Privacy Policy

Last updated: 7 November 2026

This policy has two parts: one for the Hanzi By Heart app and one for the website and waitlist.

App

This policy applies to the Hanzi By Heart iPhone app.

Controller

Konstantin Moritz van Megen, Pionierstraße 12, 40215 Düsseldorf, Germany. Email: support@hanzibyheart.com.

Age

Hanzi By Heart is intended for people aged 16 and over. We do not knowingly collect data from children under 16. You can only allow the optional usage analytics if you are 16 or older. If a parent or guardian contacts us, we will delete the data of a child under 16 on request.

On your device

The app stores settings and learning progress, including card states, review history and pending sync operations. Guest learning data stays on your device unless you create or sign in to an account. You can use the core learning features as a guest. Storing this on your device is strictly necessary for the app to work (section 25(2) no. 2 TDDDG); no consent is required for it.

Account and sync data

If you use an account, Supabase processes your email address, Apple sign-in reference or Google account ID, an internal user ID, authentication data, settings, card states, review history, sync revisions and timestamps. This is needed to authenticate you, recover your account and synchronize learning progress across devices. Supabase and Resend also process your email address and technical delivery data to send confirmation and recovery messages from no-reply@auth.hanzibyheart.com. If you choose Sign in with Google, Google (Google Ireland Limited for users in the EEA and Switzerland, otherwise Google LLC, USA) confirms your identity and sends us your email address and an ID for your Google account; we receive no password, name or profile picture. Google processes this sign-in as an independent controller under its own privacy policy and learns that you use Hanzi By Heart. You can remove the connection in your Google Account at any time.

Purchases and subscriptions

When the app starts and whenever you open it again, it checks through RevenueCat whether your device or account has access, also as a guest and before any purchase. Without this check, the app cannot decide whether to show the learning content or the purchase screen (Section 25(2) no. 2 TDDDG). Apple processes payment details and billing. We do not receive your full payment-card details. RevenueCat processes a pseudonymous app user ID, product, entitlement, transaction and receipt/status information, plus limited app and device diagnostics, so the app can offer, verify and restore purchases and measure purchase performance. The integrated purchase SDK also sends Apple’s vendor-specific device identifier (IDFV) in technical requests; this is not an advertising identifier. RevenueCat first assigns a random, pseudonymous app user ID. When you sign in, the app associates your internal account ID with that RevenueCat customer so entitlements can follow your account. RevenueCat stores this data in the United States.

Support and word reports

When you contact support, we process the details you send and your email address. When you intentionally submit a word report, Supabase stores its category, word context, optional comment and example sentence, app version, iOS version and app language. Account reports use your internal user ID; guest reports store a reply address only if you provide one and allow contact. A support email from the app adds the app and iOS version. A data request from Settings also adds your pseudonymous analytics and purchase IDs and, if you are signed in, your account email; you see and can edit everything before sending. Do not include sensitive personal data in free-text fields.

Optional usage analytics

Only after your consent, PostHog processes a random installation ID that is not linked to your account; installation, update, app-open and background events; onboarding steps and demo phase; sections viewed; study mode, rating, previous learning phase, undo actions and aggregate session counts; paywall source, paywall version shown and selected plan category; purchase and restore outcome and purchase environment; and app/build version, iOS version, device model/class and app language. Email, account, Supabase, RevenueCat, transaction or receipt IDs, exact prices, specific words, Hanzi/Pinyin, searches, typed answers and other free-form content are excluded. Also included are guest/account status without the account identity, device regional settings, session ID, active HSK levels and study modes, whether an exam date is configured, new-word-goal ranges, search-length and result-count ranges, and use of learning ahead. These events are pseudonymous, not anonymous.

Processors and international transfers

Account, sync and report data is hosted with Supabase (Supabase, Inc., USA) in Frankfurt, Germany; access by the US provider is possible. Sign-in emails are sent by Resend (Plus Five Five, Inc., USA); Resend stores message content and delivery logs in the United States. Purchase data is processed by RevenueCat, Inc. in the United States. Optional analytics data is hosted with PostHog (PostHog, Inc., USA) on servers in the EU; access from the United States is possible. We have a data processing agreement with each of them. Transfers to the United States rely on EU standard contractual clauses (Art. 46(2)(c) GDPR) and, where the provider is certified, additionally on the EU-U.S. Data Privacy Framework (Art. 45 GDPR). You can request a copy of these safeguards at support@hanzibyheart.com. Apple processes App Store, Apple Account and TestFlight data as an independent controller under its own privacy policy.

Users outside the EU

We process your data in the EU and with the providers named under processors and international transfers. Some countries require additional information:

Republic of Korea: we transfer the data described in this policy abroad (account, sync, purchase and support data and, with your consent, analytics data). It is transferred over encrypted connections whenever you use the respective feature, to Supabase (servers in Germany, US provider), Resend (USA), RevenueCat (USA) and, with your consent, PostHog (servers in the EU, US provider), each for the purpose and retention period stated above. You can refuse the transfer by not creating an account and not allowing analytics; learning on your device remains available.

Thailand: transfers outside Thailand rely on the safeguards described above and, for analytics, on your consent.

Vietnam: we process personal data of users in Vietnam in accordance with Law No. 91/2025/QH15 and submit the required impact assessment for cross-border transfers to the Ministry of Public Security.

Singapore: our data protection officer is Konstantin Moritz van Megen, support@hanzibyheart.com.

New Zealand: some information reaches us from others, namely from Apple about purchases, refunds and TestFlight, and when you sign in with Apple, and from Google when you sign in with Google. This policy describes what we receive, why we use it and your rights; this is our notice under Information Privacy Principle 3A.

Japan: we handle personal information of users in Japan under the Act on the Protection of Personal Information (APPI). The providers named above are based in the USA; Supabase stores your data in Germany and PostHog in the EU. Japan recognises the EU as offering an equivalent level of protection. The USA has no general federal data protection law; protection comes from federal laws for specific sectors and from state laws. Our contracts with these providers (data processing agreements and EU standard contractual clauses) oblige them to protect your data to a standard that meets the APPI; we check this regularly and tell you about these measures on request. For disclosure, correction, suspension of use or deletion, and for complaints: support@hanzibyheart.com.

Beta testing with TestFlight

If you test the app through TestFlight, Apple provides us with information under its terms, for example crash reports, usage information such as session and crash counts, the installed version, the installation date and your feedback. If we invited you by email, we also see your name and email address. We use this data only to fix bugs and improve the app, and we do not share it (Art. 6(1)(b) and (f) GDPR). Purchases in the test version run in Apple's sandbox and cost no real money.

Purposes and legal bases

Account, sync, support requested by you, and purchase functionality are processed to perform the app contract or take steps at your request (Article 6(1)(b) GDPR). Service security, abuse prevention, troubleshooting and proportionate purchase-performance measurement rely on our legitimate interests in a secure, reliable and economically sustainable app (Article 6(1)(f) GDPR). Optional analytics and access to information on your device for that purpose rely on your consent (Article 6(1)(a) GDPR and section 25(1) TDDDG). Legal retention duties rely on Article 6(1)(c) GDPR. We do not use automated decision-making, including profiling, within the meaning of Article 22 GDPR.

Consent and withdrawal

Analytics is voluntary and only available if you are 16 or older. The app offers the choice during onboarding or later under Settings > Privacy. The PostHog SDK does not start before you agree. You may decline without losing functionality and change your choice at any time. Withdrawal stops future collection immediately and discards queued events that were not sent; processing before withdrawal remains lawful. On request, we delete events already transmitted without undue delay and within one month at the latest. The quickest way is Settings > More about privacy > Send a data request: the email then already contains your pseudonymous analytics ID. If you turn analytics off and on again, you get a new ID; we can only match IDs that you send us. If targeted deletion is technically not possible, we delete all analytics data from the test phase.

No advertising or cross-app tracking

We do not use Apple's advertising identifier (IDFA), advertising, data brokers or tracking across other companies' apps and websites. PostHog autocapture, arbitrary tap capture, person profiles, session replay and automatic error reports are disabled. Screen size, network type, time zone and device name are removed before sending; IP-based geolocation is disabled.

Retention

Account and sync data is kept while your account exists. Account-linked word reports are deleted with the account; other support correspondence and guest reports are kept only as long as needed to resolve and prevent the reported issue or meet legal duties. Purchase records needed to provide entitlements are kept while required for that purpose and applicable legal duties. We keep pseudonymous analytics data as long as we need it to understand usage patterns, identify friction and make product decisions. We review this regularly and delete data we no longer need; on request we delete it earlier (see consent and withdrawal). Local data remains until you delete it or the app according to iOS behavior. Authentication-email delivery and provider security logs may expire later under limited provider deletion cycles or legal duties.

Deletion

You can delete your account in Settings. This permanently removes the Supabase login and account-linked learning and report data and initiates revocation of a linked Apple authorization. You can delete local guest progress with "Delete progress". Deleting an account does not cancel an Apple subscription; manage subscriptions in your Apple account. RevenueCat entitlement records and already-sent analytics are not automatically covered by Supabase account deletion. For separate erasure, use Settings > More about privacy > Send a data request; the email then already contains the pseudonymous IDs for analytics and purchases. We keep backup copies with a cloud storage provider in the USA (based on the EU-U.S. Data Privacy Framework) and delete them after 30 days. After you delete your account, your data may therefore remain in these backups for up to 30 days.

Providing data

You are not required to provide us with personal data. An account is optional; without one, the learning features and your progress remain available on your device. Without the data required for sign-in (email address, Apple sign-in reference or Google account ID), you cannot use sync or account recovery. Purchases require verification through Apple and RevenueCat; without it, we cannot unlock access. Usage analytics is voluntary; declining it has no disadvantages.

Your rights

Subject to the legal conditions, you have the right to access, rectification, erasure, restriction and data portability. You may withdraw consent at any time with effect for the future; processing carried out before withdrawal remains lawful. You may also lodge a complaint with a data protection supervisory authority.

Right to object

You may object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests (Article 6(1)(f) GDPR; in the app: service security, abuse prevention, troubleshooting and purchase-performance measurement). We will then no longer process your data for these purposes unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims. Write to support@hanzibyheart.com.

Supervisory authority

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, www.ldi.nrw.de.

Contact

Email us for privacy questions or requests. We may need enough information to verify that a request relates to you.

Website and waitlist

Controller

Konstantin Moritz van Megen, Hanzi By Heart, Pionierstraße 12, 40215 Düsseldorf, Germany. Email: support@hanzibyheart.com, telephone: +49 177 6922060.

Visiting the website

The website is delivered through Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA). When you visit, Cloudflare processes the data this requires: IP address, time, requested address, browser and device details and, where sent, the page you came from. The purpose is to deliver the website and protect it against attacks and abuse. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is a secure, stable website.

Cloudflare acts as our processor for this. Where Cloudflare processes data for its own purposes, for example to protect its network, Cloudflare is the controller for that processing; see Cloudflare's privacy policy. Data may be transferred to the United States. Cloudflare is certified under the EU-U.S. Data Privacy Framework, and its data processing agreement relies on it for these transfers (Article 45 GDPR). Where no adequacy decision applies, the EU Standard Contractual Clauses incorporated in that agreement apply (Article 46(2)(c) GDPR). You can read these safeguards at the link or request a copy from us.

We do not store access logs of our own; logging for our website program is switched off. The page view count described under Page views without cookies stores no IP addresses. According to its documentation, Cloudflare retains security events and technical security analytics data for up to 31 days on our plan. Where Cloudflare needs further data to operate its service, investigate specific attacks or meet legal obligations, retention depends on that purpose and the applicable obligations. Cloudflare describes these criteria in its privacy policy.

Waitlist

By signing up, you request a confirmation email and agree to one email when the app launches. We process your email address and the language of the page for this purpose. The confirmation link is encrypted and valid for seven days. We add you to the waitlist only after you explicitly confirm on the page it opens (double opt-in). Before this, your address is present in the confirmation email and our provider's delivery log, but is not stored as a waitlist contact.

The legal basis for these requested emails and the waitlist is your consent (Article 6(1)(a) GDPR). Providing your address is voluntary and is not required by law or contract. Without it, you can still use the website but will not receive the launch email. We will not send other marketing emails.

You can withdraw consent at any time by emailing support@hanzibyheart.com and through the unsubscribe link in the confirmation email and in the launch email. Withdrawal does not affect the lawfulness of earlier processing. We then block your address from further emails and remove it from the active waitlist. We close the active waitlist no later than 30 days after the launch email, or if we abandon the planned launch.

To demonstrate your consent, we also store the signup and confirmation times, the language and the version of the consent text with the contact. After withdrawal or the last email, we retain this evidence, including the address, blocked from sending until the end of the third following calendar year, then delete it. This is based on our legitimate interest in demonstrating consent and defending possible claims (Article 6(1)(f) in conjunction with Article 7(1) GDPR). If a specific legal dispute arises, only the evidence needed for it is retained until the dispute ends. We do not store the IP address as consent evidence.

We use Resend (Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA) as our processor for email and the waitlist. According to the provider, message content and delivery logs are stored in the United States for 30 days; backups persist for seven days. Contact data stays until we delete it. Transfers are covered by the EU Standard Contractual Clauses in the data processing agreement (Article 46(2)(c) GDPR). You can read the safeguards there or request a copy from us.

To prevent abusive signups, Cloudflare briefly processes the IP address and a hash of the email address. The rate-limit counters each cover a 60-second window. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is protecting the form and recipients against abuse. The section Visiting the website covers Cloudflare's additional security data.

Contacting us by email

When you write to us, we process your message and contact details to reply. Our legitimate interest is handling your enquiry (Article 6(1)(f) GDPR); where it relates to a contract or steps you request before entering one, Article 6(1)(b) GDPR applies. STRATO GmbH in Berlin hosts our mailboxes as our processor. Providing details is voluntary; without a way to contact you, we cannot reply. We delete correspondence once the enquiry is settled. Where legal retention obligations apply, for example to business correspondence or accounting records, we keep only the necessary documents for the required period.

Page views without cookies

To see which pages people read and where they come from, our website program counts page views on the server. For each page it serves, it stores the page address, the website you came from (only its domain, for example reddit.com), the country derived from your connection and a device class (mobile, computer or automated). It does not store your IP address, sets no cookies and reads or stores nothing on your device; no script runs for this. Single visitors cannot be told apart. When you confirm a waitlist signup, the program also counts the page on which you used the form, with the country and the device class, but never your email address. The counts are stored in Cloudflare Workers Analytics Engine as part of Cloudflare's processing for us (see Visiting the website) and are deleted after three months. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is to improve our pages and guides.

We do not set cookies of our own and use no advertising or tracking services. Only if you use the switch between light and dark mode does your browser keep that choice in its local storage, so that the next page opens the same way. The choice stays on your device and is never sent to us; storing it is necessary for the function you asked for (section 25(2)(2) of Germany's TDDDG). Page content and typefaces are loaded from our own domain. The ink animation is computed locally in your browser. Open and click tracking are also switched off for our confirmation emails.

Cloudflare may use strictly necessary cookies during a security check, such as cf_clearance to record a passed check (configured to 30 minutes for our site), or __cf_bm for bot protection (expires after 30 minutes of inactivity). These support secure delivery, not advertising. Necessary browser access is based on section 25(2)(2) of Germany's TDDDG, and the related data processing on Article 6(1)(f) GDPR. See Cloudflare's cookie documentation for details; the section Visiting the website covers recipients, transfers and further retention.

Your rights

Subject to the legal conditions, you have the right of access, rectification, erasure, restriction of processing and data portability. You can withdraw consent at any time with effect for the future, without affecting the lawfulness of earlier processing. Write to support@hanzibyheart.com.

Your right to object

You may object at any time, on grounds relating to your particular situation, to processing based on Article 6(1)(f) GDPR. This includes delivering and securing the website, handling enquiries and retaining consent evidence. Write to support@hanzibyheart.com. Where data is processed for direct marketing, you may object at any time without giving a reason.

You can also lodge a complaint with a data protection supervisory authority, for example the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, www.ldi.nrw.de.

We do not make automated decisions within the meaning of Article 22 GDPR.