Learning stays on your device
Your study progress, review schedule, selected level, and app settings are stored on your device. Your learning goal, target exam level and date, any optional language-experience and age-band answers, and placement-test answers and results are also stored locally. HSK Note does not currently offer its own user accounts or a cloud backup or sync service for study progress. Deleting the app or its local data can remove that progress.
The app plays prerecorded vocabulary audio. It does not record your microphone or send your voice for speech recognition.
Images and prerecorded audio are downloaded from Cloudflare when needed and cached on your device. The hosting provider receives the requested file path and ordinary connection information such as your IP address. The app does not attach purchase tokens or analytics identifiers to these requests. Uncached media requires internet access; cached files may be removed to free storage.
App usage and diagnostics
We use PostHog to understand onboarding, learning sessions, paywall use, purchases, and errors so that we can improve the app and investigate problems. Data can include a persistent analytics identifier, session identifiers, app and OS versions, device information, language, approximate location derived from an IP address, event times, and aggregate learning activity such as card counts and study duration.
The analytics identifier can be linked to an installation identifier and purchase records during purchase verification or restoration. We do not describe this linked information as fully anonymous. Session replay is not enabled, and the app does not display advertisements.
The free text you write in Settings > Send feedback, in the satisfaction survey, and in the word translation-error report is sent to PostHog (US endpoint) as part of an app analytics event so that we can improve the service. Entering an email address for a reply in Send feedback is optional; if you do, it is stored together with that feedback and used only to reply to your inquiry. It is used only to reply, and the reply is sent from our company support mail (Gmail). We do not use it for marketing or advertising and do not provide it to anyone other than PostHog (storage) and Google (Gmail, sending the reply). The satisfaction survey and the translation-error report do not ask for email. There is no separate server, account, or login. To have your data deleted, contact our support email and we will process your deletion request.
We also use Google Analytics for Firebase for app usage and purchase measurement. It processes app-instance identifiers, device and app information, usage events, and purchase amounts and currencies. SDKs may also collect their own automatic events and identifiers; app-level event controls do not mean that all SDK communication stops.
Advertising measurement
We use the Meta SDK to measure advertisements that bring learners to HSK Note, including app activation, onboarding, paywall visits, checkout and purchase events. Meta may process SDK and device identifiers, app and device information, event times, product identifiers, and purchase amounts and currencies for advertising measurement and optimization. The app does not display advertisements.
On iOS, access to the advertising identifier follows your App Tracking Transparency permission. You can change that permission in system settings. Declining permission does not prevent learning or purchasing and does not stop all analytics or aggregate advertising measurement. Android advertising identifiers and related controls are managed through your device settings. The TikTok SDK is not enabled in HSK Note.
On Android, the app reads installation referral information from Meta or Google Play to understand which advertising campaign led to an installation. It sends the referral string to our Cloudflare service for processing and, where applicable, decryption. This service does not write the raw referral string to our application database. Derived channel, campaign, ad group and ad identifiers or names are stored on the device and attached to subsequent PostHog and Firebase Analytics events, allowing installation sources to be analyzed alongside usage and purchase events. This does not mean that Cloudflare keeps no ordinary request logs.
Purchases and access
Apple App Store or Google Play processes your payment. We do not receive your payment-card number or store password. Our purchase service on Cloudflare processes an installation identifier, product identifiers, transaction identifiers or purchase tokens, purchase and expiry dates, and entitlement, refund, or revocation status. An analytics identifier may be associated with these records.
We use these records to verify purchases, provide paid access, restore purchases, prevent invalid claims, and understand purchase outcomes. The app may check its installation identifier with this service even if you have not bought anything.
Optional notifications and support
If you enable notifications, the app may register an Expo push token, platform, installation identifier, and registration timestamps with the HSK Note notification service. Expo and the Apple or Google notification services provide push delivery. Expo also processes its own device identifier, the Apple or Google push token, and app and project information to maintain delivery.
On Android, Firebase notification components can initialize automatically and generate or send a Firebase installation identifier, a notification registration token, and configuration data to Google before you grant permission to display notifications. After a previous Expo registration, the notification software can also refresh its token registration on later app starts or token changes. Turning notifications off does not stop all communication by these platform services.
When you turn notifications off in the app, or the app detects that permission has been revoked, it requests deletion of the associated push registration from the HSK Note server. If offline, deletion can be delayed until the app reconnects and retries. This request does not delete records already held separately by Expo, Apple, or Google; those providers process and retain information under their own policies. Uninstalling the app does not itself guarantee deletion from our server or these providers.
When you email support, we receive your email address, message, and any diagnostic information or attachments you choose to send. Our support inbox uses Gmail. Please do not send passwords, complete payment-card details, or private purchase tokens.
Service providers and international processing
We use Cloudflare for web delivery and the purchase and notification backend, PostHog for app and website analytics, Google Analytics for Firebase for app analytics, Meta for advertising measurement, Apple and Google for payments and platform services, Expo for push delivery, and Gmail for support. Providers process information for their respective services and may also have their own privacy obligations.
PostHog uses a US service endpoint, and Cloudflare and other providers operate internationally. Processing may take place outside your country, including in the United States. This website uses PostHog to measure page views and referral sources, which can include page URLs, referring URLs, browser and device information, request IP addresses and event times. Website analytics uses in-memory identifiers rather than persistent tracking cookies; automatic interaction capture and session replay are disabled. The hosting provider also receives ordinary request information to deliver and protect the site.
Retention and deletion
We keep information for the time needed to provide the relevant service, handle support and disputes, maintain security, and meet applicable legal obligations. We do not promise that all server or analytics data is automatically deleted after a fixed period. Removing the app does not by itself delete server-side purchase records or analytics data.
You can request deletion by email. We will identify the relevant records, review the request, and explain any records that must be retained under applicable law. Records retained for a legal obligation are restricted to that purpose. Removing purchase-to-device links may affect our ability to restore paid access automatically; we will explain this before processing a request that affects those links.
Your requests and choices
Contact us to request access, correction, deletion, or restriction of processing, or to raise a privacy concern. The rights and exceptions that apply depend on your location. We may need proportionate information to verify that a request relates to your data.
In Settings, use Support information to copy the support/installation ID and analytics ID, then include them in your request. Copying them does not send them to us. The analytics ID may show as unavailable if analytics has not initialized or is disabled. A support ID alone may not identify analytics records for a person who has not purchased. If these are unavailable, tell us your app version and what you want to request; do not send private credentials. Contact us before uninstalling if you want to preserve these identifiers.
Policy updates
We will update this page when our handling of information changes and provide any additional notice or choice required by applicable law. The date above identifies this version.