Privacy Policy

Who is responsible

Gao Laoban (高老板) is operated by Daan de Groot, a sole trader (eenmanszaak) established in the Netherlands. For the purposes of the General Data Protection Regulation (GDPR) this is the data controller.

You can reach the controller at daandegroot44@gmail.com.

What we collect

We collect only what the service needs in order to work.

Account data

• Your email address and display name.
• A salted hash of your password — never the password itself — if you register with email and password.
• If you sign in with Google: your Google account identifier, email address, name and profile picture URL, as supplied by Google.

Learning data

• Flashcards you create or import, and their translations and example sentences.
• Your study history: review scores, scheduling intervals, streaks and per-item progress for vocabulary, grammar and lessons.
• Conversations you have with the AI practice partner, including your messages, the model's replies, and the corrections generated for them.
• Text you submit for translation, pronunciation or writing practice.

Billing data

• Your subscription tier, status and renewal date, and the customer identifier issued by Stripe.
• We never see or store your card details. Those go directly to Stripe.

Usage data

• Counters used to enforce free-plan limits: messages sent per day, speech requests per day, and the date they were last reset.
• Your activity streak and the time you were last active.

Analytics data — only if you agree

If you accept analytics, we record how the app is used so we can see which parts work and which do not. This covers:

• Pages viewed, features used and buttons pressed, with the technical details a browser sends anyway: device type, browser, operating system, screen size, referring page and approximate location derived from your IP address.
• Events describing what happened rather than what you wrote — a study session finished with 20 cards reviewed, a chat message of 34 characters was sent, a translation was requested from English to Mandarin.
• A recording of your session: the pages, clicks and scrolling, with all text and every form field masked out. We deliberately cannot read your flashcards, your messages or anything you type from these recordings.
• Errors the app hit in your browser, with the technical stack trace.
• Once you are signed in, these are linked to your account, along with your email address, name, subscription tier and interface language.

We never send the content of your learning to our analytics provider. Not your flashcard terms, not your chat messages, not translations, not what the AI replied. Search terms and filters are stripped out of the page addresses that are recorded.

Cookies

We do not use advertising cookies and we never will. We set:

• A session cookie, which keeps you signed in. It is encrypted, HTTP-only, and expires after 30 days. This cookie is strictly necessary and cannot be declined while you are signed in.
• i18n_redirected, which remembers the interface language you chose so you are not redirected away from it on your next visit. It stores a language code and nothing else.
• gl_analytics_consent, which records whether you accepted or declined analytics. It exists so we do not ask you again, and it is set whichever way you answer.
• Analytics cookies, set by PostHog, which identify your browser across visits so that a returning visitor is not counted as a new one. These are set only after you accept, and the analytics code is not even loaded until then.

You can change your mind at any time, and it takes effect immediately — declining stops the collection and deletes the analytics cookies from your browser.

Who we share it with

We do not sell your data and we do not share it for advertising. We use the following processors to run the service:

• Cloudflare, Inc. — hosting, the database that stores your account and learning data, storage for generated audio, bot protection on the sign-in form (Turnstile), and the AI models that power chat, translation and exercise generation. Text you send to those features is processed on Cloudflare's network.
• Stripe, Inc. — payment processing and subscription management, if you subscribe to a paid plan.
• Google LLC — sign-in, only if you choose to sign in with Google.
• Microsoft Corporation — Azure Speech, which converts text to spoken audio and transcribes pronunciation practice. Audio and the text being spoken are sent to Microsoft for that purpose.
• PostHog, Inc. — product analytics, only if you accept them. We use PostHog's European hosting, so this data is stored in Frankfurt, Germany and does not leave the EU.

Some of these providers operate outside the European Economic Area. Transfers rely on the European Commission's Standard Contractual Clauses or an adequacy decision, as set out in each provider's data processing agreement.

Connected applications

You can authorise third-party applications to access your flashcards and study statistics on your behalf. When you do, we record which application you authorised, which permissions you granted, and when. We store only hashes of the resulting access tokens. You can review and revoke these authorisations at any time from your account settings.

How long we keep it

• Account and learning data: for as long as your account exists.
• Billing records: for seven years after the transaction, as required by Dutch tax law.
• Authorisation codes and expired access tokens: deleted automatically within days of expiry.
• Analytics events: kept by PostHog for up to 12 months. Session recordings are deleted after 30 days.

Your rights

Under the GDPR you have the right to access your data, correct it, delete it, restrict or object to its processing, and receive a portable copy.

To exercise any of these rights — including deleting your account and everything in it — email daandegroot44@gmail.com. We will respond within one month.

Deleting your account removes your data from our database, but analytics data already collected sits with PostHog and is not reached by that deletion. Ask us and we will delete it there too.

If you believe we have handled your data improperly, you can lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Children

The service is not directed at children under 16. If you believe a child has given us personal data, contact us and we will delete it.

Changes

If we change this policy substantively we will update the date at the top of this page and, where the change affects you materially, notify you by email.