Privacy Policy

This policy covers Sinoxenica: the learning app at sinoxenica.com, the reader at reader.sinoxenica.com and the Sinoxenica Scanner browser extension. It says what we store about you, why, who else handles it, and how to have it corrected or deleted.

Who is responsible

Sinoxenica is run by Siyuan Yan, who is responsible for your personal data (the “controller”). Write to [email protected] about anything in this policy.

What we store

Your account. Your email address, your password (only as a salted hash, never in readable form) or, if you sign in with Google, your Google account's identifier, your username, and what you put on your profile: picture, banner, bio, colours and name style. We also keep the languages you study, your time zone offset (so streaks follow your day), and your active sign-in sessions.

Your learning. Lessons and exercises you complete, with your answers; your review cards and how you answered them; experience points, streaks, badges, leagues and teams; people you follow; posts and hearts in the feed; the custom cards, pictures and Anki decks you add; and who invited you, if someone did.

Your reading. In the reader, books stay on your device unless you sign in. Once you are signed in, the reader syncs your books between your devices: the book files themselves, their titles, authors and covers, your library, reading position, bookmarks, reader settings, and reading sessions (when, for how long and how many characters). You can delete all synced books from the reader's settings at any time.

Reports you send. If you report a problem with an exercise, we keep your message, the exercise and your answer, the app's version and your browser's user agent.

AI explanations. If you ask why an answer was right or wrong, we keep the conversation: your answer, the questions you ask and the explanations you get.

Word lookups. When you look a word up in the reader or with the scanner, the text around it is sent to our server to find it in the dictionary. We do not keep it.

Technical data. Our server reads your IP address to limit how fast any one address can make requests, and passes it to hCaptcha when you sign in or sign up, but does not write it down. Its logs record which address of our API was called, the result and how long it took. When something goes wrong they can also record your account's internal number, and when we send you an email, your email address. The logs are deleted as they age, currently after about a year.

We do not use analytics or advertising. Your browser keeps your sign-in and your settings in its local storage, and we set no cookies of our own. Videos in the app play in YouTube's player, which may set YouTube's cookies when you open one.

Why we store it

• To provide the service you signed up for: your account, your progress, syncing between devices, and the social features you choose to use (the contract between us).
• To keep the service secure and working: preventing abuse and automated sign-ups, fixing problems you report, and keeping backups (our legitimate interests).
• To send you the emails your account needs: confirming your address and resetting your password.

We do not sell your personal data, and we do not use it for advertising.

What other people can see

Other learners can see your username, profile, experience points, streak, league and team, and what you post in the feed. Your milestones and rare card pulls also appear in other people's feeds, unless you turn that off in your settings. Your email address, your answers and your reading stay private. You can hide your name from word leaderboards and limit who sees your mined words in your settings.

Who else handles your data

We use these services to run Sinoxenica. Each handles only what its job needs:

• Cloudflare carries all traffic between your browser and our server, so it sees your IP address and what you send.
• hCaptcha (Intuition Machines) checks that sign-ins and sign-ups come from a person, using your IP address and information about your browser and device.
• Google signs you in if you choose “Sign in with Google”, and delivers our emails to you through Gmail.
• Amazon Web Services stores our encrypted backups, the pictures in lessons, and the audio of custom cards' example sentences.
• OpenAI receives the exercise, your answer, your follow-up questions and what earlier lessons taught you when you ask for an explanation, and a video's subtitles when they are imported.
• Google Cloud turns the example sentences of your custom cards into speech.
• Discord: exercise reports, with your username, may be posted to the team's private Discord channel so we can fix them.
• YouTube (Google) plays the videos in the app, and sees that you watch them.

Where it is kept

Our server is in Japan. Backups are kept, encrypted, in Amazon Web Services' Tokyo region. The services above may handle data in other countries, including the United States, under their own safeguards. If you use Sinoxenica from outside Japan, your data is transferred to Japan to provide the service.

How long we keep it

We keep your data for as long as you have an account. When your account is deleted, we delete its data within 30 days, including report posts on Discord, and the last backups that contain it expire 30 days after that. Synced books you delete in the reader are removed from our server straight away, and from backups within 30 days. The audio of custom cards' example sentences is stored by its text, not by account, so it is not deleted with your account; it contains no other information about you.

Your rights

You can ask for a copy of your data, have it corrected, have your account and its data deleted, or object to how we use it. Write to [email protected] from the email address of your account, so we know the request is yours. We answer within 30 days. Most of your profile and settings you can also change yourself in the app.

If you think we have mishandled your data, you can complain to the data protection authority where you live. We would like to hear from you first.

Children

Sinoxenica is not meant for children under 13. In the European Economic Area and the United Kingdom you need to be 16, or have a parent's permission. If you believe a child has given us their data, write to us and we will delete it.

Changes

If we change this policy, we post the new version here with a new date. If a change matters for how we use your data, we tell you in the app or by email before it takes effect. See also our Terms of Use.