Your GDPR Rights

Last Updated: August 17, 2026

1. Introduction

Tingyin (听音) is a Mandarin tone-listening trainer. If you live in the European Economic Area, the EU General Data Protection Regulation (GDPR) gives you rights over the personal data we hold about you.

This page explains each right and the exact place in the app where you can exercise it. Most of them you can do yourself, in your account, without writing to us.

If you train without an account, your progress stays on your own device and is never sent to us. Everything below applies to accounts.

2. Data Controller

The data controller is Zava Solutions LLC, 30 N Gould St Ste N, Sheridan, WY 82801-6317, United States. You can reach us at kubo5922@gmail.com.

3. Your Rights

Right of access (Article 15)

You can download a copy of everything we hold about your account at any time.

How to exercise it:

What you get:

your account details and email preferences
the sign-in providers connected to your account
your synced learning progress
your purchase history
the names of your saved passkeys — device name and dates only, never the public key or credential identifier

Right to rectification (Article 16)

You can correct your account information yourself, and the change takes effect immediately.

How to exercise it:

Display name, bio, hometown and profile photo: Edit profile
Email address: Change email — we send a verification link to the new address
Password: Change password

Right to erasure (Article 17)

You can delete your account at any time, from inside the app, in two steps. Type DELETE (or your email address) to confirm.

How to exercise it:

What we delete:

Your profile, sign-in credentials (password, passkeys, connected sign-in providers) and your synced learning progress.

What we keep, and why:

Payment records. A note that a real payment happened is kept for accounting. Stripe, the payment processor, holds the authoritative copy of the transaction regardless.
Email suppression records. The record that your address unsubscribed or bounced is kept so we never email you again.

Right to restriction of processing (Article 18)

You can tell us to keep your data but stop using it. Nothing is deleted and nothing you use stops working — we simply stop learning anything about you.

How to exercise it:

Sign in, go to Edit profile, and under "Restrict processing" choose Restrict processing of my data. It takes effect immediately.

What stops:

The usage record we keep about you. We normally note when you were last active and which days you trained, so we can see how the product is used. While the restriction is on, we stop writing it.
Marketing email. It is switched off, and it cannot be switched back on until you lift the restriction.
Analytics in your browser. Restricting also withdraws your analytics consent, which stops the analytics events the app sends. That choice is stored in the browser you use, so if you also train on another device, turn analytics off there too under cookie preferences. The stop on our own servers applies to your whole account either way.

What keeps working:

Signing in, training, and syncing your progress. A right you cannot exercise without losing the service is not a right, so restricting does not take the app away from you.
Email you asked for — a password reset, an email-change confirmation, a sign-up code. Withholding those would lock you out of the account the restriction is meant to protect.
Payment records and email suppression records, which we are required to keep and which are storage rather than use.

Only you can lift the restriction, from the same screen. Lifting it lets us record usage again; marketing email stays off until you switch it on yourself.

Right to data portability (Article 20)

The export you download under the right of access is a structured, machine-readable JSON file, so you can take your data to another service.

How to exercise it:

Right to object (Article 21)

We do not run advertising campaigns and we do not use your data for advertising. The one broadly promotional email we send is the welcome email when you create an account, and it carries an Unsubscribe link at the bottom. Following it switches marketing email off for your account in one click, without signing in, and the link stays valid for a year.

Email you ask for — a password reset, an email-change confirmation, a sign-up code — carries no unsubscribe link, because switching those off would lock you out of your own account. Article 21 does not ask us to offer one for them.

You can also switch marketing off at any time in your email preferences. To object to the usage record we keep about you, use the right to restriction above.

We do not use your data for automated decision-making that has legal or similarly significant effects on you.

Withdrawing consent (Article 7)

Where we rely on your consent — such as for analytics cookies — you can withdraw it at any time, as easily as you gave it.

The app itself sets only two cookies, both strictly necessary for sign-in and security. See our Cookie Policy for the full list of what is set and how to change your choice.

4. How Long We Keep Data

We keep your account data for as long as your account is active. You can delete it at any time, and we then erase it as described under the right of erasure above.

Two things outlive the account: payment records, kept for accounting, and email suppression records, kept so we never email you again. Short-lived security tokens and keys expire or are deleted automatically.

5. Data Security

Passwords are stored as hashes, never in plain text. Files are stored with a provider that encrypts them at rest, and traffic to and from the app is protected in transit.

6. International Transfers

Tingyin is operated from the United States, and some of the service providers that process data on our behalf — hosting, file storage, payments, email, analytics and abuse prevention — are also based outside the EEA. We rely on providers that apply appropriate security and data-protection safeguards. If you have questions about how your data is transferred, contact us.

7. How to Exercise Your Rights

Most rights are self-service in the app, exactly as described above. For anything else — a question, a request that is not covered by the app's own screens, or help with one of them — email us at kubo5922@gmail.com.

We respond to valid requests within the time the GDPR allows: one month, extendable by a further two months for complex requests, and we will tell you if we need the extension. We may need to verify your identity first.

If you are in the EEA, you also have the right to lodge a complaint with your local data protection authority.

Related Documents: Privacy Policy | Terms of Service | Cookie Policy

Your GDPR Rights

Last Updated: August 17, 2026

1. Introduction

This page explains each right and the exact place in the app where you can exercise it. Most of them you can do yourself, in your account, without writing to us.

If you train without an account, your progress stays on your own device and is never sent to us. Everything below applies to accounts.

2. Data Controller

The data controller is Zava Solutions LLC, 30 N Gould St Ste N, Sheridan, WY 82801-6317, United States. You can reach us at kubo5922@gmail.com.

3. Your Rights

Right of access (Article 15)

You can download a copy of everything we hold about your account at any time.

How to exercise it:

What you get:

your account details and email preferences
the sign-in providers connected to your account
your synced learning progress
your purchase history
the names of your saved passkeys — device name and dates only, never the public key or credential identifier

Right to rectification (Article 16)

You can correct your account information yourself, and the change takes effect immediately.

How to exercise it:

Display name, bio, hometown and profile photo: Edit profile
Email address: Change email — we send a verification link to the new address
Password: Change password

Right to erasure (Article 17)

You can delete your account at any time, from inside the app, in two steps. Type DELETE (or your email address) to confirm.

How to exercise it:

What we delete:

Your profile, sign-in credentials (password, passkeys, connected sign-in providers) and your synced learning progress.

What we keep, and why:

Payment records. A note that a real payment happened is kept for accounting. Stripe, the payment processor, holds the authoritative copy of the transaction regardless.
Email suppression records. The record that your address unsubscribed or bounced is kept so we never email you again.

Right to restriction of processing (Article 18)

You can tell us to keep your data but stop using it. Nothing is deleted and nothing you use stops working — we simply stop learning anything about you.

How to exercise it:

Sign in, go to Edit profile, and under "Restrict processing" choose Restrict processing of my data. It takes effect immediately.

What stops:

The usage record we keep about you. We normally note when you were last active and which days you trained, so we can see how the product is used. While the restriction is on, we stop writing it.
Marketing email. It is switched off, and it cannot be switched back on until you lift the restriction.
Analytics in your browser. Restricting also withdraws your analytics consent, which stops the analytics events the app sends. That choice is stored in the browser you use, so if you also train on another device, turn analytics off there too under cookie preferences. The stop on our own servers applies to your whole account either way.

What keeps working:

Signing in, training, and syncing your progress. A right you cannot exercise without losing the service is not a right, so restricting does not take the app away from you.
Email you asked for — a password reset, an email-change confirmation, a sign-up code. Withholding those would lock you out of the account the restriction is meant to protect.
Payment records and email suppression records, which we are required to keep and which are storage rather than use.

Only you can lift the restriction, from the same screen. Lifting it lets us record usage again; marketing email stays off until you switch it on yourself.

Right to data portability (Article 20)

The export you download under the right of access is a structured, machine-readable JSON file, so you can take your data to another service.

How to exercise it:

Right to object (Article 21)

You can also switch marketing off at any time in your email preferences. To object to the usage record we keep about you, use the right to restriction above.

We do not use your data for automated decision-making that has legal or similarly significant effects on you.

Withdrawing consent (Article 7)

Where we rely on your consent — such as for analytics cookies — you can withdraw it at any time, as easily as you gave it.

The app itself sets only two cookies, both strictly necessary for sign-in and security. See our Cookie Policy for the full list of what is set and how to change your choice.

4. How Long We Keep Data

We keep your account data for as long as your account is active. You can delete it at any time, and we then erase it as described under the right of erasure above.

5. Data Security

Passwords are stored as hashes, never in plain text. Files are stored with a provider that encrypts them at rest, and traffic to and from the app is protected in transit.

6. International Transfers

7. How to Exercise Your Rights

If you are in the EEA, you also have the right to lodge a complaint with your local data protection authority.

Related Documents: Privacy Policy | Terms of Service | Cookie Policy