Privacy Policy

Last updated: 7 November 2026 · Applies to hanziloom.com and the HanziLoom web app

1. Who we are

HanziLoom ("we", "us") is a sole-proprietor software business operated from Chongqing, China. We are the data controller for the limited personal data described below. For any privacy question or request, write to [email protected].

2. What we do not collect

To be explicit, because most learning apps do the opposite:

• No account, no sign-up, no password, no email address required to use the app.
• No analytics or crash-reporting SDK (no Google Analytics, no Firebase, no Sentry).
• No advertising, no ad networks, no behavioural profiling, no sale or sharing of personal data.
• No cookies for tracking. The app makes no cross-site requests — every script, font, image, audio file and data file is served from our own domain.

3. Data stored on your device

The app saves your progress in your browser's local storage. Nothing in this table is transmitted to us or to anyone else.

You can erase all of it at any time: About → Reset all progress inside the app, or by clearing site data in your browser settings. Clearing it is irreversible — we hold no copy and cannot restore it.

Local storage is strictly necessary to provide the service you asked for (remembering your progress and your licence). Because it is not used for tracking or advertising, we do not show a consent banner. Under the EU ePrivacy Directive and similar laws, strictly necessary storage does not require prior consent, but we tell you about it here anyway.

4. Data we do receive

4.1 When you email us

If you write to a @hanziloom.com address, we receive your email address, your message and anything you attach. We keep it only as long as needed to answer you and to keep a record of licence issues, and we never add you to a marketing list.

4.2 When you buy a licence

Payments are handled by our merchant of record, Creem. Creem collects your name, email address, country, and payment details, issues the invoice in its own name, and remits any VAT or sales tax. We never see or store your card number. Creem sends us your email address and order reference so we can issue and support your licence. Creem's own privacy policy governs the payment data it collects.

4.3 Server logs

Our site is hosted on Cloudflare. Like every web host, Cloudflare processes technical request data (IP address, user agent, requested URL, timestamp) to deliver the pages and to defend against abuse. We do not build user profiles from these logs, and we do not combine them with any other data.

5. Speech synthesis

Listening exercises use your browser's built-in speech synthesis to pronounce Chinese words. On some browsers — notably desktop Chrome — that engine may generate audio on the vendor's servers, which means the word being spoken is sent to that vendor. This is a function of your browser, not of HanziLoom: we send nothing ourselves, and we have no access to the result. If you prefer to keep everything on-device, use a browser with an offline voice engine, or simply skip the listening questions.

6. Children

HanziLoom is not directed at children under 13, and we do not knowingly collect personal data from them. Because the app requires no account and collects nothing by default, a child can use it without providing any personal data. If you believe a child has sent us personal data by email, contact us and we will delete it.

7. Your rights

Depending on where you live (EU/EEA, UK, California, China and elsewhere), you may have the right to access, correct, delete, restrict or port your personal data, to object to processing, and to complain to a supervisory authority. In practice, the only personal data we normally hold is an email thread and, if you bought a licence, an order record held by Creem.

To exercise any right, email [email protected]. We answer within 30 days. We may ask you to confirm the email address you wrote from, so that we do not hand your data to someone else.

8. International transfers and retention

Our hosting (Cloudflare) and payment processing (Creem) operate globally, so data may be processed outside your country, including in the United States and the European Union, under the standard contractual clauses those providers maintain. Email correspondence is kept for up to 3 years after our last exchange, then deleted. Order records are kept as long as tax law requires.

9. Security

The site is served over HTTPS only. There is no user database to breach, because there are no user accounts. Licence codes are verified offline by your browser using a signed token; we do not run a licence server that could leak a customer list.

10. Changes to this policy

If we change how the app handles data — for example by adding an optional account or a newsletter — we will update this page and change the date at the top. Material changes will be announced in the app itself before they take effect.