Kylin

Privacy Policy

Last updated: August 9, 2026

1. General Information

Kylin ("the App") is a mobile application that teaches Mandarin Chinese, following the HSK 3.0 syllabus published by the Chinese Language Education and Cooperation Centre. It is developed and published by IOCODO LLC ("we", "our", "us").

This Privacy Policy explains what information the App handles, how it is used, and the choices available to you. Kylin is designed to be usable offline and does not ask you for a name, an email address or any other personal detail in order to learn.

2. Data Stored on Your Device

The App stores your learning data locally, in a database on your device. This is the primary copy and is what makes the App work offline. It includes:

• Your learning progress and spaced-repetition review schedule, meaning which words, characters, tones and grammar points you have studied and when each is due to come back
• Your answer history, which is what the recall forecast on the home screen is computed from
• In-app preferences and settings, including your learner language, sound, haptics, reminder time and whether pinyin is shown
• Practice reminders you choose to schedule, which the operating system holds on the device itself

All learning content (words, characters, stroke data, grammar, reader articles and audio) is bundled inside the App at install time. The App does not download lesson content while you use it.

On-device data is removed when you uninstall the App, subject to any device backup behaviour controlled by Apple or Google.

3. Account and Authentication

Kylin does not require you to create an account or sign in to learn. On first launch the App signs you in anonymously using Firebase Authentication (Google LLC), which generates a random identifier tied to your installation. That identifier carries no name, email address, password or phone number, and we cannot identify you personally from it.

From Settings you can optionally link that guest session to an Apple or Google account, so your progress follows you to a new device. Linking is never required and no lesson is locked behind it. If you choose to link:

• We receive your email address and, when the provider supplies it, your display name. Firebase Authentication stores them against your account.
• We never receive your password. You authenticate with Apple or Google, not with us.
• Sign in with Apple lets you hide your real address. If you do, we only ever see Apple's private relay address.
• Your email address and name are used to identify your account and restore your progress. They are not used for marketing, are not shared with anyone else, and are deleted with everything else when you delete your account (see Section 12).

4. Data Stored in Firebase Backend Services

Kylin uses a small set of Firebase services operated by Google LLC:

• Firebase Authentication: issues the anonymous identifier described above, and stores your email address and display name if you choose to link an Apple or Google account.
• Cloud Firestore: stores a best-effort backup of your learning progress, keyed to your identifier, so it survives a reinstall or a new device. The same database holds a small metadata record described in Section 6, your purchase entitlement, and the content reports described in Section 5.
• Firebase App Check: verifies that requests come from a genuine Kylin installation, using device attestation (App Attest on iOS, Play Integrity on Android).
• Firebase Remote Config: lets us change small pieces of App configuration remotely, such as the minimum supported App version.
• Firebase Cloud Messaging: delivers the notifications described in Section 7.

The cloud backup is best-effort. If you are offline, or if background sync is unavailable for any reason, the App keeps working normally from the local copy on your device, which remains the source of truth.

5. Content Reports

If you tap "Something looks wrong?" to flag a translation, pronunciation, audio clip, mnemonic or typo, the App sends us a short report so we can fix it. A report contains the item being reported, the type of problem, an optional note you write yourself, the App version and your identifier. It carries no name, email address or contact detail, and it is used to correct the App's content. Reporting is always optional.

6. Device and Version Record

The App keeps one small record about your installation in Cloud Firestore, written at most once a day and usually not at all. It holds your App version and build number, the platform you are on, a coarse last-active date, the date you installed, and the week your installation first appeared. We use it for operational questions that aggregate statistics cannot answer: which build a user is actually running before we set a minimum supported version, and whether a bad build has been left behind. It carries no name, email address or contact detail.

7. Notifications

Notifications are off until you turn them on, and you can turn them off again at any time in your device settings.

• Practice reminders that you schedule yourself are held locally by your device's operating system. They are not sent from a server.
• Remote notifications (for example, letting you know reviews are waiting, or announcing a new HSK level) are delivered through Firebase Cloud Messaging. To send one, the App registers a device token with Google and stores it against your identifier, and may subscribe your installation to broad topics such as your platform or how recently you last opened the App. A token identifies an installation, not a person, and we do not use it to build a profile of you.

8. Analytics, Diagnostics and Third-Party Services

The App uses two Google-provided services to understand how it is performing:

• Firebase Analytics: records usage events, for example which screen you opened or which lesson you finished, so we can see how the App is used and improve it. These events do not carry your name, email address or contact details.
• Firebase Crashlytics: collects crash and error reports if the App malfunctions, including your device model, operating system version, App version and a technical log of what the App was doing at the time. Crash reports do not include your name, email address or what you were studying.

During normal operation, the App communicates only with the following third-party services:

• Firebase Authentication (Google LLC): the anonymous identifier, plus email address and display name if you link an account
• Sign in with Apple (Apple Inc.): optional account linking
• Google Sign-In (Google LLC): optional account linking
• Cloud Firestore (Google LLC): learning-progress backup, the record in Section 6, purchase entitlement and content reports
• Firebase App Check (Google LLC): request integrity verification
• Firebase Remote Config (Google LLC): remote App configuration
• Firebase Cloud Messaging (Google LLC): notification delivery
• Firebase Analytics (Google LLC): usage analytics
• Firebase Crashlytics (Google LLC): crash and error diagnostics
• Apple App Store (Apple Inc.) and Google Play (Google LLC): purchases and receipt validation
• Google Fonts (Google LLC): font assets for this web page only

This version of the App requests no access to your microphone, camera, contacts, photos or location. If a future version needs one of those, we will update this policy before that version is released and, where the law requires it, ask for your consent first.

9. Payments and Subscriptions

Kylin is free to start, and the whole of HSK 1 is free. An optional Kylin Pro upgrade (a monthly or annual auto-renewing subscription, or a one-time lifetime purchase) opens HSK 2 and HSK 3. All payments are processed entirely by the Apple App Store or Google Play. We do not operate our own payment system.

We never receive, see or store your card number, billing address or any other payment detail. The store reports back only whether a valid Kylin Pro entitlement exists, so the App can open the paid levels, and that entitlement is mirrored to Cloud Firestore so it survives a reinstall. Your purchases, billing and refunds are governed by the privacy policy and terms of the store you bought from. See our Terms of Use for the subscription terms.

10. Learning Content and Attribution

Some of Kylin's reference material comes from open projects that require credit, and the App carries their licence text in full on its attribution screen:

• CC-CEDICT, a community Chinese to English dictionary, used for definitions and readings. Licensed under Creative Commons Attribution-ShareAlike 4.0.
• Make Me a Hanzi, used for stroke order and character decomposition. Copyright 1999 Arphic Technology Co., Ltd. and copyright 2016 Shaunak Kishore, distributed under the Arphic Public License.

These are content sources, not services. Nothing about you is sent to them, and the App does not contact them at runtime.

11. Data Sharing and Sale

We do not sell your data. We do not share it with any third party except as needed to operate the App, specifically by transmitting your learning backup, entitlement, content reports and diagnostic data to the Firebase services described above, or as required by law. Nothing is shared with other learners.

12. Account Deletion and Data Retention

You can delete your account and all associated data at any time:

• In-app: open Settings, scroll to the bottom, and tap Delete account, then confirm. This clears the learning data stored on your device, removes your content reports and the record in Section 6, and deletes your Firebase Authentication identity, including the email address and display name if you had linked an Apple or Google account.
• By email: write to support@iocodo.com with the subject "Kylin Account Deletion". We complete the deletion within 30 days and confirm by reply.

Step-by-step instructions, including what survives deletion and why, are on the account deletion page. Any remaining copy of your data in our backend systems is removed within 30 days. Crash reports are held for up to 90 days and then deleted.

13. Children's Privacy

Kylin is a general-audience education app. It is not directed at children under the age of 13, and we do not knowingly collect personal information from children. The App can be used in full without an account: nothing in it requires a name, an email address or any other personal detail, so it suits learners of any age under the supervision appropriate to their context. The optional account linking in Section 3 is a choice made by the device owner.

14. Your Rights (GDPR, CCPA and similar laws)

Depending on where you live, you may have rights over your data under laws such as the EU and UK General Data Protection Regulation or the California Consumer Privacy Act. Unless you have linked an Apple or Google account as described in Section 3, the data we hold about you is the anonymous learning data described above, so that is what most of these rights apply to. You can, at any time:

• Access or export your learning data, using the in-app export where available, or by contacting us.
• Delete your data and your account, as described in Section 12.
• Object to or restrict the backup, notifications and analytics described above, by leaving the App offline and declining optional features such as notifications and content reporting.
• Contact us with any question or request about your data, at the address in Section 16.

We do not sell personal information, and there is no "sale" or "sharing" of data to opt out of under the CCPA.

15. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the "Last updated" date at the top of this page. Continued use of the App after changes are posted constitutes your acceptance of the updated policy.

16. Contact

If you have questions about this Privacy Policy, please contact:

IOCODO LLC
Email: support@iocodo.com
Website: iocodo.com