Privacy Policy

Effective date: October 24, 2026 · Contact: zqy327680399@gmail.com

Hanzi Steps ("we", "the site") is an online course for learning Chinese. The short version: we collect as little as possible, we never sell data, and there are no ads or trackers.

1. What we collect

Account basics — when you sign in with Google (or Meta), we receive your name, email address and a provider account id, so your purchase follows you across devices.
Payment records — payments are handled by Paddle, our merchant of record. We receive your email, what you bought and subscription status. We never see or store card details.
Learning progress — stored on your own device (browser storage), not on our servers.
Dictionary lookups — queries are sent to our lookup service and third-party dictionaries to fetch a definition.
Server logs — our host (Cloudflare) keeps standard technical logs (IP, timestamps) for security and abuse prevention.

2. What we do not do

We do not sell or rent your personal information.
We do not run advertising or third-party analytics trackers.
We do not send marketing email — only mail about your account or purchase.

3. Legal bases (GDPR)

Contract — to provide the course and honour the access you paid for.
Legitimate interests — to keep the site secure and prevent abuse.
Legal obligation — to keep purchase records that tax rules require.

4. Cookies and local storage

We use browser local storage only to keep you signed in and remember your progress. Paddle may set cookies on its own checkout page — see Paddle's privacy policy for that part.

5. Who we share with

Cloudflare — hosts the site.
Paddle — payments, invoices, taxes.
Google / Meta — only to verify your sign-in, if you use those buttons.
Dictionary providers (Wiktionary and similar) — only the word you look up.

6. Your rights

Ask us any time to show, correct or delete your account data (GDPR access / erasure; CCPA know / delete). Deleting your account removes your record from our servers. Email zqy327680399@gmail.com and we will answer within 30 days.

7. Data retention and security

Account and purchase records live in encrypted storage at Cloudflare and are kept while your account exists, or as long as tax rules require for purchases. Traffic is served over HTTPS.

8. Children

The site is not directed at children under 13, and we do not knowingly collect their data. Contact us if you believe a child has created an account.

9. Changes

If this policy changes materially we will update the date at the top and, for signed-in users, show a notice on the site.