Privacy Policy

1. Scope and operator

This policy covers account, learning, teaching, community, communication and related services on the iChinese website and companion mobile and desktop apps. The operator is the Center for Language Education and Cooperation, Ministry of Education (referred to as “we”). Institutions, teachers and third-party apps providing independent services may have their own privacy rules. Please read those too. Notices and separate permissions for specific features supplement this policy.

2. Information we collect

Account and profile: the phone number or email needed to register or sign in, verification results, and the nickname, photo, country or region of residence, nationality, native language, birth year, learning level and interests you provide. Third-party sign-in supplies identifiers and profile information within your authorization. Learning and interaction: enrolment, progress, assignments, answers, results, vocabulary, practice recordings and AI conversations generated when you use features, as well as posts, comments, messages, cloud documents and files you choose to publish or send. Business and security: reservations, orders, payment status, delivery or application materials, verification documents, feedback and screenshots as needed, plus IP addresses, device and browser information, versions, access times and necessary operational logs. Collection depends on the feature; browsing public content does not require a complete profile.

3. Purposes and legal grounds

We use necessary information to create and protect accounts, deliver learning, teaching and communication services, fulfil enrolments and orders, handle verification and feedback, prevent abuse and meet applicable legal obligations. Personalized recommendations use your selected interests and browsing and interaction records. You can turn them off and clear the related profile and records in privacy settings. Depending on applicable law, processing relies on providing a service you request, legal obligations, your consent or another lawful basis. Where consent is required, we explain the processing and ask separately. Changes to purposes or information categories require renewed notice and any legally required authorization.

4. Cookies, local storage and device permissions

The website uses necessary cookies and local storage to maintain sign-in, perform security checks and remember language, appearance and other preferences. Apps also retain necessary sessions and settings. You can clear or restrict storage through your browser or device; some features may then require signing in or setting preferences again. Microphone, camera, photo, file, location and notification permissions are requested when relevant features need them. You can disable permissions in device settings. Refusing a permission affects the corresponding feature without affecting unrelated features.

5. Sensitive information and AI features

Voice, video, identity documents, face verification information, payment-related information and minors’ personal information may be sensitive. We process them only where needed for classes, speaking practice, teacher verification, exam identity checks or related activities, explain the purpose, necessity and impact in the relevant flow, and obtain separate or guardian consent where required. AI conversation, voice, translation and teaching preparation features send your submitted text, voice, files and necessary context to the corresponding model service. Avoid submitting unrelated identity numbers, contact details or other people’s private information. Any separate collection of recordings for model training or research requires its own explanation and legally required consent.

6. Recipients, public information and third-party services

To deliver services you choose, necessary information is provided to teachers, your institution, communication recipients and providers of cloud storage, verification messages, audio and video, content safety, maps, AI and enabled payment services. We require processors to follow agreed purposes and security requirements. Disclosures to independent controllers follow applicable notice and consent requirements. Public profiles, posts and comments can be accessed by others, and public content may be displayed across regions. Third-party apps receive information within their permissions, which you can manage or revoke under authorized apps. Institution heads, administrators and feedback staff may be in other locations; see the data processing details.

7. Storage locations and international processing

Accounts are assigned a home location based on residence. Profiles, learning records and similar personal information are generally stored in the corresponding location, with services covering Beijing, Frankfurt, Singapore, Virginia and Riyadh. The global sign-in directory retains only identifier hashes, account identifiers and home-location mappings needed to locate accounts. Cross-location bookings, communication, collaboration and institution services may require necessary information to reach the recipient’s location. NetEase Yunxin processes classroom audio and video in Singapore; NetEase Yidun processes relevant content safety checks in mainland China; Baidu Maps receives IP addresses and general device information when maps load; AI web search sends search terms to a service in China. Under the regional plan, Riyadh’s AI processing takes place in Frankfurt. We explain recipients, information and purposes in the relevant flow, meet applicable transfer requirements and obtain separate consent where legally required. During testing, temporary model configuration may process AI text, voice and other submissions from overseas locations in mainland China. This configuration is for testing only and must switch to the regional plan before public launch. Reading a general privacy policy is not authorization for that processing.

8. Retention and deletion

We keep personal information for the shortest period needed for its purpose, unless law requires longer retention. Browsing and interaction records used for recommendations cover the most recent 90 days. Other information is retained as needed for account services, courses, transactions, security and legal requirements. Where a feature specifies a period, its notice applies. Account deletion has a 15-day cooling-off period; signing in during it cancels the request. Once deletion completes, profile information, learning records, practice recordings, feedback and similar data are cleared through the account deletion process. Posts, comments and reviews remain with the author shown as “Deleted user”; results that institutions must retain are kept without your identity. Delete public content you do not want retained before exporting data and deleting your account. Information that must legally be retained or cannot yet technically be deleted is restricted to storage and necessary security protection.

9. Your choices and privacy rights

You can view and edit your profile, manage direct messages, public lists, recommendations, processing consent and app permissions, export personal data and request account deletion. Withdrawing consent does not affect earlier consent-based processing, but the related feature may no longer be available. The account actions below require sign-in. Use the phone number in this policy or Feedback and suggestions to request access, copies, correction, deletion or an explanation of processing, and exercise any applicable rights to restriction, objection or portability. We perform necessary identity checks and respond with an explanation within the applicable legal deadline. You may also complain to the competent data protection authority.

• View and edit your profile
• Manage privacy and permissions
• Export personal data
• Delete your account
• Feedback and suggestions

10. Protecting minors

We use birth year and necessary identity verification to identify applicable protections for minors and restrict some communication and transaction features. For services involving personal information of children under 14 in China, a guardian must read the relevant notices and provide legally required consent. Local age requirements apply elsewhere. Guardians can request access, correction or deletion through the contact details below. If we discover that children’s information was collected without required guardian consent, we investigate and address it as required by law. Do not disclose children’s real names, contact details, schools, identity documents or other unnecessary information in public content.

11. Security and incident response

We use encrypted transport, access controls, regional isolation, access auditing and necessary backups to protect information and limit staff access. Cross-location access follows business permissions and is logged. Operational logs mask IP addresses and account identifiers by default; viewing original entries requires a reason and an audit record. If personal information is or may be leaked, altered or lost, we take prompt remedial action and report to authorities and notify affected individuals as applicable law requires. Protect your verification codes and signed-in devices, and contact us if you notice unusual activity.

12. Policy updates

We publish the version and effective date on this page. For material changes to purposes, information categories, recipients or your rights, we notify you through an on-page notice or another appropriate channel and seek renewed consent where legally required. This page remains marked as a draft until formal publication.

13. Contact us

Personal information controller: Center for Language Education and Cooperation, Ministry of Education. For questions about this policy or to exercise your rights, call the number below or sign in and submit a privacy request through Feedback and suggestions. Describe the feature and your request. Do not include passwords, verification codes or unrelated identity documents in feedback.