HanziTales — Cookies and Local Storage
Effective date: 22 September 2026 Last updated: 7 October 2026
This notice explains what HanziTales stores on your device. It forms part of the Privacy Policy.
The short version
We use no advertising cookies and no third-party trackers. Almost everything we store on your device is there to sign you in, remember your settings, and let the app work offline. The one exception is a random identifier we use ourselves to count how many people visit our pages, install the app, sign up and use it ("audience measurement", below). Our website host also counts page views, without cookies or storage on your device. When an ad brought you, its click identifier is kept on our servers, not on your device ("ad click identifiers", below).
In the mobile and desktop apps
The apps do not use cookies. They store data on the device itself:
| What | Where | Why | Kept for |
|---|---|---|---|
| Your learning database — vocabulary, progress, review scheduling, books, chapters | A local database file in the app's private storage | Offline use, speed, resilience if you lose connectivity | Until you sign out, delete the data, or uninstall |
| Downloaded audio | App storage or cache | Listening offline | Until cleared or uninstalled |
| Session tokens for your account | The platform's secure storage | Keeping you signed in | Until you sign out or the token expires |
| Preferences — chosen voice, language, quiz settings, last screen, sync position | App preference storage | Remembering how you left the app | Until you sign out or uninstall |
| Crash log | A file in the app's documents directory | Diagnosing a crash you report to us | Overwritten on the next crash; deleted with the app |
| A random install identifier | App preference storage | Audience measurement: counting installs, views of the sign-up screen, sign-ups, sign-ins, views of the plans and purchases started, and the days the app is opened | Until you uninstall |
Uninstalling the app, or using your platform's "clear app data", removes all of it. Deleting your account removes the server copy as well — see the Privacy Policy.
On the website and the web version of the app
| What | Type | Why | Kept for |
|---|---|---|---|
| Authentication and session tokens | Local storage / strictly necessary cookie | Keeping you signed in and protecting the session | Until you sign out, or the session expires |
| Your learning database | Browser storage (IndexedDB / origin-private file system) | Running the same offline-capable app in a browser | Until you sign out or clear site data |
| Preferences | Local storage | Remembering your settings | Until you clear site data |
| A random visitor identifier, and which version of a page you were shown | Local storage | Audience measurement: counting visits, clicks, sign-ups, sign-ins, views of the plans and purchases started, per page version, campaign link and country, and the days the web app is opened | Until you clear site data |
| Payment session, where you buy on the web | Strictly necessary cookie set by Stripe's Link service, the seller of web purchases, on its own checkout page | Completing the purchase securely, fraud prevention | Per that provider's policy |
| Google's and Apple's sign-in, only once you open a sign-in or create-account form | Their scripts, loaded from their servers; Google's reads and sets its own cookies on its own domain (Apple's opens a window on Apple's) | Offering "Continue with Google" or "Continue with Apple", and showing the Google account you are signed in with there. Nothing reaches us unless you choose to sign in | Per Google's and Apple's policies |
The sign-in scripts load only on a sign-in or create-account form, which you opened to sign in or create an account. All of these except the random identifier are strictly necessary for a service you have asked for, and are exempt from consent requirements under the ePrivacy Directive and equivalent rules. We set no cookie for advertising or profiling.
Audience measurement
To learn which of our pages, campaigns and places bring learners, the website and the apps keep a random identifier on your device and send us a short record when you view one of our landing pages, tap its button, install the app, see the sign-up screen, sign up or sign in, open the plans or start a purchase, and once a day when you open the app. A record holds that identifier, what happened, the page and page version, your platform (web, iOS, Android...), your device's or browser's language setting (such as "es-AR"), the domain of the site that linked to us, the campaign tags in the link you followed (such as utm_source), and which kind of ad click brought you. It also holds roughly where you are — country, state or region, and city — which our website host works out from your IP address as the record is sent; we keep the place, not the IP address. On the website it also holds your browser's time zone setting (such as "Asia/Singapore"), from which we infer your country when the IP address gives none. When you are signed in, it is linked to your account.
The records go only to our own servers. We use them for counts and conversion rates, such as how many learners use the app each day, never to profile you or to target advertising, and we do not share them; the only thing an ad network hears about is described under "Ad click identifiers", below. They are deleted after 25 months, and unlinked from your account when you delete it. To stop them, clear this site's data or reinstall the app; blocking storage prevents them too.
Page views counted by our website host
Our website host, Vercel, counts page views on the website with its Web Analytics: the page, the referring site, browser, operating system, device type and country. It sets no cookie and stores nothing on your device; it tells visits apart within a day by a hash of the request that it discards, and keeps no IP address. Browser extensions that block analytics block it too.
Ad click identifiers
When you arrive on our website from an ad on Google, Meta or Microsoft, the link carries a click identifier (gclid, gbraid, wbraid, fbclid or msclkid). The page sends it to our servers, with the random identifier above, and we keep it for 90 days to tell that ad network if you sign up, read your first chapter or buy — never your email, name or account. Nothing is stored in your browser for this. It is skipped when your browser sends Global Privacy Control and for visitors in the EEA, the UK and Switzerland; see section 5.1 of the Privacy Policy, which also explains how to opt out.
Controlling it
You can clear site data or block storage in your browser settings, and clear app data on your device. Doing so signs you out and removes your offline copy; your data on our servers is unaffected and downloads again when you sign in. Because our storage is strictly necessary, blocking it entirely prevents the app from working.
Changes
If we add any other non-essential storage, we will update this notice and ask for your consent first, where the law requires it.
Questions: support@hanzitales.com.