Privacy Policy

1. Who We Are

Tutor Chat is operated by Mike Fang as an individual, with operations in China and Australia. In this policy, “we” refers to that operator, who is responsible for personal information handled within this service; Tutor Chat is the product name.

Tutor Chat provides language learning, AI tutoring, vocabulary context, grammar explanations, English exam practice, writing, speaking, text summaries, and related membership services across Web, iOS, macOS, and Android.

Privacy requests can be sent to xmf29202589@gmail.com. General support requests can be sent to 931284272@qq.com.

2. Data We Collect

• Account data: nickname, email, password hash when a password is set, login state, role, language, theme, and security tokens.
• Verification and security data: email codes, password-recovery records, stable account identifiers and verified email supplied by Google or Apple, Passkey public keys and device labels, login time, session cookies, CSRF cookies, IP address, approximate country inferred from IP, device context, and basic logs. We do not receive a Google or Apple account password.
• Learning data: study records, questions, answers, accuracy, chat messages, AI feedback, review history, word lists, grammar points, writing submissions, and text summaries.
• Speech and video data: recordings, transcripts, speech features, user-submitted video links, subtitles, term occurrences, video/book materials, and notebooks.
• Podcast data: Podcast Index search terms and directory identifiers, publisher RSS URLs and metadata, subscriptions, episode playback position, transcript candidates, learning materials, and term timestamps. Ordinary listening does not permanently copy audio to our servers.
• Membership and payment data: products, plans, customer/transaction/subscription identifiers, amounts, currency, status, purchase/expiry/revocation dates, and validation results for Stripe, Z-Pay, Google Play, Apple in-app purchases, or manual activation. Card and payment credentials are handled by the applicable payment platform and do not pass through or remain on our servers.
• Bring Your Own Key (BYOK) data: API provider, connection label, model identifier, service URL, verification status, capability information, and the encrypted API key. We do not return the complete key to a client after it is saved.
• Legal confirmation and content-report data: accepted terms and privacy versions, document digest, confirmation time, platform, and related security records; the category, note, processing status, and content snapshot in AI content reports you submit.

3. How We Use Data

We determine a lawful basis under applicable law, such as your consent, processing necessary to enter into or perform a contract with you, compliance with legal obligations, or another permitted basis. Where optional processing, sensitive information, disclosure to an independent recipient, or an overseas transfer requires consent, we must provide the required notice and obtain that consent before processing, including separate consent where required. Reading this policy, registering an account, or accepting the terms does not itself authorize every optional use of data.

You may choose not to use optional speech, media transcription, or BYOK features. A feature cannot complete its task without the data it needs; declining unrelated processing does not prevent access to basic services. Please avoid submitting identity documents, financial account details, health information, or another person's sensitive information unrelated to a learning task.

• Create and protect accounts, restore sessions, prevent abuse, block unauthorized access, and assist initial interface-language selection.
• Generate learning content, AI explanations, personalized review, speaking/writing feedback, and progress tracking.
• Process membership access, subscription status, payment confirmation, support, and administrator actions.
• Maintain product reliability, diagnose errors, improve learning workflows, and comply with legal obligations.

4. AI and Third-Party Services

When you choose Google or Apple sign-in, that provider sends us a signed identity credential, a stable account identifier, and any verified email or name you authorize it to share. We do not store Google access or refresh tokens. An Apple authorization credential is encrypted server-side only so authorization can be revoked when you unlink or delete the account. Your device or credential provider keeps each Passkey private key; we store only the public key and non-sensitive device information needed for verification.

System AI learning services send the prompts, chat and learning content, text to speak, or audio to transcribe needed for a task to the configured AI or speech provider, such as OpenAI, DeepSeek, Qwen/Tongyi, or Alibaba Cloud. The BYOK catalog may also include GLM, Gemini, Kimi, MiniMax, MiMo, Tencent, and custom OpenAI-compatible services. A catalog entry does not mean every request goes to every provider. BYOK settings show your selected provider, service URL, and available region; contact the privacy email for details of current system providers and processing arrangements.

Stripe, Z-Pay, Google Play, or Apple App Store receives the order, transaction-verification, and settlement data needed for your chosen payment channel. Email, hosting, and database services handle verification messages or service storage. Podcast searches send the query to Podcast Index; show, episode, artwork, audio, and official transcript data come from publisher RSS feeds or external hosts linked by those feeds. When you connect to an external website, player, or audio host, it may also receive your IP address, device information, and its own cookies.

Podcast playback normally connects to the publisher audio URL and may use our controlled proxy after a direct playback failure. We download and submit podcast audio to a configured transcription provider only after you request learning material and confirm any required ASR quota. Section 6 explains temporary processing-audio cleanup.

YouTube browsing and playback use the YouTube website and official embedded player. We attempt to create learning material only after you tap Enter Vocabulary Context Room. If ASR has been approved and enabled, temporary audio needed for processing is isolated and enters cleanup after processing finishes and tasks no longer reference it.

Standalone speaking analysis processes recordings server-side to create transcripts and fluency, rhythm, and prosody metrics; expression-clarity feedback may send the transcript to the currently configured AI provider. Context speaking practice sends the recording directly to Alibaba Cloud's Aliyun speech-evaluation service. Both results are learning feedback, not official exam scores.

When you select your own AI service, we decrypt the corresponding key on the server only for that request and send the data needed for the task to your selected API provider: LLM requests may include prompts, chat content, and related learning data; TTS requests include text to speak; ASR requests include the recording or media audio you selected for transcription. That provider processes data and bills usage under its own terms, privacy policy, account settings, and the region you selected. You choose the operator behind a custom service URL; check its identity, processing locations, and data rules before use.

BYOK can configure LLM, TTS, and ASR separately according to the service catalog; one provider key does not imply that every capability is available. Speech evaluation remains system-only, and voice cloning, voice design, and user voice-sample uploads are not offered.

We do not sell personal data. For processors acting on our instructions, applicable law requires appropriate limits on purpose and scope, confidentiality, and security. Sign-in, payment, media, or BYOK providers you use may instead process information independently under their own policies; not every third party acts solely on our instructions.

Provider retention, model or product improvement, human safety review, and opt-out options depend on the service, free or paid tier, account settings, and contract. For example, Gemini API classifies unpaid and paid services according to active billing-account linkage and applicable regional rules, rather than simply whether a particular call incurs a charge. Unpaid services may use inputs and outputs to improve models and allow human review; the provider instructs users not to submit personal, sensitive, or confidential information to those services. Paid services may still retain safety and compliance logs. We do not make a universal promise of no training or zero retention for third parties. Read your selected provider's data terms before enabling it and do not submit sensitive data to services unsuitable for handling it.

This policy describes processing and does not replace legally required notices and permissions for a specific feature. Sharing personal data with third-party AI, or changing a recipient, purpose, or scope where renewed consent is required, must be preceded by the required notice and authorization. You can stop using the feature and contact us under Section 7.

5. Cookies and Local Storage

The Web product uses login cookies, refresh cookies, CSRF cookies, a restricted legal-session cookie, interface language cookies, and local storage for language and theme preferences. These are used for login, security, legal confirmation, and interface preferences, not for sale or cross-site advertising.

The YouTube page in the iOS App uses persistent cookies in the system WKWebView so you may sign in to YouTube and keep that session across pages and launches. Tutor Chat does not read, export, upload, or store your Google username, password, credentials, or cookie contents. You can clear YouTube/Google website data from the App's YouTube page.

6. Retention

We keep personal information for the shortest period necessary for the purposes in this policy. Account and account-owned learning records are generally retained for ongoing learning, synchronization, and review, and deleted under applicable rules when you delete the record or account or the purpose ends. Transaction, tax, security, dispute, and legal-confirmation records are retained only as needed for applicable law, platform obligations, verification, or disputes, and are not used to continue personalized learning.

AI content reports you submit retain a category, optional note, and a content snapshot of up to 4,000 characters, normally for 90 days for safety review, abuse handling, and appeals. Where law requires longer retention, only the necessary information is retained for that obligation.

Original recordings for standalone speaking analysis and context speaking practice are kept in private storage for up to 14 days by default. Transcripts, speech metrics, and feedback remain learning records until you delete the record or account, or we no longer need them. Deletion enters the object-cleanup process.

Temporary processing audio used for media transcription normally becomes eligible for cleanup 24 hours after processing tasks stop referencing it. This period begins when task references are released, not necessarily when audio was uploaded. Active tasks, remaining references, and failed-cleanup retries affect completion time. Ordinary playback and learning material you intentionally save follow the retention rules for their respective purposes.

Deleting a BYOK connection removes its stored encrypted credentials and model configuration. Non-secret event records needed for law or security audit may remain. Older sessions locked to that connection can no longer use that model.

Account deletion removes the account and account-owned data and queues related storage objects for cleanup. Data still required by law or temporarily impossible to remove individually from backups must be limited to necessary storage and security, then removed when the obligation ends or the backup rotates; backups must not restore routine use of a deleted account. Data already received by third parties follows their retention and deletion mechanisms; we assist or forward requests as required by law. De-identified information may still be personal information, so removing an account identifier is not a substitute for required deletion.

7. Your Rights

You can manage sign-in methods and sessions in Login and Devices. After signing in, you can request deletion through the account-deletion page, or email xmf29202589@gmail.com for access, correction, export, or deletion. You can email us even if you cannot sign in. If you decline updated terms, sign-out, data export, and account deletion remain available.

For email requests, provide your account email or nickname and the data scope involved. We verify only the identity information necessary to handle the request and do not ask for your password or full API key. We respond within the period required by applicable law or, where no period is specified, a reasonable time. If we cannot fulfill a request entirely, we explain the reasons and available complaint or remedy channels.

You may withdraw consent, restrict or object to processing, and exercise other rights available under applicable law. Withdrawal does not affect processing that was lawful before withdrawal. A feature dependent on that data may become unavailable; information still required by law is handled under Section 6.

Deleting an account does not mean every payment channel has cancelled renewal. The Google Play account-deletion flow queues a request to stop future subscription payments. Cancel Stripe, Apple, or other subscriptions through the purchase platform and check its confirmation. Necessary payment, refund, and dispute records may remain as required by law.

Privacy complaints can be sent to xmf29202589@gmail.com. You may also seek a remedy from a competent regulator or court under applicable law. Whether Australia's Privacy Act applies depends on business size, activities, and statutory exceptions; individual or small-business operation does not exclude obligations that actually apply.

8. Children

The service is not offered to children under 14. We currently do not provide dedicated child accounts, a parental-consent process, or special child-information rules. Anyone under 14 should not register or submit personal information. Users aged 14 to 17 need a parent's or guardian's consent and supervision and must meet any stricter age and region requirements of the selected provider. For example, Gemini API requires users to be at least 18.

If we discover information collected from a child by mistake, or a parent or guardian contacts xmf29202589@gmail.com, we verify the request and take steps such as stopping processing and deletion as required by law. Any legally permitted and necessary handling of information about a child under 14 requires appropriate special protections and parental consent first. An age statement does not replace required safeguards.

9. International Processing and Security

Operations in China and Australia do not mean all data stays in those countries. Selected AI, speech, payment, email, hosting, or media providers may process data elsewhere, depending on the service and account configuration. For example, Qwen BYOK offers China mainland Beijing and Singapore regions; a custom BYOK endpoint may have an operator in another location.

For processing legally treated as an overseas disclosure or transfer, we must disclose the actual overseas recipient, contact information, purposes, methods, data categories, and rights channels, obtain separate consent where required, and meet applicable transfer conditions, safeguards, and recipient-management obligations. Required mechanisms or exemptions depend on the actual activity; reading this policy does not replace them. Where Australia's Privacy Act applies, the corresponding overseas-disclosure duties also apply.

We use access controls, credential encryption, and security management appropriate to processing risks, but no system can guarantee absolute security. If a personal-information security incident occurs, we take remedial action and notify affected users and regulators where required by applicable law.

10. Changes

The version date and effective rules are shown above. This revision takes effect when actually published and any required notice process has been completed. Material changes are notified in advance, or promptly as required by law, through in-product notices, email, or another means reasonably reaching you. Processing requiring renewed consent begins only after that consent is obtained.

If a registered company later takes over operations, or responsibility for personal-information processing otherwise changes, we will separately identify the new legal entity, contact details, scope of the transfer, and your rights, and meet applicable notice and consent requirements.

You can request the historical text corresponding to a confirmation version through the privacy contact email.