Privacy Policy

1. Who we are

Tingyin (听音) is a Mandarin tone-listening trainer. It is operated by Zava Solutions LLC, a Wyoming limited liability company trading as Tingyin. In this policy, “we” means that company. Its registered address is in section 11.

This policy explains what personal information we collect, why we collect it, how we use it, who we share it with, and what rights you have over it. It covers everyone who uses Tingyin, whether or not you have an account.

2. Information we collect

2.1 When you create an account

• Your email address. Required for an account.
• Your password, if you sign up with a password. We store only a hash of it, never the password itself.
• A display name and an avatar photo, if you choose to add them. Both are optional.
• Your Google or Apple sign-in identity, if you sign in with one. We store the provider and the provider's email address, not your password.
• Passkey credentials, if you use a passkey. We store the public key, a credential ID, and a device name — never the private key.
• Your training progress, if you have an account that syncs. Without an account, progress stays in the browser on the device you use.
• A record of your purchase if you buy Premium, and your email preferences.

2.2 When you use the service

• Usage data through PostHog, our analytics provider (see Analytics below).
• Technical data such as your IP address and browser type, which the servers and services that run Tingyin need in order to serve it and keep it secure.

Audio credits. The word audio you hear was recorded by human speakers and is licensed under CC BY-SA 4.0: HSK word recordings by Yue Tan and syllable recordings by Chen Wang (audio-cmn / Shtooka), and word recordings by individual Lingua Libre contributors. The corpus word list is derived from HSK vocabulary under CC BY-SA.

2.3 Cookies

Tingyin sets exactly two cookies, both on our own domain and both needed for the service to work: one keeps you signed in, and one protects against cross-site request forgery. We do not use advertising cookies or cross-site tracking cookies.

3. How we use your information

We use your information for the purposes below, and we rely on these legal bases under Article 6 of the GDPR:

We do not rely on consent for any of the processing above, so there is nothing you need to opt in to, and no processing stops if you do not opt in. You can still change your email preferences at any time from the Edit profile page. We do not make decisions based solely on automated processing that produce legal or similarly significant effects (Art. 22 GDPR).

4. Analytics

We use PostHog, a product analytics service, to understand how Tingyin is used and to improve it. When you use the service while signed in, your email address is sent to PostHog and linked to a profile, so we can see how accounts use the service over time.

That information is used only for product analytics. It is not used for advertising, remarketing, or conversion tracking, and it is not shared with any advertising network, data broker, or other company. Nothing in Tingyin tracks you across other apps or websites.

The legal basis for this processing is our legitimate interest in improving the product, under Article 6(1)(f) of the GDPR. What the cookie banner controls is storage on your device, not the measurement itself: until you accept, PostHog counts the visit without writing a cookie, which means we can see that a visit happened but cannot connect it to your next one. Rejecting stops the measurement too.

5. Who we share your information with

We share personal information only with the processors below, to run the service. Each of them processes your data on our behalf and only for the purpose listed:

We do not sell, rent, or trade your personal information. We disclose it to law enforcement or others only when the law requires it, or to protect our rights and the safety of the service. If Tingyin is ever acquired or merged, your information may transfer to the new owner, who must continue to honor this policy.

6. How long we keep your information

We keep your account information for as long as your account is active. From the Edit profile page you can download a copy of your data or delete your account at any time.

Deleting your account permanently removes your profile, sign-in credentials, passkeys, synced progress, and avatar. Two things survive deletion, and we keep them deliberately:

• Your purchase records. They are a financial record of a real payment and are kept for accounting. Stripe holds the authoritative copy regardless.
• The record that your address unsubscribed or bounced. Deleting it would re-enable email to someone who asked us to stop.

For everything else, we keep personal information only as long as the purposes above need it, and we review these periods from time to time.

7. International data transfers

Tingyin is operated from the United States, and your information is stored and processed in the United States by us and by the processors listed above. If you are in the EEA, the UK, or Switzerland, these transfers need a lawful mechanism under Chapter V of the GDPR:

• Where a processor participates in the EU-US Data Privacy Framework — Stripe, Cloudflare, PostHog, Resend, and Google — the transfer relies on that adequacy decision (Art. 45 GDPR).
• Where a processor does not participate — in particular Railway — and as an additional safeguard everywhere else, the transfer is covered by Standard Contractual Clauses (Art. 46(2)(c) GDPR).

You can ask for a copy of the relevant safeguards by contacting us at the address below.

8. Your rights and choices

You can do most things yourself. From the Edit profile page you can change your display name, email preferences, and password, download a copy of your data, restrict how we process it, and delete your account.

8.1 Under the GDPR

If you are in the EEA, the UK, or Switzerland, you have the right to:

• access your personal information (Art. 15 GDPR)
• correct inaccurate information (Art. 16 GDPR)
• have your information erased (Art. 17 GDPR)
• restrict processing in certain cases (Art. 18 GDPR)
• receive a copy of your information in a portable form (Art. 20 GDPR)
• object to processing based on legitimate interests (Art. 21 GDPR)
• lodge a complaint with your supervisory authority (Art. 77 GDPR)

To exercise any of these rights, write to us at kubo5922@gmail.com. We will respond within the time limit set by Art. 12(3) GDPR — generally within one month, extended by up to two further months for complex or repeated requests.

8.2 Under California law (CCPA/CPRA)

If you are a California resident, California law gives you the right to know what personal information we hold, to correct it, to delete it, and to receive equal service and price for exercising these rights. We do not sell your personal information, and we do not share it for cross-context behavioral advertising, so there is nothing to opt out of on Tingyin. You can exercise these rights the same way as the GDPR rights above.

9. Children

Tingyin is not directed at children under 13 (or under 16 in the EEA), and we do not knowingly collect personal information from children. If you believe a child has given us personal information, contact us at kubo5922@gmail.com and we will delete it.

10. Changes to this policy

We may update this policy from time to time. If a change is significant, we will let you know before it takes effect, in the app or by email. The latest version always appears on this page, with the date above.

11. Contact

Questions about this policy or about your data? Contact us at kubo5922@gmail.com.
Zava Solutions LLC, a Wyoming limited liability company, 30 N Gould St Ste N, Sheridan, WY 82801, United States.