Privacy Policy

1. Information we collect

We may collect, store, and use the following types of personal information:

• Information you provide: If you contact us through our contact form, we collect your name, email address, and the content of your message. If you create an account, we collect your email address and a password.
• Information from Google Sign-In: If you choose to sign in with Google, Google provides us with your email address, display name, and profile photo address. We use the name and photo only to show who is signed in.
• Study progress: If you are signed in, we store which vocabulary words you have marked as known or flagged for review, recorded per HSK level, along with your chosen avatar and a first-run flag.
• Automatically collected information: Our web server records standard access logs containing your IP address, the date and time of each request, the page requested, the response status, the referring page, and your browser and operating system. Our site is served through Cloudflare, which keeps its own records and can derive an approximate, country-level location from your IP address.

We do not collect payment information. HSK Hero has no paid tier, and any support you choose to give through Ko-fi is handled entirely on Ko-fi's own site.

We do not collect special-category data such as health, biometric, or genetic data, racial or ethnic origin, religious or political beliefs, or sexual orientation. We do not collect precise location: the site never requests it, and our server sends a Permissions-Policy header that disables the browser's location, microphone, and camera access.

2. How we use your information

We use the information collected for the following purposes. Under the UK GDPR we must also tell you our legal basis for each one:

• To create and authenticate your account, and to verify your email address — necessary for the performance of a contract.
• To save your study progress and synchronise it across your devices — necessary for the performance of a contract.
• To send you account emails, such as email verification and password resets — necessary for the performance of a contract.
• To answer questions and support requests you send us — our legitimate interest in responding to people who contact us.
• To keep the site running securely, diagnose faults, and prevent abuse and spam — our legitimate interest in the security and reliability of our service.
• To store non-essential cookies — only where you have given consent.

We do not use your information for advertising, profiling, or automated decision-making, and we do not send marketing or promotional emails.

Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights, and have limited this processing to what is needed to keep the site working and secure. Where we rely on consent, you may withdraw it at any time through the Cookie Settings link in the site footer, without affecting anything done beforehand.

3. Cookies and tracking technologies

We set one cookie of our own, cookie_consent, which records the choices you make in the cookie banner so that we do not ask you again. It lasts 365 days and is essential to respecting your preference.

We also use your browser's local storage, which is not a cookie and is never sent to our servers. It holds your study progress, your chosen avatar, your pinyin display preference, your last-used study scope, and a marker noting whether you are signed in. Signing in also causes Google Firebase to store authentication data in your browser so that you stay signed in between visits.

We use Cloudflare Web Analytics to understand how many people visit the site and which pages they use. It measures page views, referring sites, and general information about the browser, operating system, and country of each visit, along with page performance data. It does not use cookies, does not store anything on your device, and does not track you across other websites. We see only aggregated figures, never an individual visitor's browsing history.

You can review and change your choices at any time through the Cookie Settings link in the site footer, or by adjusting your browser settings. Some features may not work properly if you block essential cookies.

4. Data sharing and disclosure

We do not sell your personal information. We share it only with the service providers we rely on to run the site, and only where required by law:

• Service providers: Google (Firebase Authentication, Cloud Firestore, and Google Sign-In) handles accounts and stores study progress. Cloudflare serves and protects the site and provides the bot check on our contact page. Web3Forms delivers contact form messages to us. Google Fonts serves the typefaces used on our pages, which means Google receives your IP address each time a page loads. No cookie is set by that request.
• Legal requirements: We may disclose your information if required by law, or to protect the rights, property, or safety of HSK Hero, our users, or others.
• Business transfers: If HSK Hero is transferred to another owner, your information may be transferred as part of that transaction.

International transfers. These providers operate from outside the UK and EEA, including the United States. Where personal data is transferred outside the UK or EEA, those transfers are covered by the safeguards the providers have in place, such as the UK International Data Transfer Addendum, EU Standard Contractual Clauses, and the UK–US and EU–US Data Privacy Framework.

5. Data retention

We keep your personal information only for as long as it is needed:

• Account data is kept for as long as your account exists. When you delete your account, your stored progress is removed first and your account is then deleted. Both steps are immediate and cannot be reversed by us. Copies may persist briefly in our providers' routine backups before ageing out on their own schedules.
• Contact form messages are kept for up to 12 months after we have dealt with your enquiry, in case you follow up, and are then deleted.
• Server access and error logs are kept for no more than 15 days — the current day's log plus 14 daily rotations — after which they are deleted automatically. Cloudflare retains its own records and analytics data on its own schedule.
• Information in your browser stays on your device until you clear your browsing data. We cannot remove it for you, but the Reset Progress button clears the progress it holds.

6. Your rights

Under the UK GDPR, you have the following rights regarding your personal data:

• Access: You can request a copy of the information we hold about you.
• Rectification: You can ask us to correct any inaccuracies in your data.
• Erasure: You can ask us to delete your personal data, subject to certain conditions.
• Restriction: You can ask us to restrict how we process your data in certain circumstances.
• Objection: You can object to our processing of your data.
• Portability: You can request a copy of your data in a machine-readable format.

For anything else, email us at [email protected]. We will respond within one month.

If you are unhappy with how we have handled your data, you can complain to the UK Information Commissioner's Office at ico.org.uk, or to your local supervisory authority if you are in the EEA.

7. Security

The site is served only over HTTPS. Passwords are managed by Google Firebase Authentication and are never stored by, visible to, or accessible to us.

Access to account records is enforced by database security rules, not just by our application code. A request must be authenticated, must be for that user's own record, and must come from an account with a verified email address before any data can be read or written. No other data is readable. We also send a Content-Security-Policy and related security headers to reduce the risk of injected content.

We implement appropriate technical and organisational measures to protect your personal information from unauthorised access, loss, or misuse. However, no system is completely secure, and we cannot guarantee the absolute security of your data.

8. Children

HSK Hero is intended for a general audience and is not directed at children.

Creating an account requires you to be at least 13. This is because an account stores an email address; it is not a restriction on using the site. All study content — flashcards, quizzes, typing tests, the grammar guide and both games — works without an account, and progress is saved in the browser, so a younger learner can use everything HSK Hero offers.

We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has created an account, contact us at [email protected] and we will delete the account and its data. We are always happy to do this, and you do not need to give a reason.

9. Third-party links

Our site contains links to third-party websites, including our Ko-fi support page. We are not responsible for the privacy practices or the content of these sites. We encourage you to review the privacy policy of any third-party site you visit.

10. Changes to this privacy policy

We may update this privacy policy from time to time. Any changes will be posted on this page with an updated "Last updated" date. We encourage you to review this policy occasionally to stay informed about how we protect your data.

11. Contact us

HSK Hero is operated by Charles Wagner, an individual based in Singapore, who is the data controller for the purposes of this policy.

If you have any questions or concerns about this privacy policy or how we handle your personal information, please contact us at [email protected], or through the form on our contact page.