Privacy Policy

In short

• XueTang is made by Pocket Apps Studio Pte. Ltd., a company registered in Singapore. Singapore’s Personal Data Protection Act 2012 (“PDPA”) is the main law that applies to us. If you live in the European Union, the European Economic Area or the United Kingdom, the GDPR applies as well (see “If you live in the EU, EEA or UK”).
• You can try the app and finish your first lesson without an account. To continue, you sign in with Apple or Google. Your account holds your e-mail address, the name you choose and your learning progress.
• Your pronunciation recordings never leave your iPhone. Translations of words you add are made on your iPhone.
• We use usage analytics to improve the app. Once you sign in, it is linked to your account ID. It is on by default and you can switch it off at any time in Settings → Privacy → Usage analytics.
• We do not show ads, do not sell your data, do not use the advertising identifier (IDFA) and do not track you across other apps or websites.
• You can delete your account and its data in the app at any time.

Who we are

XueTang is operated by Pocket Apps Studio Pte. Ltd. (UEN 202549990M), 160 Robinson Road, #14-04 Singapore Business Federation Center, Singapore 068914 (“we”, “us”). We decide how and why your personal data is used in the app.

Data Protection Officer. As required by the PDPA, we have appointed a Data Protection Officer (DPO). For any question, request or complaint about your personal data, write to dpo@pocketapps.studio, or by post to: Data Protection Officer, Pocket Apps Studio Pte. Ltd., 160 Robinson Road, #14-04 Singapore Business Federation Center, Singapore 068914.

For general support, write to support@pocketapps.studio.

“Personal data” means data about you from which you can be identified, on its own or together with other information we have or are likely to have.

What we collect and why

Using the app without an account

When you first open the app, it creates an anonymous guest account with Firebase (Google) so that it can work. Up to the end of your first lesson, your progress stays on your iPhone and nothing about you is stored on our servers.

Your account

To continue after the first lesson, you sign in with Apple or Google. This creates your account. We store:

• Your e-mail address, as shared by Apple or Google. If you use Apple’s “Hide My Email”, we receive a private relay address instead of your real one.
• Your name, if you enter one in the app’s account settings. When you sign in with Apple for the first time, Apple may also share the name on your Apple Account with our sign-in provider.
• An account ID, a random identifier that Firebase assigns to your account.
• Your acceptance of the Terms of Use: which version you accepted and when, so that we can show which terms apply to your account.

Why: to give you an account, keep your progress safe and let you use it on more than one device.

Your learning data

Once you are signed in, the app saves the following to your account:

• the lessons you have completed and when,
• your review schedule for each word and grammar point (when each item is next due and how well you know it),
• the words you add yourself (Chinese characters, pinyin, meaning and an example sentence, if you enter them),
• the date you were last active.

Why: so that the spaced-repetition schedule works, your progress is not lost and it stays the same across your devices.

Your app settings, study reminders and onboarding answers stay on your iPhone and are not uploaded.

Microphone and pronunciation exercises

Some exercises ask you to say a word aloud so that the app can score your tones. The app only uses the microphone after you allow it and only while you are recording an answer. The recording is analysed on your iPhone by a tone-recognition model built into the app. It is not stored and is never sent to us or to anyone else. If you do not allow microphone access, the app gives you exercises that do not need it.

Translations of words you add

When you add your own word, the app can suggest a translation using Apple’s Translation framework, which translates on your iPhone.

Notifications

Study reminders. If you turn on reminders, the app schedules them as notifications on your iPhone. We do not receive any data about them.

Push notifications. If you allow notifications, we may also send you occasional messages ourselves, for example about new lessons. We use OneSignal to deliver them. Before you allow notifications, the app sends OneSignal nothing. Once you allow them, OneSignal receives your iPhone’s push token (an address Apple creates so messages can reach this app on this device), an ID OneSignal assigns to it, basic device details (iPhone model, iOS and app version, language and time zone), your IP address, and when you last opened the app. Once you sign in, the app also gives OneSignal your account ID, so a message reaches you on each of your devices. You can stop push notifications at any time in your iPhone’s Settings → Notifications → XueTang.

Why: to send you the notifications you agreed to receive.

Purchases

XueTang is free to download. Premium is a subscription bought through the Apple App Store. Apple handles the payment. We never see your card or payment details.

We use RevenueCat to check which subscription you have. RevenueCat receives your subscription status, Apple’s purchase records for it (such as product, price, dates and renewal status), an app user ID and basic device details. Before you sign in, that app user ID is random. Once you sign in, the app uses your account ID as your RevenueCat app user ID so that your subscription follows you to your other devices.

Why: to unlock Premium for you and to keep records that the law requires.

Usage analytics

To understand how the app is used and what to improve, the app sends usage events to PostHog while the “Usage analytics” setting is on. The setting is on by default. You can switch it off at any time in Settings → Privacy → Usage analytics. While it is off, the app does not contact PostHog for analytics and creates no analytics identifier.

While it is on, the app sends:

• app events: installed, updated, opened and moved to the background,
• in-app events: which onboarding screen you viewed and the learning goals you picked, finishing sign-in (and whether with Apple or Google), starting, finishing or leaving a lesson (with its length and number of mistakes), finishing a unit, a chapter or a review session, whether you allowed or declined the microphone and notifications, opening a notification, seeing or closing the subscription screen, starting a trial, buying or restoring a subscription, signing out, deleting your account, and when the app asks whether you would like to rate it (not your answer),
• a few settings sent with every event: your subscription status (free, trial, paid or expired) and the language you see translations in,
• technical details: app version and build, device model and type, operating system and version, language and region settings, time zone, screen size and whether you are on Wi-Fi or mobile data.

Before you sign in, the events are tied to a random identifier created on your iPhone. Once you sign in, the app links them to your account ID, including the events from before you signed in, so that we can see how learning develops over time and on each of your devices. RevenueCat also sends PostHog your subscription events under your account ID (for example a trial started, a renewal or a cancellation), so that we can see which parts of the app lead people to subscribe. We do not send PostHog your e-mail address or your name. When you sign out, the app starts a new random identifier. When you delete your account, we delete the analytics linked to it (see “Deleting your account”). We do not record your screen or your sessions. PostHog receives your IP address with each request because that is how the internet works, and we do not use it to locate or identify you.

Why: to find out which parts of the app work and which do not, so that we can improve them.

In-app feedback

If you send feedback through the in-app form, we receive:

• your message and the category you chose,
• the name you enter (optional; the form fills in the name saved in the app and you can clear it),
• your e-mail address, only if you switch on “You may contact me” (off by default). If you are signed in, this is the address on your account; otherwise it is the address you type in,
• the app version and build, your device model, and the date and time,
• a random identifier for your app installation, so that several messages from the same installation can be read together,
• your RevenueCat app user ID, so that a billing question can be matched to your purchase (when you are signed in, this is your account ID).

Feedback is delivered through PostHog, also when “Usage analytics” is off, because you choose to send it. PostHog receives your IP address with the request.

Why: to read and act on your feedback. If you switched on “You may contact me”, we may also reply to you by e-mail about your feedback or ask you follow-up questions about it.

E-mails we send you

• Welcome e-mail. After you create your account, we send you one short e-mail welcoming you to XueTang and asking what you wish a Chinese learning app did for you. You can simply reply if you want to. Your answer helps us shape the app.
• Replies to your feedback, if you switched on “You may contact me” or wrote to us directly.
• Product feedback and research. From time to time we may e-mail you to ask how XueTang is working for you and how we could improve it.
• Service messages we have to send, for example about a change to these terms or a security issue affecting your account.

These e-mails do not advertise or sell anything. You can tell us to stop at any time by replying “stop” to any of them or by writing to the DPO. You will still receive service messages we are required to send.

Why: to welcome you, to answer you and to learn how to make the app better.

E-mails you send us

If you write to us, we receive your e-mail address, your name if it is in your message, and whatever you choose to tell us. We use it to answer you.

Technical data

Every time the app talks to one of the services below, that service receives the technical data needed to answer the request: your IP address, the time of the request and basic device details such as device model, operating system version and app version. This happens with Firebase and RevenueCat each time you open the app, with PostHog as described above, and with Google or Apple when you sign in. The app does not include a crash-reporting service.

Our legal basis under the PDPA

We collect, use and disclose your personal data:

• with your consent, for example when you create an account, allow the microphone or notifications, or send us feedback with your e-mail address,
• because it is needed to provide the service you asked for, such as your account, your progress and your subscription (deemed consent under section 15 of the PDPA),
• under the legitimate interests exception in the First Schedule to the PDPA, for usage analytics, the welcome and product-feedback e-mails, and keeping the app secure. We have assessed that these benefits outweigh any adverse effect on you, mainly because the analytics are used only to improve the app, never for advertising, are easy to switch off and are deleted with your account, and the e-mails are rare, non-commercial and easy to stop. You can ask the DPO for more information about this assessment,
• under the business improvement exception in the PDPA, when we use data we already hold to improve the app,
• where the law requires it, for example tax and accounting records.

You can withdraw your consent at any time by writing to the DPO. We will tell you what withdrawing means for your use of the app, for example that we cannot keep an account without an e-mail address.

Who we share data with

We only share your data with the service providers we need to run the app. Each of them processes it on our behalf and under a contract with us.

When you pay through the App Store, Apple and its payment partners process your payment under their own terms. They are not our service providers. See Apple’s privacy policy.

We do not sell your personal data, rent it out or share it for advertising. We only disclose it to anyone else if you ask us to or if the law requires it, for example to the police in an investigation or to enforce our legal rights.

Transfers outside Singapore. Several of these providers store data outside Singapore, mostly in the United States. As section 26 of the PDPA requires, we only transfer your data to providers bound by contracts that protect it to a standard comparable to the PDPA. We use each provider’s published data processing agreement for this. For users in the EU, EEA or UK, these agreements include the European Commission’s Standard Contractual Clauses (and the UK addendum).

How long we keep your data

• Account and learning data: until you delete your account.
• Feedback and e-mails: until your matter is dealt with, then deleted within 12 months unless you ask us to keep it or the law requires it. You can ask us to delete it earlier.
• Your request to stop e-mails: for as long as we send e-mails, so that we can keep honouring it, also after you delete your account. We keep only a one-way hash of your e-mail address, not the address itself.
• Usage analytics: up to 12 months, then deleted. Analytics linked to your account are deleted earlier if you delete your account.
• Push notification data: until you delete your account. If you use the app without an account, until you ask the DPO to delete it.
• Purchase records: for as long as the law requires, usually 5 years after the end of the relevant financial year (Singapore Income Tax Act 1947 and Companies Act 1967).
• Technical logs held by our providers: for the short period each provider needs to run and secure its service.

When we no longer need data, we delete it or make it anonymous.

Deleting your account

You can delete your account at any time in the app (Settings → Profile → Delete Account). This deletes your account and all learning data stored under it from Firebase, deletes your push notification data at OneSignal, deletes the usage analytics linked to your account at PostHog, and resets the app on your iPhone.

Deleting your account does not delete:

• purchase records held by RevenueCat and Apple, which we must keep as described above,
• feedback you sent, which is kept as described above.

You can ask the DPO to delete these too, and we will do so unless the law requires us to keep them.

Deleting the app from your iPhone removes the data stored on it but does not delete your account. Deleting your account does not cancel a subscription. Cancel it in your Apple Account settings.

How we protect your data

All data the app sends is encrypted in transit (TLS). In Firebase, your account data can only be read and changed by your own signed-in account. Only a small number of authorised people at Pocket Apps Studio can access personal data, and only to run and support the app. No system is perfectly secure, but if a data breach happens that must be reported, we will notify the Personal Data Protection Commission and, where required, you, as the PDPA requires.

Children

XueTang is not meant for children under 13, and we do not knowingly collect personal data from them. Teenagers between 13 and the age of majority where they live should use the app with a parent’s or guardian’s permission. If you believe a child under 13 has given us personal data, please write to the DPO and we will delete it.

Your rights

Under the PDPA you can:

• ask for access to the personal data we hold about you and how it has been used or disclosed in the past year,
• ask us to correct data that is wrong or incomplete,
• withdraw your consent at any time,
• delete your account in the app, or ask the DPO to delete your data.

Write to the DPO at dpo@pocketapps.studio. We will reply as soon as we can and within 30 days. If we need longer, we will tell you when to expect an answer. We may need to confirm your identity first. Access requests are free in normal cases; if a request would cost us significant effort, we will tell you the fee before we do anything.

If you are not happy with our answer, you can complain to the Personal Data Protection Commission of Singapore at www.pdpc.gov.sg.

If you live in the EU, EEA or UK

The EU General Data Protection Regulation and the UK GDPR also apply to you. Pocket Apps Studio Pte. Ltd. is the controller.

Legal bases.

• Account, learning data and subscription: necessary to provide the app to you (Art. 6(1)(b) GDPR).
• Signing in with Apple or Google, allowing the microphone or notifications, and including your e-mail in feedback: your consent (Art. 6(1)(a) GDPR).
• Usage analytics, technical data, security, the welcome e-mail and product-feedback e-mails: our legitimate interest in running, securing and improving the app (Art. 6(1)(f) GDPR). You can object at any time: switch off “Usage analytics”, or reply “stop” to an e-mail.
• Purchase records: legal obligations (Art. 6(1)(c) GDPR).

Your additional rights. You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object (Art. 21). You can withdraw consent at any time without affecting what was done before (Art. 7(3)). We do not make decisions about you based solely on automated processing (Art. 22).

Complaints. You can complain to the data protection authority where you live or work, for example the UK Information Commissioner’s Office or your national authority in the EU.

Changes to this policy

When we change this policy, we update the date below. If a change significantly affects how we use your data, we will tell you in the app or by e-mail before it takes effect. The current version is always available in the app and at https://xuetang.app/privacy.

Last updated: 19 October 2026