Privacy Policy

Last updated: July 3, 2026

Tuji is provided by Hong Kuok Wai. This Privacy Policy explains how we collect, use, disclose, store, and protect information when you use the Tuji mobile app, website, APIs, and related services (together, the "Service").

If you do not agree with this Privacy Policy, please do not use the Service.

Contact: nexflow0632@gmail.com

1. Information We Collect

We collect information that you provide directly, information generated by your use of the Service, and limited technical information needed to operate, secure, and improve the Service.

1.1 Account Information

When you create or use an account, we may collect:

• Email address.
• Username.
• Display name or nickname.
• Avatar choice.
• Authentication identifiers from email login, Apple Sign-In, or Google Sign-In.
• Account creation date and related account status information.

Authentication is handled through Supabase and supported identity providers such as Apple and Google.

1.2 Learning and App Data

To provide Tuji's language-learning features, we collect and store learning-related data, including:

• Saved or favorited words.
• Learned words.
• Study settings, such as learning direction, interface language, daily goal, font size, accent, decks, and categories.
• Study history, review state, spaced-repetition scheduling, answer ratings, correctness, response time, mastery scores, streaks, and progress.
• Issue reports you submit about learning content, including your description, selected answer, platform, app version, language setting, and a snapshot of the learning card or question.

1.3 Atlas Images and User Content

If you use Tuji's Atlas or custom picture dictionary features, we may collect:

• Images you upload.
• Generated thumbnails and recognition copies.
• Image metadata such as file type, size, dimensions, and hashes.
• AI recognition jobs, candidate labels, confidence scores, AI provider responses, and model information.
• Your corrections, custom vocabulary items, generated cards, study progress for those cards, and related notes.
• Public or shared Atlas items if you choose to publish or share them.
• Reports submitted by users about public Atlas items.

Atlas images are private by default unless you choose to publish, share, or make them public.

1.4 Payment and Subscription Information

Tuji Pro subscriptions are processed by Apple through the App Store. We do not receive or store your full payment card number.

We may store:

• Subscription tier.
• Subscription source.
• Expiration date.
• App Store transaction identifiers, including original transaction identifiers.
• Purchase, renewal, refund, expiration, or subscription status information received from Apple.

1.5 Push Notification Information

If you enable push notifications, we may collect:

• Apple Push Notification service (APNs) token.
• A per-install device identifier generated by Tuji.
• Platform, such as iOS.
• Notification permission status.

We use this information to send and manage notifications and to stop notifications when you sign out or delete your account.

1.6 Technical, Usage, and Diagnostic Information

We may collect limited technical and usage information, including:

• IP address hash.
• Local session identifier.
• Server logs.
• Browser or app request information.
• Device, app version, build number, and platform information.
• Crash data and diagnostic data.
• Non-personalized product events, such as page views, favorites, or pronunciation actions.

Tuji uses Firebase Crashlytics for crash reporting. We configure crash reporting to avoid intentionally sending email addresses, user IDs, uploaded images, learning content, search text, access tokens, or other sensitive content. However, diagnostic reports may include technical information necessary to diagnose crashes and improve app stability.

1.7 Cookies and Local Storage

The Service may use cookies, local storage, and similar technologies to:

• Keep you signed in.
• Refresh authentication sessions.
• Store app preferences.
• Store local learning state before it is synced to your account.
• Store a local session identifier for basic product events.

You may clear cookies or local storage through your browser or device settings. Clearing them may sign you out or remove local-only settings or progress that has not been synced.

2. How We Use Information

We use information to:

• Create, authenticate, and manage accounts.
• Provide learning, study, progress, favorites, settings, and Atlas features.
• Sync data across devices.
• Process subscriptions and provide paid features.
• Send push notifications if you enable them.
• Provide AI image recognition and vocabulary suggestions.
• Respond to support requests and issue reports.
• Detect, prevent, and investigate abuse, fraud, security incidents, and service misuse.
• Debug, maintain, analyze, and improve the Service.
• Comply with legal obligations and enforce our terms.

3. Legal Bases for Processing

If you are located in the European Economic Area, the United Kingdom, or another region that requires a legal basis for processing personal information, we process personal information based on one or more of the following legal bases:

• Performance of a contract, such as providing the Service, account features, learning progress, subscriptions, and requested features.
• Consent, such as when you enable push notifications, use certain optional features, or where consent is required for advertising or cookies.
• Legitimate interests, such as improving the Service, maintaining security, preventing abuse, debugging, and understanding basic product usage.
• Compliance with legal obligations, such as tax, accounting, consumer protection, billing, and regulatory requirements.
• Protection of rights, safety, and security, including investigating fraud, misuse, or security incidents.

Where processing is based on consent, you may withdraw your consent where applicable. Withdrawing consent does not affect processing that occurred before the withdrawal.

4. AI Image Recognition

When you use Atlas image recognition, your uploaded image or a processed copy of it may be sent to third-party AI or vision providers, such as Google Cloud Vision or OpenAI, to identify objects and generate vocabulary suggestions.

Text labels, translations, vocabulary suggestions, and related content may be processed by translation or AI providers such as Google Translate or OpenAI.

You should not upload images that contain:

• Sensitive personal information.
• Private documents.
• Payment cards, government IDs, medical records, or passwords.
• People who have not consented to the upload.
• Content that you do not have the right to upload.

AI results may be inaccurate. You are responsible for reviewing and correcting AI-generated suggestions before relying on them or publishing them.

5. Advertising

Tuji may show rewarded ads through Google AdMob. The app is configured to request non-personalized ads.

Even when non-personalized ads are requested, Google AdMob may still process limited device, advertising, network, and diagnostic information to deliver ads, measure performance, prevent fraud, and comply with legal obligations.

We do not intentionally use advertising data to track you across apps or websites owned by other companies.

Depending on your region, Google or Tuji may request consent for cookies, local storage, advertising identifiers, or personal data use where required by law.

6. How We Share Information

We do not sell your personal information.

We may share information with the following categories of recipients:

• Service providers that host, store, process, secure, monitor, or support the Service.
• Authentication providers, such as Apple, Google, and Supabase.
• Cloud and database providers, such as Supabase and Vercel.
• AI and vision providers, such as OpenAI and Google Cloud Vision, when you use AI recognition features.
• Translation providers, such as Google Translate, when translation features are used.
• Payment and subscription processors, such as Apple.
• Crash reporting and diagnostics providers, such as Firebase Crashlytics.
• Advertising providers, such as Google AdMob, for rewarded ads.
• Law enforcement, regulators, courts, or other parties when required by law or necessary to protect rights, safety, and security.
• Other users or the public, only when you choose to publish, share, or make content public.

We may also share aggregated or de-identified information that cannot reasonably be used to identify you.

7. Public and Shared Content

Some Atlas features may allow you to publish or share custom vocabulary items or images. If you choose to publish or share content:

• The shared content may be visible to other users or the public.
• Public content may include the image or thumbnail, vocabulary labels, translations, category information, and related learning content.
• Other users may report public content.
• We may review, remove, reject, or restrict public content for safety, legal, copyright, spam, abuse, or moderation reasons.

Do not publish content that is private, copyrighted without permission, illegal, harmful, misleading, or violates another person's rights.

8. Data Retention

We retain information for as long as reasonably necessary to provide the Service, maintain accounts, support learning features, comply with legal obligations, resolve disputes, enforce agreements, and protect the Service.

In general:

• Account information is retained while your account exists.
• Learning progress and settings are retained while your account exists or until you delete or clear them.
• Uploaded Atlas images and related private content are retained while your account exists or until deleted.
• Public content may remain available until unpublished, removed, or deleted.
• Payment and subscription records may be retained as needed for billing, audit, fraud prevention, and legal compliance.
• Crash, diagnostic, event, and log data may be retained for a limited period for security, debugging, and product improvement.
• Aggregated or de-identified information may be retained longer.

Deleted data may remain in encrypted backups for a limited period before being overwritten or deleted according to our backup retention practices.

9. Account Deletion

You may delete your account from within the app where the feature is available, or by contacting us at nexflow0632@gmail.com.

Deleting your account is intended to remove your account and associated app data, including profile information, learning progress, private Atlas images, settings, push tokens, and other user-linked records, except where retention is required or permitted by law, security, fraud prevention, billing, dispute resolution, or backup processes.

Some information may not be controlled by Tuji:

• App Store purchase history is managed by Apple.
• Information held by third-party providers is governed by their own policies.
• Content you made public may have been viewed, copied, cached, or stored by others before deletion.

Account deletion is generally irreversible.

10. Security

We use administrative, technical, and organizational measures designed to protect information, including access controls, authentication, row-level access rules, private storage buckets, HTTPS, and provider-side security controls.

No method of transmission or storage is completely secure. You are responsible for keeping your account credentials safe and for promptly notifying us if you believe your account has been compromised.

11. International Data Transfers

We and our service providers may process and store information in countries or regions other than where you live. These countries may have different data protection laws from your location. Where required, we rely on appropriate legal mechanisms to transfer and process information.

12. Your Choices and Rights

Depending on where you live, you may have the right to:

• Access the personal information we hold about you.
• Correct inaccurate information.
• Delete your account or personal information.
• Object to or restrict certain processing.
• Request a copy of certain information in a portable format.
• Withdraw consent where processing is based on consent.
• Appeal or complain to a data protection authority.

You can exercise these rights by using in-app settings where available or contacting nexflow0632@gmail.com. We may need to verify your identity before responding.

13. California Privacy Notice

If you are a California resident, this section provides additional information.

Categories of personal information we may collect include:

• Identifiers, such as email address, user ID, username, device ID, and transaction identifiers.
• Customer records, such as account and subscription information.
• Commercial information, such as subscription tier and purchase status.
• Internet or network activity, such as usage events, session identifiers, and server logs.
• Geolocation-related information at a limited level, such as approximate location inferred from IP address by infrastructure providers.
• Audio, electronic, visual, or similar information, such as uploaded images.
• Inferences, such as learning progress, mastery, and study preferences.
• Sensitive personal information only if you choose to upload content that contains it. You should avoid uploading sensitive content.

We use these categories for the purposes described in this Privacy Policy.

We do not sell personal information. We do not knowingly share personal information for cross-context behavioral advertising. We do not use or disclose sensitive personal information for purposes other than those permitted by applicable law.

California residents may request access, correction, deletion, and information about our data practices by contacting nexflow0632@gmail.com.

14. Children

The Service is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided personal information to us, please contact nexflow0632@gmail.com so we can take appropriate action.

If your jurisdiction requires a higher age for consent to online services, you must meet that age or use the Service with consent from a parent or legal guardian.

15. Third-Party Services

The Service may rely on third-party services, including:

• Supabase for authentication, database, storage, and backend services.
• Vercel for hosting and serverless infrastructure.
• Apple for App Store subscriptions, Sign in with Apple, and push notification infrastructure.
• Google for Google Sign-In, Google Cloud Vision, Google Translate, AdMob, and Firebase Crashlytics.
• OpenAI for AI image recognition or related AI features.

Your use of third-party services may be subject to their own terms and privacy policies.

16. Do Not Track and Global Privacy Controls

Some browsers or devices may send "Do Not Track" or similar signals. Because there is no consistent industry standard for these signals, the Service may not respond to them automatically.

Where legally required and technically supported, we will honor applicable consent choices or privacy preference signals.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The updated version will be posted with a new "Last updated" date.

If changes are material, we may provide additional notice, such as in-app notice, website notice, or email where appropriate.

If required by law, we will request your consent before applying material changes that affect how we collect, use, or share your personal information. Otherwise, your continued use of the Service after the updated Privacy Policy becomes effective means you acknowledge the updated policy.

18. Contact Us

If you have questions, requests, or complaints about this Privacy Policy or our privacy practices, contact us at:

Email: nexflow0632@gmail.com

Operator: Hong Kuok Wai