HanziTales — Privacy Policy
Effective date: 22 September 2026 Last updated: 30 October 2026
This policy explains what personal information Rifta Studio LLC ("Rifta Studio", "we", "us") collects through the HanziTales app and website (the "Service"), why, who we share it with, and the choices you have.
Rifta Studio LLC is a limited liability company registered in the State of Washington, United States, and is the controller of the personal information described here, except where the School and Educator Addendum applies, in which case the School is the controller and we act on its instructions.
Contact: support@hanzitales.com · legal notices: legal@hanzitales.com
1. The short version
- We ask for an email address and a display name, or you can sign in with Google, Apple or Kakao, which give us an identifier for your account with them and usually your email address (section 2.1). That is all the identity information we need.
- We do not use advertising SDKs, advertising cookies or trackers. There is no advertising in HanziTales. We count visits, sign-ups, the days the app is used, and which of its screens are opened and what is tapped on them ourselves, with a random identifier, and our website host counts page views without cookies (section 2.2).
- If an ad brought you to our website, we tell the ad network that showed it when you sign up, read your first chapter or make a purchase, using the click identifier the ad network put in the link, so it can measure its ads. We never send your email, name or account identifier. We don't do this if your browser sends Global Privacy Control or if you are in the EEA, the UK or Switzerland, and you can opt out (section 5.1).
- We do not sell your personal information. The reports to ad networks in section 5.1 may count as "sharing" for cross-context behavioural advertising under US state privacy laws; that is the only such sharing we do.
- What you write into the Service (plot ideas, prompts), and the Chinese text you photograph or paste to read as a private text, is sent to AI providers so that a story, translation or audio track can be made. Those providers are contractually barred from training on it. We never keep your photos, only the text read from them, and a private text is seen by no one but you (section 2.1).
- Your learning data mostly lives on your device, and is synchronised to our servers so you can use more than one device and not lose it.
- You can delete your account at any time — see section 9.
2. Information we collect
2.1 Information you give us
| What | Examples | Why |
|---|---|---|
| Account | Email address, password (stored only as a salted hash by our authentication provider), display name | Create and secure your account, sign you in, send service emails |
| Sign-in with Google, Apple or Kakao (if you choose it) | The provider's identifier for your account with it, and what the provider sends with it: usually your email address (Apple may give a private relay address that forwards to you; Kakao may give none), and your name and profile picture if that provider shares them. For Apple, a token Apple issues to us, kept on our servers only | Sign you in and link the sign-in to your HanziTales account. Apple's token lets us withdraw HanziTales' access to your Apple ID when you delete your account or unlink Apple, as Apple requires. We never receive your password for those accounts, and we don't use your name or picture as your display name |
| Content you write | Plot ideas, prompts, titles, character names and descriptions, your edits | Generate and store your books |
| Private texts (if you use them) | Up to four photos of a Chinese text that you take with your camera or choose from your device, or text you paste; the Chinese text read from the photos, as you checked and corrected it, with its title and the names in it | Make the text readable for you, with pinyin, translation and audio, as a private text in your library. The photos are sent to our AI provider to read the text off them and are not stored or logged by us: we keep only the text. A private text is visible to you alone, until you delete it |
| Learning activity | Words you mark as known or starred, quiz answers, correct/incorrect results, review scheduling state, reading position, listening activity, confidence data | Run spaced repetition, pick the right vocabulary, adapt the difficulty of generated text |
| Ratings and reviews | Ratings you give to books and chapters, difficulty ratings on vocabulary | Recommend books, improve difficulty estimates |
| Feedback | The message you send from the in-app feedback tool, plus the screen you were on, the platform and the app version | Answer you, fix bugs |
| Support correspondence | Emails you send us | Support |
2.2 Information we generate or receive
| What | Examples | Why |
|---|---|---|
| Books and audio | The generated chapters, translations, pinyin, annotations and speech audio produced from your prompts | Deliver the Service |
| Usage and cost records | Which AI model was called for which of your requests, token counts, character counts sent to speech synthesis, timestamps, cost | Bill credits correctly, control abuse, manage costs |
| Credit and subscription records | Credit balance and ledger entries, plan, subscription status, trial use, renewal and expiry events, purchase identifiers and store receipts from our payments provider, redeem-code use | Give you what you paid for, prevent duplicate trials, keep required financial records |
| Technical and security logs | IP address, timestamps, request metadata and error diagnostics recorded by our hosting provider; crash logs stored locally on your device | Security, abuse prevention, debugging |
| Device-local data | A local copy of your vocabulary, progress and books, in a database on your device, and small app preferences | Offline use and speed |
| Visit, sign-up and app-use counts | A random identifier created on your device; which of our pages and page versions you saw, whether you tapped its button, installed the app, signed up or signed in; when you install the Android app from our website's button, which visit to our website it came from, so the app can bring over the words and progress you had there; that you opened the app, once a day; which screens of the app you open, what you tap on them and how far down you scroll (the screen's name, such as "library"; the name of what you tapped, such as the button "Read chapter 1", and where on the screen; never what you type, and in a book not which word you tapped); when you leave the app and come back; the kind of any error message you see (such as "offline"), not its text; how long the app and its pages take to load; the language the app is showing; that you opened the plans or started a purchase; your platform; your device's or browser's language setting (such as "es-AR"); your approximate location — country, state or region, and city — which our website host works out from your IP address when the record is sent (we keep the place, not the IP address); on the website, your browser's time zone setting (such as "Asia/Singapore"), from which we infer your country when the IP address gives none; your device type (phone, tablet or computer), operating system, browser, screen and window size, pixel density and whether it has a touch screen; how fast our app's code downloaded to you and your browser's own estimate of your connection (such as "4g"); the domain of the site that linked to us; campaign tags in the link (such as utm_source, the ad's keyword, the ad's identifier and the device type the ad network reports); which kind of ad click brought you | Learn which pages, campaigns and places bring learners and where to advertise, count how many learners use the Service each day, week and month, and see where in the app people get stuck so we can improve it. See Cookies and Local Storage |
| Ad click identifiers | When you arrive on our website from an ad on Google, Meta (Facebook, Instagram) or Microsoft (Bing), the click identifier the ad network adds to the link (gclid, gbraid, wbraid, fbclid or msclkid), with the random identifier above and the page you landed on. Not kept if your browser sends Global Privacy Control, or if you are in the EEA, the UK or Switzerland | Tell that ad network when you later sign up, read your first chapter or make a purchase (section 5.1) |
| Page views on the website | Counted by our website host, Vercel (Web Analytics), without cookies: the page, the referring site, browser, operating system, device type and country. Vercel tells visits apart within a day by a hash of the request that it discards; it keeps no IP address or lasting identifier | See which pages are read and where readers come from, including visits our own counting misses |
We do not collect: precise location, contacts, microphone input, biometric data, health data, device advertising identifiers (such as Apple's IDFA or Google's advertising ID), or a device fingerprint. The app uses your camera or photo library only when you choose to photograph or pick a page for a private text, and only the photos you choose leave your device; we keep the text read from them, never the photos.
2.3 Payment information
We never see or store your card number. Purchases in the mobile apps are processed by Apple or Google. Purchases on the web are sold through Link, the merchant-of-record service operated by Stripe, which collects your payment details, billing address and email at its checkout and handles them as an independent controller under its own privacy policy (https://link.com/privacy). We receive only the fact and identifiers of a purchase — plan, product, status, dates, a transaction identifier — which we store as subscription and credit records.
3. Why we use it, and our legal bases
For users in the EEA, UK and Switzerland, the legal bases under the GDPR are:
| Purpose | Legal basis |
|---|---|
| Creating your account, providing learning features, generating books, syncing your data, processing purchases, giving support | Contract (Art. 6(1)(b)) |
| Keeping the Service secure, preventing fraud and abuse of credits, debugging, measuring our own costs, measuring which of our pages and campaigns bring learners and how many learners use the Service, defending legal claims | Legitimate interests (Art. 6(1)(f)) — balanced against your rights; we use the least identifying data that works |
| Editing and publishing books generated through the Service as our own commercial products, as described in section 7 of the Terms of Service | Legitimate interests (Art. 6(1)(f)) — we publish the text, never your identity: we do not name you without your consent and we remove personal details before publication. You may object at any time at support@hanzitales.com; we will then not publish any book generated from your prompts that we have not already published |
| Keeping invoices, tax and transaction records; responding to lawful requests | Legal obligation (Art. 6(1)(c)) |
| Optional emails that are not service messages; any feature we describe as opt-in | Consent (Art. 6(1)(a)), withdrawable at any time |
We do not keep ad click identifiers or send reports to ad networks (section 5.1) for visitors in the EEA, the UK or Switzerland.
We do not carry out profiling that produces legal or similarly significant effects, and we do not make automated decisions of that kind about you. Adapting reading difficulty to your vocabulary is automated, but it only affects the learning material you are shown.
4. Artificial intelligence processing
To generate a story, translate a word, annotate a chapter or produce audio, we send the necessary content to third-party AI and speech providers. What is sent is the prompt, the text being worked on, and the vocabulary constraints, and for a private text, the photos you chose — not your email address, name or account identifier.
The providers we currently use for this are:
| Provider | Role | Location |
|---|---|---|
| Anthropic, PBC (Claude) | Story, chapter, plot and annotation generation; reading the Chinese text in the photos you choose for a private text | United States |
| OpenAI, L.L.C. | Word and character translation, some generation and title tasks | United States |
| Together AI (Qwen models) | Some generation and translation tasks | United States |
| Google Cloud Text-to-Speech | Converting Chinese text to speech audio | United States |
We use these providers under their API and business terms, which provide that content submitted through the API is not used to train their models, and is retained only briefly for abuse monitoring before deletion. We do not send them your identity, and we do not permit them to use your content for their own purposes.
We may change providers. When we do, we will update this policy and the Subprocessors list.
5. Who else we share information with
We share personal information only with the service providers we need to run HanziTales, each under a written contract that restricts them to our instructions. The current list, with roles and locations, is maintained at Subprocessors and includes:
- Supabase — database, authentication, file storage and server functions (hosting on cloud infrastructure in the United States).
- Vercel — hosts the website and web app, and works out a visit's approximate location from its IP address.
- The AI and speech providers in section 4.
- RevenueCat — subscription and purchase state management.
- Email delivery for account emails such as password resets.
Apple and Google, which distribute the app and act as merchants of record for mobile purchases, and our web payment processor, which handles purchases made outside the mobile apps, also receive purchase information. They act as independent controllers under their own terms and privacy policies, not on our instructions.
Google LLC, Apple Inc. and Kakao Corp. are sign-in providers if you choose to sign in with one of them. Signing in happens on their pages or in their apps, so they learn that you signed in to HanziTales, under their own privacy policies, as independent controllers. When you delete your account or unlink Apple, we ask Apple to revoke HanziTales' access. On the website, opening a sign-in form loads Google's and Apple's sign-in scripts from their own servers; Google's may use its own cookies to show you the Google account you are signed in with there. We receive nothing from them unless you choose to sign in.
We also disclose information:
- when the law requires it, or to respond to a valid legal request — we will notify you where we are permitted to;
- to establish, exercise or defend legal claims;
- to protect the rights, safety and property of users, the public or us, including handling reports of illegal content or child endangerment;
- to a buyer or successor in a merger, acquisition or sale of assets, subject to this policy.
5.1 Reports to ad networks
When we advertise, we want to know which ads bring learners who stay, and the ad networks use the same information to decide where to show our ads. So when you arrive on our website from an ad, we keep the click identifier the ad network put in the link, for up to 90 days. If, within that time, you sign up, read your first chapter or make a purchase, we send the ad network that showed the ad:
- the click identifier;
- what happened (sign-up, first chapter read, or purchase), and when;
- for a purchase, its price in US dollars;
- a reference number of ours, so the same report is not counted twice.
We never send your email address, name, account identifier, IP address or anything you wrote or read. The ad networks are Google LLC (Google Ads), Meta Platforms, Inc. (Facebook and Instagram ads) and Microsoft Corporation (Microsoft Advertising). Each can link the report to the click it recorded when you clicked its ad, and to what it already knows about whoever clicked, under its own privacy policy, as an independent controller.
We don't keep the click identifier or send any report:
- if your browser sends Global Privacy Control (a setting in some browsers and extensions) — we treat it as your opt-out of sharing;
- if you are in the EEA, the UK or Switzerland;
- if you asked us not to: write to support@hanzitales.com from your account email, and we delete the click identifiers we hold for you and send no further reports.
Arriving without an ad, or from an ad network not listed above, means no report is ever sent.
5.2 No sale
We do not sell personal information. Apart from the reports in section 5.1, which may count as "sharing" for cross-context behavioural advertising under California law, we do not share personal information for advertising. We do not knowingly sell or share the personal information of anyone under 16.
6. Other users and shared content
If you share a book into the shared library, other HanziTales users can read and listen to it, and your display name may be shown as its creator. Ratings you give are used in aggregate to recommend books; individual ratings are not shown to other users with your name attached.
If you delete your account, shared books stay available with your name replaced by a neutral label — see section 9.
Books may be published by us. As explained in section 7 of the Terms of Service, we may edit and publish books generated through the Service as our own commercial products, including for sale through third-party retailers. We do not publish your name or any detail identifying you as the source without your consent, and we remove personal details before publication. You can ask us not to publish books generated from your prompts, or ask to be credited, at support@hanzitales.com. Once you ask, we will not publish any book generated from your prompts that we have not already published.
Do not put personal information about yourself or anyone else into prompts, character names or book text.
Private texts are never shared or published. A private text, and everything made from it, is visible to you alone: it never enters the shared library or another user's library, and we do not publish it under section 7 of the Terms of Service. A photo of a letter or a document can contain personal details about other people; we process them only to make the text readable for you, but photograph only what you need to read.
7. Where your information is processed
We are based in the United States, and our providers process personal information in the United States. If you are in the EEA, the UK or Switzerland, this means your information is transferred outside your country.
For those transfers we rely on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum), incorporated into our contracts with our providers, together with the technical and organisational measures in section 10. Where a provider is certified under the EU–US Data Privacy Framework, or its UK Extension or the Swiss–US framework, we may rely on that certification instead. You can request a copy of the relevant clauses at support@hanzitales.com.
8. How long we keep it
| Data | Retention |
|---|---|
| Account, learning progress, your books | While your account exists, and until deletion completes |
| Private texts | Until you delete the text (from its page) or your account. The photos are not kept: they are discarded once the text has been read from them |
| Sign-in links to Google, Apple or Kakao | While your account exists, or until you unlink that provider. Apple's token: until you delete your account or unlink Apple, when we revoke it and delete it |
| Feedback and support correspondence | Up to 3 years, then deleted or stripped of identifiers |
| Security and server logs | Typically 30–90 days, longer only where an active security or abuse investigation requires it |
| Visit, sign-up and app-use counts | Up to 25 months; the screens you opened and what you tapped, 90 days. Unlinked from your account when you delete it |
| Ad click identifiers | 90 days. The record that a report was sent is kept without the identifier for up to 13 months, and deleted with your account |
| AI usage and cost records | Up to 3 years, pseudonymised after account deletion, then deleted or aggregated |
| Credit ledger, invoices and transaction records | As long as tax and accounting law requires, typically 7 years, in pseudonymised form after account deletion |
| Backups | Daily backups of the database, and encrypted off-site copies of the database and stored files, are kept on a rolling window of up to 30 days, after which deleted data ages out |
9. Deleting your account, and what survives
You can delete your account in the app, under Account › Delete account; deletion there is immediate. If you no longer have the app, follow https://hanzitales.com/delete-account.html and we complete deletion within 30 days of a verified request.
| Data | What happens |
|---|---|
| Sign-in record, email, password hash, display name, profile, links to Google, Apple or Kakao | Permanently deleted. If you signed in with Apple, we first ask Apple to revoke HanziTales' access, so it leaves your Apple ID's list of apps using Sign in with Apple |
| Learning progress, review scheduling state, known and starred words, reading history, confidence data | Permanently deleted after being folded into non-identifying aggregate statistics |
| Books you generated and never shared, and your private texts | Permanently deleted |
| Books you shared into the library | Kept, with the owner replaced by a single shared "former member" label |
| Ratings you gave | Kept, attributed to the same shared label, with timestamps coarsened |
| Feedback you sent | Kept as text, with your identifier and email removed |
| AI usage and cost records | Kept, with your identifier removed |
| Credit ledger, subscriptions, invoices | Kept in pseudonymised form for as long as tax and accounting law requires |
| Backups | Removed as the backup window rolls forward |
What survives is attached to one shared label used for everyone who has left, not to a per-person identifier, so the remaining rows cannot be traced back to you or linked to each other as one person's history. We commit not to attempt to re-identify de-identified or aggregated data.
Cancel your subscription in the App Store or Google Play before deleting your account, otherwise the store may continue to bill you — we cannot cancel a store subscription on your behalf.
10. How we protect information
- Traffic between the app and our servers is encrypted with TLS; stored data is encrypted at rest by our hosting provider.
- Passwords are stored only as salted hashes, by our authentication provider. We never see your password.
- Access to your rows in our database is enforced at the database level by row-level security, so one account cannot read another's data.
- Administrative access is limited to those who need it and requires authentication.
- Provider API keys are held as server-side secrets and are never shipped in the app.
No system is perfectly secure. If a breach affects your personal information, we will notify you and the relevant regulators where the law requires, without undue delay.
11. Your rights
Everyone
You can download a copy of your data in the app, under Account › Download my data. You may also ask us to give you a copy of your data, correct it, or delete it, by writing to support@hanzitales.com from your account email. We do not charge for this, and we do not discriminate against you for exercising these rights.
EEA, UK and Switzerland (GDPR)
You have the right to access, rectification, erasure, restriction of processing, data portability, and to object to processing based on legitimate interests. Where processing is based on consent, you may withdraw it at any time, without affecting processing already carried out.
We respond within one month, extendable by two further months for complex requests, in which case we will tell you.
You may complain to your national supervisory authority. Since we are not established in the EU, we rely on the derogation in Article 27(2) GDPR for occasional, low-risk processing where applicable; if we are required to designate an EU or UK representative, their details will be published here.
California (CCPA/CPRA)
You have the right to know what we collect, use and disclose, to delete, to correct, to opt out of sale or sharing (we do not sell; to opt out of the sharing in section 5.1, turn on Global Privacy Control in your browser, or write to support@hanzitales.com from your account email), to limit the use of sensitive personal information (we do not collect sensitive personal information as defined by the CPRA, beyond account credentials used solely to authenticate you), and to be free from retaliation for exercising these rights. We do not offer financial incentives for personal information.
Categories collected in the last 12 months, using CPRA terms: identifiers (email, display name, account identifier — which is also the user ID our payments provider stores — the identifier of a Google, Apple or Kakao account you sign in with, app store transaction identifiers, IP address, ad click identifiers); commercial information (purchases, subscription status, credit ledger); internet or network activity (app usage and request logs); geolocation data, approximate only (country, state or region, and city from your IP address, and the country we infer from your browser's time zone setting); and inferences drawn for learning purposes (estimated vocabulary knowledge and difficulty). These come from you and from your use of the Service, are used for the purposes in section 3, and are disclosed for business purposes only to the providers in section 5. Ad click identifiers, with the event they led to (internet or network activity and, for a purchase, commercial information), are shared with the ad network that showed the ad, as described in section 5.1.
You may use an authorised agent, with proof of authorisation. We verify requests by matching them to the email on the account, or, for an account without an email (some Kakao sign-ins), by asking you to make the request from the app while signed in.
Other US states
Residents of states with comprehensive privacy laws — including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana and others — have comparable rights to access, correct, delete and obtain a portable copy, and to appeal a refusal. To appeal, reply to our decision with the subject "Privacy appeal"; we will respond within 45 days.
Washington My Health My Data Act
We do not collect consumer health data as defined by that Act. If that ever changes, we will publish a separate consumer health data privacy notice before collecting it.
12. Children
Consumer HanziTales accounts are for users aged 13 and over. We do not knowingly collect personal information from children under 13 for consumer accounts, and the Service is not directed to them. If you believe a child under 13 has created an account, write to support@hanzitales.com and we will delete it.
HanziTales does not currently offer School accounts. If and when we do, and a School uses HanziTales for pupils, including pupils under 13, the School and Educator Addendum governs, the School provides the consent required by COPPA on behalf of parents, and we process pupil data only for educational purposes on the School's instructions — never for advertising, profiling for non-educational purposes, or sale.
13. Cookies and local storage
The HanziTales app uses local device storage — not cookies — to hold your learning database and preferences. The website uses what is strictly necessary to sign you in and remember your session, plus a random identifier for counting visits, sign-ups and app use ourselves. Our website host counts page views without cookies. Sign-in forms load Google's and Apple's sign-in scripts (section 5). We do not use advertising cookies; an ad's click identifier is kept on our servers as described in section 5.1, not in your browser. See Cookies and Local Storage.
14. Changes to this policy
We will post any change here with a new "last updated" date. For changes that materially affect how we use your personal information, we will notify you in the app or by email at least 30 days before they take effect, and where the law requires consent, we will ask for it.
15. Contact
Questions, requests or complaints: support@hanzitales.com. Legal notices: legal@hanzitales.com.