Privacy Policy

1. Information We Collect

When you use HSK Ace, we may collect the following information:

• Name and email address (when you create an account)
• Google login information (if you sign in with Google)
• Exam results, attempt history, scores, and writing submissions
• Voice recordings (when you use HSKK speaking practice or the speaking level check)
• Prompts and answers you send to AI features (answer explanation, grammar Q&A, AI exercise generation)
• Flashcard decks, cards, review history, and images you upload to your decks
• Referral usage and award/badge progress
• Payment information (processed by LemonSqueezy as Merchant of Record — we do not store card details)

2. How We Use Your Information

We use your information to:

• Provide the HSK practice service (mock exams, scoring, review)
• Schedule spaced-repetition reviews for your wrong answers and flashcards
• Improve product quality and user experience
• Send transactional emails related to your account and exam results
• Provide technical support when you contact us

3. Data Security

We apply the following security measures to protect your data:

• All connections use HTTPS encryption
• Passwords are hashed with bcrypt — never stored in plaintext
• Flashcard decks and uploaded images are private to your account — never shared between users
• We do not sell, share, or grant third-party access to your personal data
• Data access is restricted to authorized staff only

4. Cookies

HSK Ace uses session cookies to maintain your logged-in state. We do not use tracking cookies or advertising cookies.

5. Your Rights

You have the right to:

• View and update your personal information in your account settings
• Export or delete any flashcard deck you created
• Request deletion of your account and all associated data
• Opt out of marketing emails

To exercise any of these rights, please contact us using the email below.

6. Data Storage

Your account data, exam results, and flashcards are stored on cloud infrastructure in Singapore. Uploaded images (e.g. flashcard illustrations) and speaking recordings are kept in private object storage. Data is retained until you request account deletion; upon deletion, your data will be permanently removed within 30 days.

7. Third-Party Services

We share limited data with the following processors solely to deliver the service:

• AI pronunciation scoring service — voice recordings sent only when you use HSKK practice or the speaking level check
• AI language model service — text prompts sent only when you use AI features (explain, grammar Q&A, AI exercise generation)
• LemonSqueezy — Merchant of Record for payments (handles VAT/GST; we do not store card or bank details)
• Email service provider — transactional email delivery
• Google — only if you choose Google Sign-In

None of these processors are granted access to your flashcard content, exam history, or full profile.

8. Anonymous Handwriting Practice

When you practice handwriting without an account, we store a hashed fingerprint (an irreversible SHA-256 hash of your IP address, browser user-agent, and accept-language header) for up to 7 days. This prevents abuse of the free anonymous quota across incognito sessions. We do not store the raw IP, raw user-agent, or any other browsing metadata. Once you sign up, this anonymous fingerprint record is no longer linked to you and is purged at the next cleanup cycle.

9. GDPR / International Users

If you are located in the European Economic Area (EEA) or elsewhere outside Vietnam, your data is transferred to and processed in Singapore. By using HSK Ace, you consent to this transfer. You may request data deletion or portability at any time by contacting us.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we make significant changes, we will notify you by email at your registered address.

11. Contact

If you have questions about this Privacy Policy, please contact:

Email: [email protected]