Privacy Policy

Last updated 14 October 2026 (payments and Stripe; what is kept in your library; limits you reach; menus and questions sent to Anthropic; deleting your account)

Scan Chinese (“we”, “the service”) is a tool for reading and learning Chinese, operated at scanchinese.com. This policy describes what we collect, why, who else sees it, and how to get rid of it. It describes what the software actually does.

The short version

• You can use the service without an account, for a limited number of uses.
• We use Google Analytics to count visits, asking first in the UK and EU. No advertising, and no tracking pixels.
• We do not sell or rent personal data, ever.
• What you scan, draw or type is sent to Google for recognition and translation. Questions you ask the tutor, and menus you ask to have read, go to Anthropic.
• Paid plans are paid through Stripe. Your card details go to Stripe and never reach us.
• You can export everything we hold, and delete your account yourself.

What we collect

If you do not have an account

We count how many times each visitor has used the paid recognition and translation features, so we can offer a free trial. That counter is stored against a salted one-way hash of your IP address. The address itself is never written down, and the hash cannot be reversed into it. Counters older than 30 days are discarded.

Our web server (nginx) keeps ordinary access logs, which include IP addresses, for operational and security purposes.

If you create an account

• Email address. To identify you and to send password resets; and, only if you ask for it, a weekly email listing the words you looked up that week.
• Password. Stored only as a scrypt hash. We cannot read it.
• Display name, if you give one.
• Your library. What you look up while signed in, kept automatically so you can review it: your translations, the characters you pick from a drawing, and the encyclopedia pages you open. Also what you save yourself, the folders you file it in, your notes, and your progress markers. Remove any of it with one tap; a page or drawn character you removed is not added back unless you save it again.
• The pictures behind your cards. When a card comes from a photograph or a drawing, that image is stored so you can look back at it. It is resized and re-compressed on arrival, kept on our own server, and never sent anywhere else or shown to anyone but you. Deleting your account deletes all of them. Each account has a storage allowance.
• Activity history. A record of each recognition, translation and save, so the service can show you what you have studied.
• Limits you reach. When an allowance on your plan runs out: which one, when, how many times you were turned away, and whether you then opened the upgrade offer or a checkout. Used only to tell which limits are set wrongly. Deleted with your account.
• Where you signed up from. The IP address and browser of the account's first request, and an approximate country worked out from that address. The country is looked up against a database on our own server, so your address is not sent anywhere to resolve it. This is used to review access requests.
• Session records. For each sign-in, the IP address, browser user agent and timestamps, so you and we can tell whether an account is being misused. Sessions expire after 30 days.

Session cookies and password-reset links are stored only as hashes, so a copy of our database would not let anyone sign in as you.

If you dictate with the Speak button

The recording is sent to Google to be transcribed and is not kept by us. Only the resulting text, and only if you are signed in, as part of your activity history. Your microphone is released the moment recording stops. Transcripts are cached against a hash of the audio so that repeating a recording costs nothing; the audio itself is not stored.

Sharing a card

You can turn any saved card into a link that anybody can open. Nothing is shared unless you ask for it, one card at a time.

• What a shared link shows. The Chinese, the Pinyin, the Cantonese Yale, the English, and the photo or drawing the card came from. Anyone with the link can also play the audio.
• What it does not show. Your notes, your progress markers, your folders, your email address, or anything else identifying you. Sharing a translation does not share your account.
• The link is the permission. There is no password on it, so treat it like any other address you hand out: whoever has it can open it, and can pass it on.
• Turning it off. Press Shared again in your library and the link stops working immediately. Sharing the same card later creates a different link, so the one you already sent stays dead.
• Search engines. Shared cards are excluded in robots.txt and marked noindex. That stops the engines that respect it; it cannot stop somebody you sent the link to from publishing it.
• Deleting the card also ends the link.

Payments

Paying is optional; the free plan needs no card. If you take a paid plan or a trial, the payment is handled by Stripe (stripe.com), on Stripe's own checkout and billing pages rather than ours.

• Your card never reaches us. The card number, expiry date, security code and billing details you enter go straight to Stripe. We never see or store them, and could not show them to anyone.
• What we send Stripe. When you first open a checkout: your email address, your display name if you gave one, and your account number, so a payment can be matched to your account. With each checkout, the plan you chose.
• What we keep. Stripe's reference numbers for you and your subscription; the plan, whether it is monthly or yearly, its status (on trial, active, payment overdue, cancelled), when the current period ends and whether it is set to end there. For a Professional plan, the team and how many seats it is paid for. We also keep a log of the notices Stripe sends us: what happened and when (for example, a subscription becoming active). It holds no card or bank details.
• What Stripe keeps. Your payment details, payments, invoices and receipts, and any discount code you used. Stripe uses them to take payments and to prevent fraud. Stripe sells the subscription to you as merchant of record (its Managed Payments service), so it holds that information under its own privacy policy, and may process them outside the UK and EU, including in the United States.
• Trials. A trial takes a card up front and charges nothing until it ends. There is one trial per person: an account that has had a subscription before, according to our own records, starts paying from the first day.
• Managing it. Changing your card, cancelling, and downloading invoices happen on Stripe's billing page, reached from your account. Team seats are changed in your account under Team, and the plan itself on the plans page.
• Team members. Nobody's details but the paying account holder's are sent to Stripe. People invited to a team are not.

Cookies and local storage

We use two cookies, both set only when you sign in and both gone when you sign out. sc_session keeps you signed in; it is HttpOnly, SameSite=Lax and expires after 30 days. sc_auth holds nothing but the value 1 and expires with it; it lets a page lay itself out for somebody signed in before it has finished loading, instead of rearranging itself a moment later. Neither is used for tracking.

We also use Google Analytics to see how many people visit and which parts of the site help them. It sets its own cookies (_ga and _ga_K2T6MV0GR0, kept for up to two years) and sends Google the page you are on (without anything after the ? in its address), your browser and device, and roughly where you are. It is never used for advertising, and it never runs on pages whose address is private: password resets, email confirmations, shared cards and shared answers.

If your device is set to a European time zone (the UK and the EU), we ask first: until you choose Allow, no analytics cookie is set and Google receives only anonymous, cookieless counts. Elsewhere it runs without asking. Either way you can change your choice here, at any time.

Your browser also keeps some things locally, which never leave your device: your light/dark theme choice, recent translations and character meanings (so the app is faster and works offline), the ingredients you chose to leave out when reading a menu, and, if you install the app, the recognition models. Clearing your browser storage removes all of it.

Who else sees your data

To do its job, the service sends some content to other companies:

We have no other processors. Google Analytics is the only analytics provider; there is no advertising network and no third-party session recording. Handwriting recognition and the neural model run in your browser and send nothing anywhere.

How long we keep things

• Your account and library. Until you delete them.
• Items you delete. Hidden from your account straight away, but kept on our side. We use them to work out why a recognition or a translation went wrong, to test changes against real examples, and to improve the service. They are never shown to other users and are not sold or shared. If you want them gone for good rather than merely hidden, use /api/account/erase, or write to us. See Your choices below.
• Free-trial counters. Kept for the life of the account, because the trial is a one-off allowance rather than a monthly one.
• Sessions. 30 days, or until you sign out.
• Payment records. Your subscription details for as long as you have the account. Deleting the account ends the subscription and deletes your customer record at Stripe; our log of Stripe's notices is kept but no longer says whose account it was. Stripe keeps its record of payments already made for as long as tax and anti-fraud law require.
• Password reset links. One hour, and one use.
• Recognition and translation results. Cached indefinitely so the same lookup is not paid for twice. These caches are keyed by the text or by a hash of the image, and are not linked to any account.

Your choices

• Export. Signed in, request /api/auth/export to download everything we hold about you as JSON.
• Delete individual items. Remove anything from your library at any time. It disappears from your account immediately; we keep a copy for the reasons set out above.
• Erase deleted items. Signed in, request /api/account/erase, or write to us and we will do it for you. This permanently removes everything you have already deleted, including the copies we kept, and cannot be undone.
• Delete your account. In your account, under Delete account. This erases your account, library, folders, notes, pictures, activity history and sessions immediately and permanently, and ends a paid subscription at the same moment. We keep no copy, though a routine backup may retain it for up to 30 days. Records of past payments stay with our payment processor, as the law requires.
• The weekly email. Off unless you switch it on, in your account under Your details. Every one has a link that stops it in one click, without signing in.
• Use it signed out. Nothing is stored against you at all.

If you are in the UK or EU, the GDPR gives you rights of access, rectification, erasure, restriction, portability and objection. The export and delete features above cover most of these directly; for anything else, write to us.

Security

The site is served over HTTPS. Passwords are hashed with scrypt; session and reset tokens are stored as SHA-256 hashes. The database accepts connections only from the machine itself. No system is perfectly secure, and we do not claim otherwise; but if you find a problem, please tell us before telling anyone else.

Children

The service is not directed at children under 13, and we do not knowingly collect their personal data. If you believe a child has given us data, contact us and we will delete it.

Changes

If this policy changes materially, the date at the top will change and, where the change affects you, we will say so in the app.

Contact

Questions, requests or complaints: privacy@scanchinese.com.