Privacy Policy

Updated October 26, 2026. This notice applies to Learn Hanzi with Panda 1.3.0 (70) and its current production service. Operator: Chenxing Future Information Technology (Shanghai) Co., Ltd.

Children's learning and parent choices

The app provides offline learning without an account or purchase. When not signed in, learning progress and local learning events stay on the device and are not uploaded to our service. Optional account synchronization, third-party processing consent, purchases and external links are protected by parent PIN or device biometric verification. Verification happens on device; we do not collect the PIN or biometric templates.

Information collected after sign-in and its uses

• Name and email, if supplied by Sign in with Apple, Apple user identifier and application account identifier: account authentication, synchronization and account management.
• Learned characters, quiz and skill results, learning timestamps and duration, review history, story reading progress, parent settings, fixed interest tags, language and time zone: progress sync, review scheduling, learning recommendations, parent reports, time limits and weekly story eligibility.
• Optional subscription product and original transaction identifiers, verification environment, expiry and entitlement status: purchase validation and restoration with Apple and provision of purchased learning access. We do not receive payment-card details.
• Signed-in parent/subscription flow events for first-party funnel analysis and operational troubleshooting: parent gate completed, paywall viewed, plan selected, purchase result, entitlement activated and paywall dismissed. Fields include a random event ID, timestamp, app version, locale, UI source and optional storefront, product ID and result. The server associates these events with the signed-in account ID and records receipt time; they are not anonymous.
• IP/network request metadata, request paths, timestamps, response status and necessary error/performance diagnostics generated by service requests: content delivery, service operation, security and troubleshooting, not advertising profiles or device fingerprinting.

AI and reviewed content

Online AI content generation is disabled in the production service for release 1.3.0 (70). Learning and audiobooks use reviewed content and prerecorded narration; this release does not send learning context to DeepSeek or other AI model providers. An AI consent setting does not override the server-side disabled state. Any future online-processing change requires a fresh assessment of Kids Category requirements and updated privacy disclosures before enabling it. A parental gate is not a substitute for legally required parental consent.

Optional blind writing

Blind writing is scored on device. When signed in, only the character, stars and submission time sync to our service. Handwriting images and paths are not uploaded or sent to a third-party AI for scoring.

Service providers, storage and sharing

Account, learning, subscription entitlement and parent event records are stored in our controlled production API and MySQL database, hosted on Volcengine cloud infrastructure. Public curriculum images, audio and animation assets are application content stored in Amazon S3 in the AWS China Beijing region and delivered through AWS China CloudFront (cdn.cxfuture.top); this content origin does not store account or learning records. Hosting and content delivery providers process network metadata necessary for hosting, delivery and operational security. They are not third-party advertising or analytics services used by this app.

Apple provides optional Sign in with Apple, App Store payments/subscriptions and transaction verification, processing the associated data under Apple's platform rules. The embedded RiveRuntime renders bundled animation files on device; it is not used for ads or analytics and receives no account or learning records from us.

We do not sell personal information, integrate third-party advertising or analytics SDKs, track users across apps, collect IDFA/advertising identifiers, precise location or device fingerprints, or provide account or learning records to advertisers, analytics vendors or data brokers.

Retention and deletion

Account and synchronized learning/entitlement records support ongoing app functionality until a parent deletes the account and data. A daily cleanup removes parent/subscription events received more than 90 days earlier; account deletion also removes associated database records. Local learning events retain up to 500 entries from the last 90 days on the device. Operational/security logs are managed for infrastructure operation; the 90-day event cleanup is not a claim about retention of all data or cloud-provider logs.

A parent can delete the account and associated data in Parent Area → Settings → Delete Account and Data, or contact us to request access, correction or deletion. Core offline learning does not require account sync, AI processing or subscription.

Contact

Email: contact@cxfuture.top. Support: https://www.cxfuture.top/support.