Privacy Policy

Effective 18 October 2026

How Super HSK and Měi Lǎoshī, your AI Chinese teacher, use your data. The short version first.

The short version

We use your data to teach you Chinese and to run the app. We never sell it, and we don't show ads.
Měi Lǎoshī is an AI. When she hears you, checks your writing, answers you or paints a photo, what you sent goes to AI companies we name below. That's on from the start, and you can turn it off in Settings › Privacy › AI features.
Your posts can be seen by other learners. You choose who in Settings › Privacy.
Your answers, voice recordings, the strokes you write on the screen pad, your chats with Měi Lǎoshī and their grading records are kept for up to 400 days, and deleted with your account.
Photos that nothing shows any more are deleted after 30 days.
You can download your data and delete your account at any time, in the app or at superhsk.app/delete-account.
Questions: support@hskfish.com.

Who we are

Super HSK ("Super HSK", "we", "us") makes the Super HSK app for iPhone, iPad and Android and this website, superhsk.app. This policy covers both. We decide how your data is used, so we are responsible for it (the "controller").

What we collect

Only what the app needs to teach you, plus what you choose to make and share.

Your account

When you sign in with Apple or Google: your name, your email address and an account ID from Apple or Google. If you use Apple's Hide My Email, we get Apple's relay address instead.

If you signed in with your email address (a one-time code we email you), we keep that address.

If you tap Continue as guest, we make an account with no name, no email address and no Apple or Google ID on it. Your phone keeps that account's sign-in key in its secure storage, so you can come back to it as a guest on the same phone. If you later save it with Apple or Google, we add those details to the same account.

Your profile

Your name, Chinese name, profile picture, a short bio if you write one, time zone, app language and notification settings. If you once told the app your age group (13 to 17, or 18 and over), we keep that too.

Your goals and plan

Why you're learning, your level and target level, your exam date and test centre, and what you tell us about your goal, such as a university, a city or a job. We build your study plan from these.

Your study

Your lessons and answers, flashcards and reviews, mock exams and their results, handwriting checks, the words you add yourself, your class and self-study logs and your study timer. The strokes you write on the screen pad can be saved with the lesson.

Your voice

Recordings of you speaking: in lessons, reviews and the mock's speaking part, when you ask Měi Lǎoshī a question out loud, when you tell her about yourself for your Chinese name, and the sound of a video you post if you let her suggest its words. We use them to hear what you said and check your tones. See Měi Lǎoshī and AI and How long we keep it.

Photos of your pages

When you write on paper and snap it, or snap your class notes or a word you spotted. Měi Lǎoshī reads them to check your handwriting or find the words. Sometimes the phone reads the words itself and sends us only those words. We remove the photo's location and camera details before we store it. If you say Not now to AI, a notes photo is still saved with your log, but no AI reads it.

Study photos and selfies

Photos you take for a post, and a photo you give the profile-picture studio. If you choose an AI look, the photo is sent to an AI image model to paint it. For a profile picture, and for a photo you paint, we keep only the painting. A photo you post as it is stays with the post.

Posts, comments, likes and videos

What you post on Home (a lesson, a photo, a video, a certificate), its caption, and your comments, likes and questions to Měi Lǎoshī under posts.

Friends and invites

Your invite code and links, who joined with your link and whose link you joined with, the people you hide or block, and reports you send us about a post or a person. We don't read your phone's contacts.

Location (only if you allow it)

If you tap "Use my location" and allow it, the app uses your approximate location when you look for test centres near you. It's rounded to about a kilometre before it leaves the phone, used only to sort the centres by distance, and not saved. The test centre you pick is saved with your goals.

Motion (iPhone, only if you allow it)

To spot your usual ride to school or work and offer a short review on the way, the app looks at when your phone was in a vehicle over the last 7 days. That stays on your phone. We only learn that a pattern was found (how many rides, on which days).

Device and notifications

Your device type, system version, app version and time zone; a random ID for this install of the app (not a hardware ID); a push token if you turn notifications on, so we can send your reminders; and on Android, the link or campaign that brought you to the Play Store, if any.

Purchases

Whether you have Pro, your plan or pass, trial dates and transaction IDs. Apple or Google takes the payment; we never see your card.

Usage and session replays

Which screens you open, what you tap and how long things take, with your account ID and a few facts about your study (your goal, levels, exam date, daily minutes and how you found the app), so we can see what works and fix what doesn't. It doesn't include your name or anyone else's (names are stripped from taps), your email address, what you write or say, or your photos.

For accounts marked 18 and over, it can include a recording of the screens you saw ("session replay"), with everything you type and every image (your photos, pages and videos) blacked out, and the photo picker hidden.

The switch is Settings › Privacy › Help improve Super HSK ("Screens, taps and crashes, and a screen recording if you're 18+"). In the EU, the EEA, the UK and Switzerland, or on a phone set to a European time zone, it starts off and nothing is sent until you turn it on. Elsewhere it starts on, and you can turn it off.

Crash reports

When the app crashes or hits an error, a report of the error and the device it happened on. These go with the usage data above and follow the same switch.

Messages to us

What you write to William ("Talk to William"), feedback forms and problem reports (with a screenshot if you add one), survey answers, and emails you send us. If you message William on WhatsApp, WhatsApp's own terms apply to that chat.

On this website

superhsk.app uses no cookies and no analytics. It remembers your language choice in your browser. When you tap a store button, our server counts the tap (your device type, the button and the page that sent you). The plan card's "nearest test centres" uses your approximate city from your internet address, worked out by our web host, and doesn't save it.

When you plan with Měi Lǎoshī on the website and choose a pick or tap a download button, we save her questions' answers and the plan she made (no name, no email, no phone number) so the app can offer to continue it on your phone. It's linked only to a scrambled (hashed) form of your internet address, never the address itself, and the type of phone you're on.

Why we use it

Here is what we use your data for, and the legal reason that lets us (laws like the GDPR and Indonesia's Personal Data Protection Law ask us to say this).

To run the app you asked for

Your account, your plan, lessons, flashcards, reviews and mocks, your progress on every phone, posts, friends, reminders and Pro. Reason: to provide the service you signed up for (our contract with you).

To let Měi Lǎoshī hear, read and paint

Sending your voice, photos and typed answers to the AI companies in Měi Lǎoshī and AI. Reason: to provide the service you signed up for (our contract with you): Měi Lǎoshī is an AI teacher, so AI checking your Chinese is how the app teaches. You can turn it off.

To find test centres near you

Reason: your consent (the phone's location prompt).

To grade you fairly and make Měi Lǎoshī smarter

We keep your answers, your voice recordings, the strokes you write on the screen pad and your chats with Měi Lǎoshī (what you asked and what she replied), linked to your account, so we can check that a right answer is never marked wrong and a wrong one never marked right, and improve her grading. Only our team can see them. For how long, see How long we keep it. Reason: our legitimate interest in grading correctly. You can turn AI features off in Settings › Privacy, and nothing new is kept.

To improve the app and fix bugs

Usage data, session replays and crash reports. Reason: our legitimate interest in a working, better app; you can switch it off. In the EU, the EEA, the UK and Switzerland (or on a European time zone): your consent.

To keep the community safe

Reviewing reports, blocks and hides, and safety checks on what's posted. Reason: our legitimate interest in keeping learners safe.

To talk with you

Answering your messages and emails, sign-in codes, and emails you ask for, such as your data export or a trial reminder. Reason: our contract with you, and our legitimate interest in replying.

To follow the law

Keeping purchase records and answering lawful requests. Reason: legal obligations.

We don't sell your data, we don't use it for advertising, and we don't let anyone else use it for their own purposes. Měi Lǎoshī's grades and plans help you learn; they don't make decisions about you with legal or similar effects.

Měi Lǎoshī and AI

Měi Lǎoshī is an AI teacher, not a person. What she says is written by AI and can be wrong.

On from the start, off whenever you like

AI features are on when you start: when Měi Lǎoshī hears you, reads a photo or your typed answers, or answers a question you type, that goes to the companies below.

Don't want that? Turn off Settings › Privacy › AI features. The app stops sending your voice, photos and typed answers to AI. If you then use a feature that needs it, the app shows a sheet such as "Before Měi Lǎoshī hears you" that names the companies and offers Allow and Not now, and nothing of that kind goes to an AI until you tap Allow. Your choice is saved on your phone.

Two things can still go to AI even with AI features off, because our server doesn't check your answer for them: the words you add yourself (to fill in their pinyin and meaning) and Měi Lǎoshī's replies under your lesson posts. Also, questions other learners ask her under a post, and her answers, are first run through a safety check, and a video's caption and cover picture may be safety-checked before it goes up.

Who gets what

We send each company only what the task needs: the recording, photo or text, with the lesson's words or the question as a hint. We don't send your email address or your Apple or Google account ID.

Voice

Alibaba Cloud, SpeechSuper, iFlytek, OpenAI, Google

Alibaba Cloud (Qwen speech recognition) writes down what you said. SpeechSuper scores your pronunciation and tones and is the second speech engine. iFlytek is a last backup for both.

When you hold the button and ask Měi Lǎoshī, your recording goes to OpenAI's audio model, or to Google's Gemini if OpenAI doesn't answer. For your Chinese name, OpenAI may also write down what you told her.

The words you said may then go, as text, to a text model (below) to mark a long answer or answer your question.

Text

DeepSeek, OpenAI, Google

Gemini is Google's. They mark your answers and mocks, answer your questions, write Měi Lǎoshī's replies under your lesson posts, fill in the pinyin and meaning of words you add (with your goal, for an example sentence), and suggest your Chinese name from your name and what you tell her about yourself. OpenAI's safety check reads questions under posts and Měi Lǎoshī's answers to them.

Photos

Google, OpenAI, SoCheap

Google's Gemini, or OpenAI if Gemini doesn't answer, reads your handwriting, your class notes or a word you spotted, with the words you were meant to write.

A selfie for your profile picture, or a study photo you paint with an AI look, goes to OpenAI's image model through SoCheap, a service that passes it on. SoCheap holds the photo at an unlisted web address while it's painted, and we delete it there as soon as the painting is done.

Měi Lǎoshī's own voice: Google Cloud Text-to-Speech (and OpenAI as a backup) turns her words into speech. It gets only the text she says, which can repeat your question or your name.

Do they keep it, or train on it?

We use these companies through their paid services for developers, not their consumer apps. What happens next is set by each company's own terms, which we summarise here as they publish them:

OpenAI says it doesn't use data sent to its API to train its models unless we opt in (we haven't). It may keep requests for up to 30 days to check for abuse.
Google says that on its paid Gemini and Google Cloud services it doesn't use your prompts or files to improve its products. It keeps them for a limited time to detect abuse.
Alibaba Cloud says it doesn't use customer data to train its models without consent.
SpeechSuper says it discards the audio once it has scored it.
iFlytek says it processes voice in real time and doesn't keep it longer than a week.
DeepSeek's terms for its API don't say whether it keeps or trains on what it receives. It is based in China. It gets text only, never your voice or photos.
SoCheap doesn't publish terms on this. It only passes your photo to the image model; we delete the copy it holds as soon as the painting is back.

We keep our own copies as described in How long we keep it.

Besides the AI companies above, these companies run parts of Super HSK for us. Each gets only what its job needs.

Hosting

Render runs our server. Vercel hosts this website.

Database

MongoDB stores your account, plan, study history and posts.

File storage

Google Cloud Storage stores photos, videos, voice recordings and Měi Lǎoshī's audio.

Email

Resend sends the emails we send you, such as sign-in codes, a trial reminder and your data export. Copies of feedback and reports reach our team's inbox.

Analytics

PostHog (in the United States) receives usage data, session replays and crash reports from the app.

Payments

Apple and Google take payments. RevenueCat keeps track of your subscription or pass, using your Super HSK account ID.

Sign-in

Apple and Google confirm who you are when you sign in with them.

Notifications

Expo's push service passes your reminders, with your push token, to Apple and Google, who deliver them. A reminder can mention your name or a friend's.

Maps and stroke order

Test-centre photos come from Google Maps, and the app may load them from Google. If the app needs a character's stroke order it doesn't have, it downloads it from jsDelivr. Both see your internet address, not your account.

We may also share data if the law requires it, to protect the safety and rights of our learners, the public or Super HSK, or as part of a sale or merger of Super HSK, in which case this policy keeps applying to your data. We never sell it.

What other learners see

Your profile: your name, profile picture, Chinese name and bio, your exam date, how many words you know and your number of posts. Learners can find you by searching your name. Your profile picture can be opened by anyone who has its link.
Your posts: everyone by default, or only friends. A finished lesson posts to Home by itself (you can undo or unshare it), and study sessions and classes are shared unless you turn that off. A lesson post can show a recording of your voice, the characters you wrote and close-ups of the words you wrote on paper. Others can like it, comment, and ask Měi Lǎoshī questions under it.
"Studying now": friends by default, or nobody.
Your HSK map: other learners can compare theirs with yours, unless you choose nobody.
Your invite link: anyone who opens it sees your first name and initial, your HSK level and your exam date.

Friends are people who joined with your link. Change these in Settings › Privacy. You can also hide or block someone, and report a post or a person.

How long we keep it

Your account, plan, study history and posts: until you delete your account. A post or comment you delete disappears for everyone at once (you can restore a post), and is erased from our database with your account.
Photos: a photo that isn't part of a post, log or report is deleted after 30 days. Photos in a post you deleted stay with that post until you delete your account.
Videos: deleted within a day of deleting their post; uploads you never post are cleaned up too.
Voice recordings: recordings of your spoken answers, of questions you ask Měi Lǎoshī out loud and of a video's sound when she suggests its words are kept in private storage so we can check her grading. Kept for up to 400 days, then deleted. Deleted with your account. Recordings sent only to score your tones, or for your Chinese name, aren't kept.
Grading records: your answers, what Měi Lǎoshī heard and what she replied, the strokes you write on the screen pad and your chats with Měi Lǎoshī are kept to check her grading. This includes the log of how each answer was marked. Kept for up to 400 days, then deleted. Deleted with your account.
Plans made with Měi Lǎoshī on the website: 14 days, so the app can continue them, linked only to a hashed form of your internet address. Then deleted.
Short-lived data: "studying now" for 3 minutes, sign-in codes for about an hour, usage counters for 40 days, notifications for 90 days.
Messages and feedback: until we no longer need them to help you, or you ask us to delete them. Deleted with your account.
Analytics: kept by PostHog for the period our plan with them sets.
Backups: copies can stay in our providers' backups for a short time until they're overwritten.

Deleting your account

In the app: Profile › Settings › tap your name › Delete account. Without the app: superhsk.app/delete-account.

Deleting your account removes it at once, with your profile, plan, study history, mocks, your own words, handwriting checks, grading records (your answers, how each was marked, your chats with Měi Lǎoshī and every recording of your voice), photos, videos, posts, comments and likes, friends, invites, blocks, messages to William, feedback forms and survey answers, and reports about you or your posts.

Purchase records stay with Apple, Google and RevenueCat, and usage data with PostHog under their own rules.

Deleting doesn't cancel Pro. Cancel it first in your App Store or Google Play subscriptions. (A one-time pass in Indonesia doesn't renew.)

Your data: Settings › Privacy › Download my data gives you a copy of your account, plan, study history, posts, graded answers, your questions to Měi Lǎoshī with her answers, and more. Write to us for anything it leaves out.

Your rights

Wherever you live, you can ask us to:

tell you what we hold about you and give you a copy;
correct it;
delete it;
stop or limit using it, or object to how we use it;
give it to you, or to another service, in a common format;
withdraw a consent you gave (this doesn't undo what was done before).

If you're in Indonesia, these are your rights as a data subject under Law No. 27 of 2022 on Personal Data Protection (UU PDP). If you're in the EU, the EEA or the UK, they're your rights under the GDPR. You can also complain to your data protection authority.

Most of this you can do yourself in the app (edit your profile, Settings › Privacy, Download my data, Delete account). For the rest, write to support@hskfish.com. We may ask you to confirm the account is yours, and we'll answer within the time your law sets.

Children

Super HSK is for ages 13 and up. We don't knowingly collect data from children under 13. If you think a child under 13 is using Super HSK, write to us and we'll delete the account. If you're under the age at which your country lets you agree to this yourself (in Indonesia, under 18), please use Super HSK with your parent's or guardian's permission. Session replays are recorded only for accounts marked 18 and over.

Security

Data travels between the app and our servers encrypted (HTTPS). Photos, videos and recordings are kept in private storage, and only signed-in learners who may see a post can load its photos, video and voice (your profile picture is the exception: it's public). Sign-in codes are stored only as a scrambled hash. No system is perfectly secure, but we work to protect your data and will tell you if a breach puts it at risk, as the law requires.

Data in other countries

Your data is handled outside the country you live in. Many of the companies above, such as OpenAI, PostHog and RevenueCat, are in the United States, and some AI companies process data elsewhere: DeepSeek in China, Alibaba Cloud in China or Singapore, and iFlytek in Singapore. These countries may have different data protection laws from yours. Where the law requires it, we rely on the safeguards our providers offer, such as standard contractual clauses, or on your consent.

Changes

When we change this policy, we'll update the date at the top. If a change matters, for example a new kind of data going to AI, we'll tell you in the app before it applies, and ask again where your consent is needed.

Contact us

Questions, requests or complaints about your data: support@hskfish.com. You can also reach William, who built Super HSK, in the app: Settings › Talk to William.