Lucky Cat HSK helps people learn HSK Chinese vocabulary. You can install and play entirely as a guest, offline, without an account. In that mode your progress lives only on your device and is not sent to us. Cloud features, ads, purchases, and the optional analytics setting add data collection, described below. We collect the minimum needed to run those features and never sell your personal data.
This policy covers our obligations under Thailand's Personal Data Protection Act (PDPA) and the EU/UK General Data Protection Regulation (GDPR).
a) Guest play (default) — stored only on your device.
Learning progress, mastery, streak, quests, wallet/coins, owned cosmetics, and preferences
are saved in your device's local storage (nbhsk.*). This data is
not transmitted to us while you play as an offline guest.
b) Account & cloud save (optional — only if you sign in).
c) Purchases (only if you buy something).
In-app purchases (the one-time Supporter unlock and coin packs) are processed by
Apple App Store / Google Play via RevenueCat. We receive a
purchase/entitlement confirmation and a purchase token —
we do not receive or store your payment card details.
d) Ads (only if ads are shown).
We show ads via Google AdMob. Depending on your consent choice, AdMob may
process an advertising identifier, coarse device/usage signals, and your consent state to
serve personalized or non-personalized ads. On first run (and on iOS, via App Tracking
Transparency) you choose your consent; non-consented users receive
non-personalized ads.
e) Product analytics (only if you turn it on).
Lucky Cat HSK includes an optional, off-by-default setting —
Settings → "Share anonymous usage data." If, and only if, you switch it on, the app
sends a small set of anonymous, aggregate usage events so we can see how the
game is used and improve it:
You can turn this off again at any time in Settings; turning it off stops all event collection immediately. This setting is independent of ads (§2d) and is off unless you choose it. Basic crash/technical diagnostics provided by the app stores or operating system may still apply under their own policies.
We do not collect contacts, precise location, photos, microphone, or health data.
| Purpose | Data | Legal basis |
|---|---|---|
| Run the game / save progress locally | §2a | Contract / necessary to provide the service |
| Optional cloud save & cross-device sync | §2b | Contract (you chose to sign in) |
| Process purchases & restore entitlements | §2c | Contract |
| Show ads to support the free app | §2d | Consent (personalized) / legitimate interest (non-personalized), per your choice |
| Optional product analytics to improve the game | §2e | Consent (opt-in, off by default; withdraw any time in Settings) |
| Keep the app stable and secure (store/OS crash diagnostics) | §2e | Legitimate interest |
Under PDPA the equivalent bases (consent, contractual necessity, legitimate interest) apply.
We use these service providers, who process data on our behalf. Each also handles data under its own privacy policy:
ap-southeast-1).
Policy: https://supabase.com/privacyWe use no third-party analytics or advertising SDK for the optional analytics in §2e — those events go only to our own Supabase. We do not sell personal data or share it for cross-context behavioral advertising beyond the ad-serving described above.
Lucky Cat HSK is directed to a general audience aged 13 and older (HSK is a formal proficiency exam taken by teens and adults). It is not directed to children under 13, and we do not knowingly collect personal data from children under 13. If you believe a child has provided personal data, contact us and we will delete it.
Subject to PDPA/GDPR, you may access, correct, delete, or export your personal data, object to or restrict processing, and withdraw consent (including ad-personalization consent) at any time.
Withdrawing consent or deleting your account does not affect the lawfulness of processing already carried out, and you may continue to play as an offline guest.
Cloud data is kept while your account is active and deleted within 30 days after you request account deletion or after 24 months of inactivity. Local device data persists until you clear it or uninstall. Purchase records are retained as required for tax/audit purposes.
Your data may be processed outside your country. Our cloud/analytics data is hosted with
Supabase in Singapore (ap-southeast-1); RevenueCat and Google
AdMob (only if you buy something or ads are shown) process data on US-based
infrastructure. Where a transfer requires it (e.g., from the EU/UK), we and our providers
rely on appropriate safeguards such as the Standard Contractual Clauses. Each provider's
own policy (§4) describes its transfer mechanisms.
We use industry-standard measures (encrypted transport, Supabase Row-Level Security so users can access only their own data, server-side validation of purchases). No system is perfectly secure, but purchased entitlements and coins are server-authoritative to limit abuse.
We will update this policy as the app evolves and post the new effective date here; material changes will be surfaced in-app.
Questions or requests: sarach.northbear@gmail.com — Sarach Sriklab, Bangkok 10400, Thailand. Thailand users may also lodge a complaint with the PDPC; EU/UK users with their local supervisory authority.