Privacy Policy

DragonSpeak Mandarin is a local-first learning app. Learning activity and voice recordings stay on your device. If you buy or restore optional content, the app creates a pseudonymous billing account and sends purchase information and limited authentication security metadata to a billing-verification service.

Information handled on your device

• Learning preferences, progress, review schedules, scores and streaks are stored locally on your device.
• If you choose a speaking exercise, the app requests microphone access. Recordings remain in the app’s temporary local storage, are not uploaded and are removed when replaced, when the recorder closes or when local learning data is cleared. Only derived practice results are kept locally.
• If you enable a reminder, its time, permission state and operating-system schedule identifier are stored locally. The app does not request a remote push token.
• The app stores local entitlement status and a non-reversible transaction fingerprint so it can avoid duplicate grants.

Purchase verification and authentication security data

Only when you start a purchase or restore purchases, the app uses Firebase Authentication to create a random anonymous user ID. It sends that ID, a pseudonymous App Account Token, product ID, signed store transaction, transaction and original-transaction IDs, purchase status, and relevant purchase, renewal, expiry or revocation dates to our Firebase/Google Cloud billing service. We use this information only to verify ownership, prevent fraud and duplicate grants, unlock or restore content, and process subscription, renewal, refund or support events.

When account deletion begins, the service creates a deletion-race fence that actively blocks writes for two hours. Its document key is an irreversible HMAC derived from the anonymous billing ID using a server-only key; it contains no raw user ID, purchase identifier or transaction data. It stores only its anti-race purpose, schema version, creation time and expiry time. After two hours it no longer blocks writes, and Firestore's asynchronous TTL process is configured to delete the expired document—typically within 24 hours after expiration.

When the anonymous billing account authenticates, Firebase Authentication processes its user-agent and IP address to provide authentication and help prevent abuse and unauthorized access. Firebase states that Authentication keeps logged IP addresses for a few weeks. Firebase Functions also processes request metadata such as the function name and IP address to operate and protect the billing service, and states that Functions retains IP addresses only temporarily. We treat this as linked Other Diagnostic Data used only for App Functionality. We do not derive a location from the IP address or use this metadata for advertising, marketing, learning analytics, personalization, or tracking.

To limit automated abuse of authenticated billing functions, our service also keeps a short-lived counter whose document key is an irreversible keyed HMAC of the anonymous billing ID and operation. The record contains no raw user ID, IP address, purchase token or transaction. It stores only its security purpose, schema version, operation name, request count, rate-limit window start and expiry. Account deletion removes these counters; otherwise Firestore TTL is configured to delete them after their 24-hour expiry.

Apple processes payments. We do not receive your Apple Account name, email address, password or payment-card information.

Sharing, linkage and tracking

Google Firebase/Google Cloud processes the anonymous billing account, verification records, and authentication security metadata on our behalf, and Apple processes App Store transactions. Purchase history and authentication security metadata are linked to the random billing user ID while the account exists. We do not use this data for advertising, marketing, learning analytics or personalization, do not sell it, and do not track you across other companies’ apps or websites. The app contains no third-party advertising SDK.

Your choices, deletion and retention

• Open Me → Settings → Delete Billing Account & Server Data to delete the anonymous Firebase account and the developer-held purchase and account records linked to it. Deletion begins immediately and is retry-safe; only the non-reversible, data-free deletion-race fence described above remains during its two-hour active period and asynchronous TTL removal so in-flight operations cannot recreate the records. Provider security logs are controlled by Firebase’s retention schedule and may remain for a few weeks; they do not contain lesson progress or voice recordings.
• Account deletion does not cancel an Apple subscription and does not delete Apple’s records. Manage or cancel subscriptions separately in App Store account settings. You may restore an eligible purchase later; doing so creates a new anonymous billing account.
• Open Me → Settings → Delete Learning Data to erase on-device learning progress, preferences, local purchase evidence and app-owned reminder schedules.
• You may also email apple72899@gmail.com with a privacy request. Because the billing account is anonymous, the in-app deletion control is the reliable way to identify and delete its linked records.

Permissions

Microphone and notification permissions are optional and requested only when you use the related feature. You can revoke them in iOS Settings.

Security and international processing

Billing requests use encrypted network connections and signed store transactions. Firebase/Google Cloud and Apple may process data in countries where they operate, subject to their service terms and privacy safeguards.

Changes and contact

If app behavior changes, this policy and the App Store privacy answers will be updated. Questions can be sent to apple72899@gmail.com.