Chính sách quyền riêng tư

Privacy policy (English)

Effective date: 23/10/2026.

Scope and sign-in

HSK1 Tiếng Trung is developed by nishishei.vn. Responsible owner/entity: nishishei.vn. This policy covers the learning website nishishei.vn/hoc and the HSK1 Tiếng Trung Android app, including OTA and Google Play builds.

Google sign-in through Firebase Authentication is required when entering nishishei.vn/hoc and on the first opening of the Android app. It provides account management, cloud storage, restoration and synchronization across devices. After signing in, the Android app supports offline study with learning content and progress available on the device; sign-in and synchronization require a network connection. On the web, signing in to an account with no cloud data automatically uploads local progress. When the owner of existing progress needs to be established, the interface asks you to merge progress or use the account’s progress before uploading.

Data processed

When you sign in, account information processed includes your Firebase user ID (UID), Google account identifier, display name, email address and profile photo URL, if supplied by Google. The web uses your name, email and photo URL to display your account; identifiers link progress to the correct account.

Three groups of data are stored in Cloud Firestore under your account (users/{uid}/):

• Web progress (learning/state): completed lessons, bookmarks, unfinished study sessions, practice/exam answers and results, review schedules, study activity days and study/review counts, display preferences such as light/dark theme and text size, timestamps, data versions and migration information used to restore and merge progress. The local operations log is not uploaded; that field is empty in the uploaded state.
• Shared app/web progress (learning/app-progress): known/not-known word states with timestamps, installation IDs and operation IDs; days reaching ten cards; best quiz and exam scores; and surviving legacy exam answer selections and submission status. Legacy answers have no timestamps when none existed in the original data. This is more than aggregate statistics.
• Saved dictionary (learning/dictionary-saved): dictionary entries you have saved, synchronized with your account.

The installation ID (deviceId) in known-word progress is a randomly generated identifier stored for the installation and used to distinguish and merge changes across devices. It is not a hardware identifier, IMEI or Android ID. It is uploaded in app-progress and linked to your account; it is not used for advertising or behavioral analytics. App-data backup and restoration may preserve it.

Firebase/Google and storage location

Google provides Firebase Authentication to process sign-in and Cloud Firestore to store and synchronize data for the service in project nishishei-d6c12. The Firestore database is located in asia-southeast1 (Singapore). This location does not mean all Firebase Authentication data or all Google processing occurs in Singapore. Account and synchronization connections use Google/Firebase HTTPS/TLS transport encryption.

Local data and Android backup

Progress, settings and widget data retain local copies on the device; the web stores progress in the browser. On Android, signing out keeps local progress and does not delete cloud data. On the web, signing out clears account progress, saved dictionary entries and settings included in account progress from the browser session; device preferences stored in this browser (light/dark/system theme, font size, reduced motion, sound effects, speech rate, learning-path view and daily goal) are retained, and cloud data is not deleted. Uninstalling the app removes its local data but does not delete cloud data. With Android allowBackup=true, the operating system may back up app data to your own Google account if device backup is enabled and may restore it later. Android backup is separate from Firebase synchronization.

Data retention

Account information and cloud data are stored to maintain your account and synchronization while the account exists. Account data and synchronized progress are deleted when you complete account deletion in the app or on the web, or within 30 days of receiving an email deletion request. Firebase/Google may retain encrypted system backups for a limited period under Google’s own policy.

Delete your account on the web or in the app

You can delete your account while online:

• Web: in Tài khoản và đồng bộ (Account and synchronization), choose Xoá tài khoản và dữ liệu trên mây (Delete account and cloud data), then confirm in the browser dialog.
• Android: open the information button → Tài khoản → Xoá tài khoản → Tiếp tục → Xoá vĩnh viễn (Account → Delete account → Continue → Delete permanently).

You may need to reauthenticate with the same Google account. This stops synchronization in the session performing deletion, deletes all three documents learning/state, learning/app-progress and learning/dictionary-saved under your UID in sequence, then deletes the service’s Firebase Authentication account. If a step fails, deletion may be partial; retry (the app offers Xoá tiếp, meaning Continue deletion, for a pending request). This does not delete your Google account.

Firestore and Firebase Authentication deletion are not one transaction. Sessions on other devices may remain valid for about one hour and write data again during that period; the current version has no server mechanism to block or automatically clean up recreated data. Simultaneous deletion of every copy on every device is therefore not guaranteed. Sign out on other devices before deleting.

On Android, deleting the account does not remove local progress, saved dictionary entries, settings, operation logs or saved progress copies on the device, or Android backups. On the web, completing account deletion clears account progress, saved dictionary entries and settings included in account progress from the browser session; device preferences stored in this browser (light/dark/system theme, font size, reduced motion, sound effects, speech rate, learning-path view and daily goal) are retained. You can remove local data through the operating system’s app settings or the browser’s site-data settings.

Request deletion by email

To request account deletion outside the app, email info.upsoftware@gmail.com with the subject Xoá tài khoản Nǐ shì shéi, sent from the Google account to be removed from the service; sending from that account is used to verify ownership. Requests are processed within 30 days of receiving the email.

Features and permissions

Android text-to-speech uses the speech engine installed on the phone. Account features use the network for sign-in and synchronization on the web and both Android builds. The Google Play build has the INTERNET permission; the Firebase SDK adds com.google.android.providers.gsf.permission.READ_GSERVICES through manifest merging. This permission does not by itself mean that the app collects hardware identifiers or uses advertising. The app has no advertising, behavioral analytics or crash reporting.

Chrome extension “Nǐ shì shéi – Từ trôi”

The Chrome extension “Nǐ shì shéi – Từ trôi” uses your Nǐ shì shéi account to display approved HSK 1 words on suitable web pages and prioritize words based on your learning progress. When you click Connect on the confirmation page, the extension receives and stores your UID, email, and Firebase refresh token in the extension’s local storage; the ID token is stored in session storage. Your email appears only in the extension’s popup so you can identify the account. Tokens are used with Google/Firebase to refresh the session and with nishishei.vn to read your own progress; the extension does not modify your progress. The extension stores groups of word IDs for word selection and the IDs of recently displayed words to reduce repetition, but does not store the original progress documents. To hide text on sensitive pages, the extension checks the domain, path, visibility state, and metadata/layout of password, card number, or OTP fields within the browser; it does not read article text, cookies, or form values, record browsing history, or track clicks, scrolling, or keystrokes. The current page’s domain is passed internally for the per-site disable button. Settings, pause state, and domains you explicitly disable are stored through Chrome storage sync and may be synced by Chrome according to your settings; tokens and email are not stored through this sync mechanism. Fonts and executable code are bundled with the extension; the extension does not download remote executable code. You can pause or sign out in the popup; signing out deletes the extension’s authentication information, word cache, and session data, while settings and the list of disabled sites are retained. Data is not sold, used for unrelated purposes, or used to assess creditworthiness or for lending.

Data rights and contact

Personal data is processed in accordance with applicable Vietnamese law, including Decree 13/2023/NĐ-CP on personal data protection, and you can request access, correction or deletion by emailing info.upsoftware@gmail.com.

General contact: info.upsoftware@gmail.com