1. Who we are

Baozi is an app for learning Chinese characters and HSK vocabulary. It is available as an iOS app, as a web app at app.hsk.cards, as a Telegram Mini App and on the website hsk.cards (together, the “Service”). The Service is run by Ivan Guliaev, an individual entrepreneur based in Bishkek, Kyrgyzstan (“we”, “us”). For any question about your data, write to support@hsk.cards.

If you use the Russian version of the Service (hskcards.ru, the Russian Telegram bot), the Russian privacy policy applies instead.

2. What we collect

You can study without an account. Without signing in, your progress stays on your device and we receive nothing except the technical data described below.

• Account data. If you sign in with email, we store your email address. If you sign in with Apple or Google, we store the account identifier that service gives us and the email address it shares (with Apple this can be a private relay address). We also keep a record of your sign-in sessions (device type, time).
• Telegram data. If you use the Telegram bot or Mini App, Telegram gives us your Telegram ID, username, the name in your profile and your Telegram language, plus your reminder settings.
• Learning progress. Which words you have studied, your answers and review history, streaks, achievements and app settings. When you are signed in, this is synced between your devices.
• Usage events. Actions inside the app, such as “round started” or “pricing screen opened”, with non-identifying details. They are stored on our own server. We do not use third-party analytics or advertising SDKs, and we do not track you across other companies’ apps or websites.
• Purchases. If you buy a subscription, the payment is handled by the App Store (or another payment provider where the store offers one). We receive the plan, price, dates, status and a transaction identifier, never your card details.
• Technical data. Our servers log IP addresses, device or browser information and request times to run and protect the Service.
• Support messages. Whatever you tell us when you write to support.

We do not collect your contacts, location, photos, microphone recordings, health data or advertising identifier.

3. Why we use it

• to provide the Service: sign-in, keeping and syncing your progress, building your study rounds — necessary to perform our agreement with you;
• to send the sign-in codes you request and, in Telegram, the study reminders you turn on (you can turn them off at any time);
• to process purchases and meet accounting and tax obligations;
• to answer support requests;
• to understand how the app is used and improve it, and to keep the Service secure — our legitimate interest in a working, safe product.

We do not sell your personal data and do not use it for advertising.

4. Who processes it for us

We share data only as far as each function needs:

• Selectel (Moscow, Russia) — hosting: the app’s servers and database run there;
• Cloud.ru (Russia) — encrypted database backups;
• Cloudflare, Inc. — domain names, delivery of the Telegram webhook, and routing of emails sent to our support address;
• Resend — sending sign-in code emails;
• Apple and Google — when you choose to sign in with them; Apple also processes App Store purchases;
• Telegram — running the bot and Mini App, sending messages and reminders, and our internal support chat;
• Google Fonts — fonts on our websites: your browser requests them from Google, which receives your IP address and browser details. The iOS app does not use it.

5. Where your data is stored

Our database and backups are in Russia. Some providers listed above work from other countries, including the United States and the European Union. By using the Service you understand that your data is transferred to and stored in these countries. We transfer only what each function needs.

6. How long we keep it

• account data, Telegram data and learning progress — while you use the Service, until you delete your account;
• sign-in codes — until used or expired (a few minutes);
• purchase records — as long as accounting and tax law requires;
• server logs — only as long as needed for security.

7. Deleting your account

In the iOS app, open Settings → Delete account. This deletes your account, progress and sign-in data from our server right away and clears the progress on that device. You can also ask us by email at support@hsk.cards. We keep only the records the law requires us to keep (such as purchase records). An App Store subscription is managed in your Apple account settings; deleting your Baozi account does not cancel it.

8. Security

Connections are encrypted (TLS), access to servers and the database is restricted, sign-in tokens are stored as hashes, and backups are encrypted. No method of transmission over the internet is completely secure, but we work to protect your data.

9. Your rights

Depending on where you live, you can ask us to access, correct, export or delete your data, to restrict or object to its processing, and to withdraw a consent you gave. Write to support@hsk.cards; we answer within 30 days. You can also complain to the data protection authority in your country.

10. Children

The Service is not directed at children under 13, and we do not knowingly collect their personal data. If you believe a child under 13 has given us personal data, write to us and we will delete it.

11. Changes

We publish any new version on this page with its date. If a change is significant, we will tell you in the app.

Contact

Service

Baozi

Operator

Ivan Guliaev, individual entrepreneur, Bishkek, Kyrgyzstan

Email

support@hsk.cards

Website

hsk.cards