Privacy policy

• We collect what is needed to teach you: your account, your preferences, and what you got right and wrong.
• Voice recordings are analysed and discarded by default. Only the derived scores are kept, unless you turn retention on yourself.
• We do not sell or share personal data for marketing, we run no advertising, and we set no advertising cookies.
• Your content is not used to train models.
• You can export everything as JSON and delete your account, both without asking us.

The operator of HSK Guide is the controller for the data described here, except where a school or organisation has enrolled you — in that case the institution is the controller for the learning records it asks us to process, and we act as its processor under a written agreement.

• Performance of a contract: your account, your learning records, scheduling, examinations, billing and support. Without these the service cannot be provided.
• Legitimate interests: security, abuse prevention, aggregate and de-identified analysis of how content performs so that a badly written question can be found and fixed. We do not profile you for advertising.
• Consent: retaining voice recordings, optional email such as the monthly study-notes letter, and anything else the interface asks you to switch on. Consent can be withdrawn in Settings at any time, and withdrawing it is as easy as giving it.
• Legal obligation: keeping invoices and tax records for as long as the law requires.

Where the browser supports it, the pitch track is computed on your device and only the contour is sent, so the audio itself never leaves your machine. Where analysis has to happen on the server or with a configured speech provider, the audio is processed and deleted immediately afterwards; it is not written to permanent storage.

If you turn retention on in Settings → Privacy → “Keep my voice recordings”:

1. Recordings made from that point on are stored so you can play them back and compare your progress over time.
2. Every recording can be played back and deleted individually from the item it belongs to.
3. Settings → Privacy → “Delete all my recordings” deletes every stored recording in one action. It takes effect immediately and is not a flag on a row: the stored objects are removed.
4. Turning retention off stops new recordings from being kept. It does not delete the ones already stored — use the delete action for that.
5. Deleting a recording removes the audio. The scores derived from it stay part of your progress, because removing them would silently rewrite your history; deleting your account removes those too.

A school enrolling you cannot change this default on your behalf, and a teacher cannot listen to your recordings. Teachers see scores and weakness reports.

• Account and learning records: while your account exists. Delete the account and they go with it.
• Sessions: until they expire, at most thirty days, or immediately when you sign out.
• Security and audit logs: twelve months, then deleted.
• Contact messages: until the item is resolved, then twelve months so a correction can be evidenced, then deleted. Ask us to delete yours sooner and we will.
• Invoices and payment records: as long as tax and accounting law requires, which is longer than we would otherwise keep anything.
• A deleted account: removed from live systems immediately and from backups within thirty days.

We use service providers to run the platform, each under a data-processing agreement, each receiving only what its job needs. Which providers are in use depends on how this instance is configured — the platform is built so that every one of them can be replaced or run locally.

• Hosting and database: to store and serve everything.
• Email: to send verification links, password resets and billing notices.
• Payments: to take a subscription. Card details go to the payment provider and are never seen by us.
• Language model provider: only when the AI tutor is used, and only your message, the retrieved records and a profile summary — never your name, email address or billing details. Requests are sent under terms that exclude training on submitted data.
• Speech synthesis and recognition: to produce audio and to analyse pronunciation, under the retention rule above.
• Object storage: only for recordings you have chosen to keep, and any files you upload.

We do not sell personal data, we do not share it with data brokers or advertising networks, and there is no advertising on the platform. Where a provider is outside the European Economic Area, the transfer is covered by the European Commission’s standard contractual clauses or an adequacy decision.

We disclose data to an authority only where we are legally obliged to, and we will tell you unless we are prohibited from doing so.

You have the right to access your data, to correct it, to have it erased, to restrict or object to processing, to data portability, and to withdraw consent at any time. You can also complain to your national data protection authority — you do not have to come to us first.

• Export: Settings → Your data → “Export my data” produces a complete JSON export of your account, preferences, progress, notes, decks, tutor conversations and examination history. It is generated as a job and downloaded from the same screen. No request to us is required.
• Deletion: Settings → Your data → “Delete my account” permanently removes your account, your progress and any stored recordings. It asks you to type DELETE, because it cannot be undone.
• Recordings: Settings → Privacy → “Delete all my recordings”, as described above.
• Anything else — correction, restriction, objection, or a copy in another format — through the contact form, answered within thirty days.

The platform is not offered to children under 13. Between 13 and 16, use is through a school or with a parent or guardian. Where a school enrols a learner, the school is the controller for the learning records and must have the lawful basis to enrol them.

In an institutional context: a teacher sees completion, accuracy, scores and weakness reports. A teacher does not see tutor transcripts, personal notes or recordings. No learner under 18 is named in any public content on this site, in any testimonial or in any case study.

Two things on the platform are automated: the review scheduler, which decides when to show you an item again, and the readiness estimate, which predicts how prepared you are for a level. Neither produces a legal or similarly significant effect. Both are explained in the interface, both can be overridden by studying what you want, and neither is used to profile you for anything other than teaching you.

• Passwords are hashed with scrypt and a per-user salt, and compared in constant time. We cannot read your password and will never ask for it.
• Sessions use opaque random tokens, stored hashed, so a session can be revoked server-side the moment you sign out or delete your account.
• The session cookie is HttpOnly, SameSite=Lax and Secure in production.
• Administrative and content actions are written to an audit log with the actor, the change and the time.
• Where a breach is likely to result in a risk to you, we will notify you and the supervisory authority within the time the law requires.

Found a vulnerability? Report it through the contact form. We will not threaten you for a good-faith report.

A new version is published here with a new date. Where a change materially affects you — a new category of data, a new purpose, a new processor handling your content — we tell you in the application or by email before it takes effect, and ask again for consent where consent is what makes it lawful.