Privacy Policy
Last updated: 28 May 2026
We try to collect as little personal data as we can while still operating the service. This page explains what we collect, why, where it goes, and what you can do about it.
1. Who we are
ReadCraft is an AI-powered Chinese language learning service operated from South Africa, by the maker of HanziCraft. For the purposes of GDPR and similar laws, we are the data controller for the information described below.
2. What we collect
Information you give us
- Email address — used to sign you in, send magic links, and contact you about your account.
- Story selections — your chosen HSK level, new-word density, scenario, and style.
- Payment information — handled directly by Lemon Squeezy (see "Third parties" below). We never see your full card number.
Information generated through your use of the service
- The Chinese stories that the AI generates for you.
- Timestamps of when stories were generated and when they were last read.
- Your remaining credit balance and purchase history.
Information collected automatically
- Standard server logs (IP address, user agent, request paths) for short-term operational and abuse-prevention purposes.
- Aggregate, anonymous traffic analytics — see "Cookies & analytics" below.
3. Why we collect it
We process your data on the following legal bases:
- To perform the contract with you — generating, storing, and serving the stories you've paid for, and operating your account.
- Legitimate interest — to keep the service running, prevent abuse, fix bugs, and improve the product. We have weighed these interests against your privacy rights.
- Legal obligation — to comply with tax, accounting, and lawful regulatory or law-enforcement requests.
- Consent — for anything else we ask your consent for. You can withdraw consent at any time.
We do not sell your personal data. We do not show third-party advertising inside the service itself. We do run ads on platforms such as Meta (Facebook / Instagram) to reach new learners, and those platforms receive limited measurement data when you visit our site — see "Cookies & analytics" below for what's shared and how to opt out.
4. Third parties (sub-processors)
To operate the service we rely on a small number of carefully chosen providers. Each one has its own privacy practices linked below.
- Anthropic — generates the Chinese stories. Your selections (HSK level, topic, style, density, and any custom prompt text) are sent to Anthropic's Claude API. See Anthropic's privacy policy.
- Lemon Squeezy — merchant of record for purchases. Lemon Squeezy collects your billing details, address, and tax information. We receive a transaction confirmation and your email address only. See Lemon Squeezy's privacy policy.
- Resend — sends our transactional email (magic-link sign-in, receipts). They receive the recipient email address and the email body. See Resend's privacy policy.
- MongoDB Atlas — managed database where your account and stories are stored at rest. See MongoDB's privacy policy.
- Simple Analytics — privacy-first, cookieless website analytics. No personal identifiers are collected. See Simple Analytics' privacy policy.
- Google Analytics — aggregate traffic analytics (page views, referrers, approximate location). IP addresses are truncated and we do not link analytics events to your account. See Google's privacy policy.
- Meta (Facebook) Pixel — measures the effectiveness of our ads on Facebook and Instagram. The pixel records that a browser visited our site and, on purchase, that a purchase occurred plus its value and currency. We do not send your email, name, or account ID to Meta. See Meta's privacy policy.
- Hosting provider — runs the application servers. Server logs (IP, user agent) may be processed in transit.
6. AI processing of your inputs
To generate a story, the parameters you choose are sent to Anthropic's Claude API. Anthropic's API terms state that API inputs and outputs are not used to train their models by default. We do not send your email address, account ID, or payment information to the AI provider.
If you choose to include custom text in a future feature (such as your own target words or a custom prompt), that text will also be sent to the AI provider. Please don't put sensitive personal information into custom prompts.
7. Data retention
- Account & stories — kept while your account is active, and for a reasonable period after to allow you to come back.
- Magic-link tokens — automatically expire and are deleted shortly after issue, even if unused.
- Anonymous pre-purchase stories — temporarily held to enable the post-purchase flow, then deleted if not claimed.
- Payment records — retained for tax and accounting purposes for the period required by law.
- Server logs — typically rotated within 30 days.
When you delete your account we delete or anonymise your personal data, subject to the legal retention obligations above.
8. Your rights
Depending on where you live, you may have the following rights under laws such as the EU GDPR, UK GDPR, California's CCPA, or South Africa's POPIA:
- Access — a copy of the personal data we hold about you.
- Correction — fix anything that's wrong or out of date.
- Deletion — ask us to erase your account and personal data.
- Portability — receive your data in a common machine-readable format.
- Objection / restriction — object to or restrict certain processing.
- Withdraw consent — where we rely on consent, withdraw it at any time.
- Complaint — lodge a complaint with your local data-protection authority.
To exercise any of these rights, email [email protected] from the address associated with your account. We'll respond within 30 days.
9. Security
We protect your information using standard industry practices: HTTPS everywhere, hashed magic-link tokens, signed session cookies, and restricted access to the production database. No system is perfectly secure — if you discover a vulnerability, please report it responsibly to [email protected].
10. Children
ReadCraft is not directed at children under 13 (or the equivalent minimum age in your jurisdiction), and we do not knowingly collect personal data from them. If you believe a child has provided personal data to us, contact us and we'll delete it.
11. International transfers
ReadCraft is operated from South Africa and our processors are located in various countries, including the United States and the European Union. By using the service, you understand that your data may be transferred to, stored in, and processed in those countries. Where required, we rely on appropriate safeguards (such as standard contractual clauses) for cross-border transfers.
12. Changes to this policy
We may update this Privacy Policy from time to time. The "Last updated" date at the top will always reflect the current version. For material changes affecting account holders, we'll make a reasonable effort to notify you by email.
13. Contact
For privacy questions, data requests, or anything else covered in this policy, email [email protected].