Privacy Policy

1. Overview & Data Controller

Youyin is an open-source educational web application dedicated to helping people learn and practise handwriting characters from various writing systems. The website is operated by Heapforge Ltd, a company registered in England and Wales. Heapforge Ltd is the data controller for this website under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, and - for visitors in the European Economic Area - under the EU General Data Protection Regulation (Regulation (EU) 2016/679).

Company

Heapforge Ltd

Companies House number

17418393

Registered address

82a James Carter Road, Mildenhall, Bury St. Edmunds, England, IP28 7DE

Because Youyin operates as a static, client-side application without user accounts or server-side databases, we do not collect, store, sell, or process personal data on any remote server.

Because no personal data ever reaches us, Heapforge Ltd has not appointed a data protection officer and has not designated a representative in the European Economic Area under Article 27 of the EU GDPR. Written enquiries can be sent to the registered address above; questions about this policy are answered fastest through the GitHub repository linked at the end of it.

2. Data Stored on Your Device

All application data generated during your learning journey is saved locally in your browser's persistent storage (IndexedDB and localStorage). This data includes:

• Cards and Phrases: Character definitions, pronunciations, regional variant selections, and custom phrases you create or import.
• Study Statistics: Revision history, error counts, knowledge levels, daily streaks, streak freeze balances, and gem rewards.
• Activity Calendar: Daily session counts used to draw your practice heatmap on the Account page.
• Preferences: Selected color theme, interface language, game modifiers (such as extensive mode and daily level reduction), and onboarding tutorial progress.

This information remains entirely on your device. It is never transmitted to us or any third party.

3. Technical Data & Third-Party Providers

When you visit Youyin, your web browser connects to third-party infrastructure providers to download the website files, character stroke data, public decks, and emoji images. These providers may process technical connection data (such as your IP address, browser User-Agent, and request timestamps) strictly for the purpose of transmitting content and securing network operations:

• GitHub Pages (GitHub, Inc. / Microsoft): Static web hosting for the site application files.
• jsDelivr CDN (ProspectOne / Cloudflare): Content Delivery Network used to distribute the character stroke database, the public deck repository, and emoji images.

These providers process technical metadata in accordance with their respective privacy policies and under the international data transfer mechanisms that apply to them (such as the EU-U.S. Data Privacy Framework and its UK Extension, and standard contractual clauses).

4. Legal Bases for Processing (Art. 6 UK GDPR / EU GDPR)

Under Article 6(1) of the UK GDPR and of the EU GDPR, the limited technical processing required to deliver the website relies on:

• Article 6(1)(b) (Performance of a Contract / Service Delivery): Processing technical requests necessary to provide the web app and its interactive character practice tools upon your visit.
• Article 6(1)(f) (Legitimate Interests): The legitimate interest of maintaining website availability, fast CDN delivery, system integrity, and protection against network attacks or abuse.

5. Cookies & Tracking Technologies

Youyin does not use any tracking cookies, analytics cookies, targeting cookies, or third-party advertising scripts. We do not track your behavior across websites, nor do we build personal user profiles.

We utilize standard client-side storage technologies (IndexedDB, localStorage, and Service Worker Cache API) solely for strictly necessary technical functionality — storing your decks, keeping track of your revision levels, enabling offline practice as a Progressive Web App (PWA), and remembering your UI preferences. In accordance with the UK Privacy and Electronic Communications Regulations 2003 (PECR), the EU ePrivacy Directive (Directive 2002/58/EC) and the UK and EU GDPR, strictly necessary functional storage does not require a consent banner.

6. Your Rights Under the UK and EU GDPR

The UK GDPR - and, if you are in the European Economic Area, the EU GDPR - grants you specific rights concerning your data:

• Right of Access (Art. 15): You can view all data stored about your learning progress directly on the Deck and Account pages.
• Right to Rectification (Art. 16): You have complete control to edit, correct, or rename any card, phrase, definition, or preference at any time directly in the application.
• Right to Erasure (Art. 17 - 'Right to be Forgotten'): You can delete all your stored data immediately at any time by clicking the 'Clear account data' button on the Account page, or by clearing your browser's site data.
• Right to Data Portability (Art. 20): You can export all your decks and phrases in machine-readable JSON format at any time using the Export Deck option on the Deck page.
• Right to Restriction and Objection (Art. 18 & 21): Since no personal data is stored on remote servers, you can stop all local processing at any moment by closing the application or clearing local storage.
• Right to Lodge a Complaint (Art. 77): Our lead supervisory authority is the UK Information Commissioner's Office (ICO), which you can contact at ico.org.uk. If you are in the European Economic Area you may instead complain to the supervisory authority of your own country (for example, the Commission for Personal Data Protection in Bulgaria - CPDP / КЗЛД).

7. Data Retention & Security

Your learning data remains saved in your browser until you choose to erase it, reset your account, or clear your browser's site data. Because your data is stored locally within the browser origin sandbox and never sent to a central server database, it is protected against central database breaches, and Heapforge Ltd never holds a copy of it.

8. Children's Privacy

Youyin is a safe, educational learning environment suitable for learners of all ages. We do not collect, request, or store personal information from children or any other users, and since nothing is profiled, advertised or nudged, the app is built in line with the ICO's Age Appropriate Design Code.

9. International Data Transfers

External infrastructure and CDN providers (GitHub, Cloudflare) operate global networks and data centres. To the extent technical connection metadata is processed outside the United Kingdom or the European Economic Area (EEA), those transfers are covered by the UK's adequacy regulations and by the International Data Transfer Agreement (IDTA) or the UK Addendum to the European Commission's standard contractual clauses (SCCs); for visitors in the EEA they are covered by the SCCs and adequacy decisions adopted by the European Commission.

10. Changes to This Policy & Contact

We may update this Privacy Policy periodically to reflect improvements to the application or legal developments. Any changes will be posted on this page with a revised 'Last updated' date.

If you have questions, feedback, or inquiries regarding this Privacy Policy or the security of Youyin, you can write to Heapforge Ltd at the registered address in section 1, or open an issue on our official GitHub repository: