Privacy
Document under legal review: the marked details will be completed before launch.
This policy explains what data we handle, why, who we share it with and what rights you have. It has two parts: the Chui Learn app and the chuilearn.com website and the launch list. What comes at the end (rights, transfers, children, changes and contact) applies to both.
Who is responsible
The data controller is ICIVA TECHNOLOGY, C.A. (RIF J-50142968-5), based in the Bolivarian Republic of Venezuela. You can write to [email protected] with any question about your data.
The Chui Learn app
This part describes the categories of data we handle and the purposes we may use them for. If we ever want to handle a new category or use one for a new purpose, we'll update this policy and let you know first.
What data we handle
| Category | What it includes |
|---|---|
| Your account | Email, encrypted password, date of birth, username, and which version of these documents you accepted and when. If you sign in with Google, also the basic data Google hands over: email, name, photo and identifier. |
| Profile on your device | Avatar, profile photo and phone number. They stay on your device and never leave it. |
| Learning and progress | Words, exercise results, reviews, streak, HSK level and game stats. |
| What you create or send us | Custom words, the welcome survey, suggestions, problem reports, vocabulary corrections and other content you choose to save in your account. |
| Exercise voice | The audio from pronunciation exercises, only while it is being scored. |
| Technical data | Device model and name, system, app versions, language, time zone, carrier and connection type, random installation identifiers, IP address and the approximate location estimated from it (country, region or city). |
| Usage data, only if you agree | How you use the app: screens, features, actions and when you take them, and a summary of your learning. |
| Communications | Emails about your account and whatever you write to us. |
| Communication preferences | Whether you agreed to receive news emails, when you decided and which text you saw. |
Worth knowing
- Your voice. In pronunciation exercises, the app records your voice and sends it encrypted to our own server, where a speech recognition model we run ourselves scores it. The audio is always deleted once it has been scored, even if scoring fails. We don't keep the recording or its transcript, we don't use it to train models or clone voices, and we don't share it. The app only uses the microphone when you start a feature that needs it, such as pronunciation exercises.
- Your profile photo. You can pick it from your gallery or take it with the camera. The app only accesses the gallery or camera when you choose that option, and the photo never leaves your device.
- Your searches. When you look up a word in the dictionary, the search goes to our server only to give you the results. We don't store it.
- Usage data, only if you agree. At the end of the welcome we ask whether you want to share it, with the box unticked, and you can change it anytime in Settings → Privacy and security → "Share usage data". Only if you agree, PostHog receives how you use the app, a summary of your learning and, from the welcome survey, only the option you picked, never the text you type. PostHog doesn't store your IP address: it uses it on the spot to estimate your approximate location.
- News emails, only if you agree. In the welcome you can choose, if you like, to receive Chinese learning tips, news and offers from Chui by email. You can unsubscribe from the link in any of those emails or in Settings → Privacy and security → "News emails".
- Technical errors. When the app fails, it sends a report to Sentry with technical data and the calls to our server before the error (address, result and duration, without their content).
- Identifiers. Sentry and PostHog receive your account's internal identifier and a random installation identifier, never your email. Neither uses your phone's advertising ID. We never send them your voice, email, phone number or photos.
- Bot protection. When you sign up or sign in with email and password, recover or change your password, change your email and delete your account, Cloudflare Turnstile checks you aren't an automated program, using technical data from your device and connection.
What we use it for
| Purpose | Data | Legal basis |
|---|---|---|
| Providing the service: your account, your progress, syncing and scoring your pronunciation | Account, learning, what you create, exercise voice | Contract |
| Writing to you about your account and replying to you | Account, communications | Contract |
| Sending you Chinese learning tips, news and offers from Chui by email, only if you agree | Account (email), communication preferences | Consent |
| Security and abuse prevention | Technical | Legitimate interest |
| Stability and fixing errors | Technical | Legitimate interest |
| Improving the app with aggregate learning statistics, for example which exercises are hardest | Learning | Legitimate interest |
| Detailed usage analytics, including which country or campaign users come from | Usage, technical | Consent |
| Checking the minimum age and complying with the law | Date of birth and whatever the law requires | Legal obligation |
Where the basis is legitimate interest, you can object by writing to us. Where it is your consent, you can withdraw it anytime, without affecting what was done before.
Who we share it with
We don't sell your personal data. We only share it:
- with the providers that run the app on our behalf, listed below;
- when you decide to, for example if you link your account with another platform or an institution;
- as aggregate or anonymised data that doesn't identify you;
- if the company merges or is sold, letting you know first in the app;
- if the law requires it or to defend our rights.
Providers that run the app:
- Our server (Venezuela): learning, what you create or send us and, only while it is being scored, exercise voice.
- Supabase (Oregon, United States): accounts and sign-in.
- Google: confirms your identity if you sign in with Google.
- Resend (Virginia, United States): your account emails and, if you agree, news emails.
- Cloudflare: bot protection.
- Sentry (United States): error reports.
- PostHog (United States): usage data, only if you agree.
The app shows no advertising today.
Aggregate and anonymised data
We may create aggregate or anonymised statistics from the app's data, removing what identifies you, and use them to improve Chui, for studies or to share them. We won't try to re-identify you from them.
How long we keep it
- Exercise voice is deleted as soon as scoring ends.
- Your account, your progress and what you send us are kept while your account exists.
- Your choice about news emails is kept while your account exists, as proof of your consent.
- If you don't use your account for 24 months, we'll delete it, emailing you first.
- Error reports are deleted from Sentry within 90 days at most, and Resend's email delivery logs after 30 days.
- Everything else is kept as long as its purpose needs and then deleted or anonymised.
You can delete your account anytime in Settings → Privacy and security → Delete account, or ask for it without the app from this page. Your account, username, all your progress and what you sent us, your usage data in PostHog, your news email subscription and the app's data on that device, including the avatar, are deleted immediately. Our server's backups are renewed daily and we keep the last 30, so within about 30 days your data is gone from them too.
Security
The app talks to our servers over an encrypted connection (HTTPS). Every request is authenticated with your session and each account can only see and change its own data. We rate-limit requests to stop abuse. No system is infallible, but if an incident affects your data we'll tell you as the law requires.
Features in the works
None of these features exists today or handles any data:
- the chat with Chui;
- a friends feature;
- premium pronunciation scoring with an outside provider;
- a premium subscription and advertising in the free version. Premium users won't see ads, and in that case the app won't load any advertising code. Personalised ads will only be shown with your consent;
- voice recordings you choose to keep, for example your pronunciation of a custom word. Unlike exercise voice, they would be kept in your account until you delete them or your account.
Before turning any of them on, we'll update this policy and let you know in the app.
The chuilearn.com website and the launch list
If you join the list we store this, and nothing else:
- your email address;
- the language of the site you joined from (Spanish or English);
- the exact text you agreed to and when you agreed to it;
- whether you have confirmed your email, and when we last emailed you;
- confirmation and unsubscribe codes, stored only in hashed form.
We use them to send you the confirmation email, tell you about Chui's launch and share news, which is what you agree to when you tick the box. If you don't confirm your email, we delete it after 30 days. If you unsubscribe with the link in any email, we delete your record entirely. The list is stored on Supabase (Oregon, United States) and the emails are sent by Resend.
The site uses no cookies. It is hosted by Cloudflare, which records technical visit data, such as IP, in its server logs. To count visits we use Cloudflare Web Analytics, which does so in aggregate (pages viewed, country, device type) without cookies, without identifying you and without tracking you across sites. The site remembers in your browser the language you pick, without sending it anywhere. When you use the form, Cloudflare Turnstile checks you aren't a bot using technical data from your browser and your IP. We don't store your IP on the list.
Our legal bases for the site and the list
The launch list is based on your consent, which you withdraw by unsubscribing. Bot protection and the site's technical logs are based on our legitimate interest in it working well and not being abused.
Your rights
You can ask us to access, correct or delete your data, restrict or object to its use, receive it in a portable format or withdraw your consent by writing to [email protected]. We'll reply within 30 days. You can do many of these yourself in the app: change your details, turn off usage data or delete your account. In Venezuela, the Constitution gives you the right to access your data and ask for it to be corrected or destroyed (Article 28). You can also complain to the data protection authority in your country.
Residents of California and other US states: we don't sell your personal data, and today we don't share it for targeted advertising; if that changes, we'll first give you the option to opt out. You can exercise the rights to know, delete and correct by writing to us, and you won't be treated differently for doing so.
International transfers
We are a Venezuelan company and our server is in Venezuela; several providers process data in the United States, as listed above. So your data may be processed outside your country. If we move the server to another country or to a cloud provider, we'll update this policy. For data of people in the European Union we rely on the European Commission's standard contractual clauses, included in each provider's data processing agreement, or on the EU-US Data Privacy Framework where the provider is certified. [legal review]
Children
The app and the list are for people aged 16 or over. The app asks for your date of birth when you create your account and doesn't let anyone under 16 sign up; if an account created with Google shows an age under 16, it is deleted on the spot. If you think someone under 16 has given us their data, write to [email protected] and we'll delete it.
Changes
If we change this policy we'll update the date above. If the change is significant, we'll let you know first in the app or by email.
Contact
ICIVA TECHNOLOGY, C.A. · RIF J-50142968-5 · Venezuela · [email protected]