approximate region so we can stitch sessions across visits, and we tie events to your account after you sign in. If you reject non-essential capture, all three of these stop: PostHog is never initialised, Google Analytics is never loaded, and Vercel Web Analytics is switched off.
Error data. When something breaks, Sentry captures the stack trace, the URL, and a hashed user identifier so we can fix it. Free-form text fields are scrubbed before transmission.
Email engagement. Resend reports delivery, bounces, complaints, and (where the email contains a tracking pixel) open events. You can opt out of marketing email from the unsubscribe link in any non-transactional email we send.
HSKLord uses the following third parties to operate the service. Each one processes a defined slice of data under their own privacy policy, linked below.
| Processor | Purpose | Data shared |
|---|---|---|
| Vercel | Web and API hosting, edge CDN, deployment, and first-party Web Analytics traffic measurement. | IP address, request headers, HTTP access logs. Web Analytics additionally records the page path, the matched route, the referring URL, country, and coarse device, browser, and operating system type. It sets no cookie and no cross-site identifier, and it is switched off for visitors who reject non-essential capture. |
| MongoDB Atlas | Primary database for accounts, study progress, and orders. | Email, hashed password, study history, subscription state, order records. |
| Stripe | Web checkout, subscription billing, refunds, tax collection. | Email, billing address, last four digits of card, country, tax ID (optional). |
| RevenueCat | In-app purchase management for the iOS and Android apps. | Subscriber email, App Store or Google Play receipt identifiers, entitlement state. |
| PostHog | Product analytics, A/B testing, anonymous Core Web Vitals. | Anonymous device ID, page views, click events, performance metrics. Identified to your account only after you log in. |
| Sentry | Error tracking and source-mapped stack traces. | Error messages, stack traces, request URL, anonymised user ID. Personal data is scrubbed before transmission. |
| Resend | Transactional and lifecycle email delivery. | Email address, message body, delivery status (bounce, complaint, open if pixel-tracked). |
| Optional Google sign-in, Google Analytics 4, optional ReCAPTCHA on form endpoints. | Email, Google account ID, IP address, browser fingerprint (when ReCAPTCHA is invoked). | |
| Cloudflare | DNS resolution and DDoS protection on the apex domain (when enabled). | IP address, request headers. Cloudflare does not see decrypted application traffic; TLS terminates at Vercel. |
| Apple App Store | Distribution and in-app purchase processing for the iOS app. | Apple ID (hashed receipt), purchase records. |
| Google Play | Distribution and in-app purchase processing for the Android app. | Google account ID (hashed receipt), purchase records. |
We do not sell your personal information to anyone. We do not share it with advertisers. We do not use it for cross-context behavioural advertising.
Our processors operate in the United States and the European Union. Data may transit between these regions. Where a transfer leaves the EEA or the United Kingdom we rely on the relevant Standard Contractual Clauses or the EU-US Data Privacy Framework.
You have the right to access, correct, export, and delete your personal data. To exercise any of these rights, sign in and use the controls in your account settings, or write to rj@hsklord.com. We will respond within 30 days.
Account deletion (GDPR Article 17). You can delete your account at any time. Once you confirm, we queue your data for deletion across our systems within 30 days. Some financial records (orders, refunds, tax-relevant invoices) are retained for up to seven years to meet tax and accounting obligations and are anonymised rather than deleted. Account deletion is exposed via the in-app account screen and a programmatic endpoint at POST /api/account/delete.
EU and UK residents. Under the GDPR and UK GDPR you have the right to lodge a complaint with your local supervisory authority.
If you are a California resident, the California Consumer Privacy Act and the California Privacy Rights Act give you the rights below. We do not sell your personal information for money. We do not share it for cross-context behavioural advertising.
To exercise any of these rights, write to rj@hsklord.com from the address on file. We will verify your identity by sending a confirmation email and will respond within the statutory window.
HSKLord is intended for users aged 13 and older. We do not knowingly collect data from children under 13. If you believe a child under 13 has created an account, write to rj@hsklord.comand we will delete the account.
We keep your account data for as long as your account is active. On deletion we remove your personal data from active systems within 30 days. Backups are encrypted and are rotated out of existence within a further 30 days. Tax-relevant invoices and order records are retained in anonymised form for up to seven years.
We use a first-party authentication cookie to keep you signed in, a small number of analytics cookies set by PostHog and Google Analytics, and the local-storage tokens used by Stripe and RevenueCat to handle checkout and entitlement state. You can clear these at any time in your browser settings. Disabling the authentication cookie will sign you out.
We update this policy when our processors, data flows, or obligations change. The date at the top reflects the most recent revision. Material changes are announced by email if you have an account.
Questions, complaints, and rights requests: rj@hsklord.com.
See also: Terms of Service and About HSKLord.