Privacy Policy

1. Who we are

ChineseReads (chinesereads.com) is a web application for learning Mandarin Chinese through graded texts and vocabulary tools. The service is offered as a personal project of José Víctor García Llorente, its creator and the data controller (contact details in section 10).

2. What data we collect

We collect the following personal data when you register and while you use the service:

• Email address
• Name
• Preferred language
• Password (stored encrypted using BCrypt — we never store plain passwords)
• Your learning activity (texts read, reading streaks, saved words and flashcard reviews), used to show your progress and to power optional reminders.
• If you subscribe to PREMIUM: billing identifiers that link your account to your subscription (a Stripe customer ID and subscription ID). Your card details are entered directly on Stripe and are never stored by ChineseReads.
• If you arrived through a promotional link or used a discount code: the campaign code involved (e.g. the name of the collaborator who recommended us), used only to measure how well each collaboration works.
• The texts and images you upload to create your own readers, together with the words and sentences processed from them. They stay private in your account until you delete them or delete the account.
• Account metadata: registration date, last login date, the monthly usage counters (text generations, audio plays and AI messages) used to enforce each plan's limits, and proof of your consents (when you accepted the terms and, if given, the email consent).
• Your IP address, transiently, to rate-limit requests and prevent abuse (for example on audio playback and on password-reset requests). It is not stored with your profile.
• Single-use technical tokens: the one-click unsubscribe token of the reminder emails and, when you request a password reset, the SHA-256 hash of the reset token (never the token itself) together with its expiry.

We also measure aggregate traffic with Umami, a cookie-less analytics tool. It collects anonymous, aggregated statistics only (pages visited and where visitors come from), stores no personal data and cannot identify you, so it requires no consent.

The messages you exchange with the AI tutor are not stored in our database: they are processed on the fly and only live in your browser during the conversation.

The public Hall of Fame pages show information about our collaborators (name, photo, bio, social links and discount code) published with their agreement. To settle their commissions we also record, for each purchase made with a code, the plan, the amount and the invoice identifier.

3. How we use your data

• To provide and maintain the ChineseReads service.
• To manage your account and personalize your experience.
• To analyze anonymous, aggregate usage patterns and improve the application.
• To send you the service emails (the welcome email and the password-reset link you request) and, only with your consent, the daily review reminder.
• To process payments and manage your PREMIUM subscription through Stripe, and to meet the related tax and accounting obligations.
• To enforce each plan's usage limits and prevent abuse and fraud, including measuring the performance of referral campaigns.
• To handle your GDPR rights requests.

We do not sell, rent, or share your personal data with third parties for marketing purposes.

4. Cookies and local storage

We only use essential cookies:

• Essential cookies — necessary for authentication (JWT token stored in HttpOnly cookie). These cannot be disabled as the service cannot function without them.
• Local storage — your browser also keeps a small local copy of your basic session data so pages load instantly and, if you arrived through a referral link, the campaign code for up to 60 days so the collaboration is credited correctly. This data never tracks you across other sites and is removed when you clear your browser data (the referral code also expires on its own).

We do not use advertising, analytics or any other non-essential cookies, so no cookie consent is required. Our traffic statistics come from Umami, a cookie-less tool (see section 5).

5. Third-party services

ChineseReads uses the following third-party services:

• Stripe — to process subscription payments securely. Your card and payment details are handled by Stripe as the payment processor; ChineseReads does not receive or store full card numbers. Privacy policy: stripe.com/privacy
• Umami — for aggregated, cookie-free traffic statistics (pages visited and where visits come from), through its managed Umami Cloud service. It technically processes each request (IP address and browser) only to build anonymous aggregated counts, sets no cookies and cannot identify you to us. Privacy policy: umami.is/privacy
• DeepSeek API — to generate Chinese learning texts and to power the AI tutor (asking about words and context). Only the text you send is processed, no account or personal data. Privacy policy: deepseek.com/privacy
• Google Cloud Vision — to extract text from uploaded images. Images are processed and not stored. Privacy policy: cloud.google.com
• Google Cloud Text-to-Speech — to generate audio pronunciation of Chinese text, words and sentences. Only the Chinese text to be read aloud is sent, no personal data. Audio is generated on demand and not stored. Privacy policy: cloud.google.com
• Brevo — to send your account's service emails (the welcome email and the password-reset link when you request one) and, only if you gave your consent, a daily review reminder that includes how many flashcards are due and your reading streak — at most one per day and only when you have reviews pending. Your email address and name are shared with Brevo solely to deliver these messages. You can withdraw the optional consent at any time from your profile or through the one-click unsubscribe link inside the reminder emails themselves (service emails carry no unsubscribe link because they are needed to run your account). Privacy policy: brevo.com/legal/privacypolicy

6. Legal bases for processing

We only process your data where the GDPR allows it:

• Performance of the contract — your account, the content you create, the service emails and the PREMIUM subscription.
• Consent — the optional daily review reminder by email (withdrawable at any time).
• Legitimate interest — preventing abuse and fraud, enforcing usage limits, aggregated statistics and measuring collaborations.
• Legal obligation — keeping billing records for tax and accounting purposes.

7. International transfers

Some of the providers listed in section 5 process data outside the European Economic Area: Stripe and Google Cloud in the United States (both certified under the EU-U.S. Data Privacy Framework), and DeepSeek in China, which only ever receives the text you type into the AI features — never your name, email or any account identifier. Brevo processes data within the European Union. No provider receives more data than described in section 5.

8. Data retention

Account data is kept while your account is active. You can delete your account yourself at any time from your profile: deletion is immediate, removes your collections, flashcards and created texts, and automatically cancels any active subscription so no further charges occur. You can also ask us to delete it by email. Traffic statistics are anonymous and aggregated and contain no personal data. Payment and subscription records may be kept for longer where necessary to meet tax, accounting and fraud-prevention obligations, even after the account they belong to has been deleted.

9. Your rights (GDPR)

Under the General Data Protection Regulation (GDPR), you have the right to:

• Access your personal data
• Correct inaccurate data
• Request deletion of your data
• Object to processing
• Data portability
• Withdraw consent at any time
• Restrict the processing of your data
• Lodge a complaint with a supervisory authority (in Spain, the AEPD — aepd.es)

To exercise these rights, contact us at: victorgarciallorente20@gmail.com

10. Contact

If you have any questions about this privacy policy, please contact us at: victorgarciallorente20@gmail.com