Privacy Policy

Last updated: July 7, 2026

RushMandarin ("RushMandarin," "we," "us," or "our") operates the RushMandarin web application at app.rushmandarin.com, the RushMandarin mobile app for iOS and Android, the RushMandarin browser extension, and the website at rushmandarin.com (collectively, the "Service"). This Privacy Policy explains what information we collect, how we use it, who we share it with, and the choices you have.

By using the Service, you agree to the collection and use of information in accordance with this Privacy Policy.

This Service is operated by RushMandarin LLC.

1. Information We Collect

1.1 Information you provide directly

• Account information. When you create an account, we collect your email address. You can sign in with a one-time code sent to your email, with Google, with Apple, or (for existing accounts) with an email and password. Passwords are handled by our authentication provider and stored only in securely hashed form — we never store your password in plain text. If you sign in with Google, we receive your email address, name, and profile picture from Google. If you sign in with Apple, we receive your name and email address; if you use Apple's Hide My Email, we receive a private relay address instead of your real email (see Section 3). In some flows (for example, trying the browser extension before signing up), we may create a temporary anonymous account identifier, which is linked to your account if you later sign up.
• Learning content and activity. As you use RushMandarin to study Mandarin, we collect the content you interact with and data you generate — for example, words you save, word lists, texts and videos you read or watch within the Service, your review history, vocabulary and proficiency data, and learning progress and settings.
• Voice recordings and images. If you use features that record audio (such as voice notes) or capture images (such as photographing text for recognition), we collect those recordings and images to provide the feature, including transcribing audio and extracting text from images (see Sections 1.4 and 3).
• Coaching and feedback. If you use coaching features, we collect the goals and free-text feedback you enter.
• Email list. If you subscribe to our email list on rushmandarin.com, we collect your email address to send you updates about RushMandarin. You can unsubscribe at any time using the link in any email.
• Communications. If you contact us (e.g., by email), we collect the information you choose to provide.

1.2 Information collected automatically

• Usage data. We collect information about how you access and use the Service, such as pages or screens viewed, features used, actions taken (for example, tapping a word to see its definition, playing content, completing a review), and timestamps. We collect this for all signed-in users. This data is associated with your account's internal user ID (not your email).
• Product analytics. We use PostHog, a product-analytics service hosted in the United States, to understand how the Service is used. PostHog receives usage events and technical data linked to your internal user ID. In the mobile app, PostHog session replay may record how you interact with app screens so we can diagnose problems and improve the app; text inputs and images are masked in these recordings.
• Crash and error reporting. We use Sentry to collect error and crash reports from the web app and mobile app. Error reports include technical details about the failure, recent in-app actions leading up to it, and your internal user ID.
• Device and technical data. We collect technical information such as browser or device type, operating system, app version, a device identifier on mobile, and approximate region, as well as data necessary for the Service to function (such as session tokens stored in your browser or on your device). The mobile app also stores your learning data locally on your device so it works offline, and syncs it to our servers.

1.3 Browser extension

The RushMandarin browser extension runs on web pages you visit and detects Chinese text so it can provide its language-learning features (such as definitions, proficiency highlighting, and saving words). When a page contains Chinese text and you are signed in, the extension may send the page's visible text, address (URL), and title to our servers to provide these features and to record your encounters with Chinese words (including which words you look up or hover over and how long you spend on a page). We use this information only to provide and improve the language-learning features; we do not sell it, and we do not use your browsing data for advertising. You can sign in to the extension with Google or Apple, or it can use your existing RushMandarin web session.

1.4 AI features

Some features use large language models ("AI") to generate explanations, translations, practice exercises, and coaching. When you use these features, the text you select, surrounding context from the content you are studying, and relevant learning data (such as words you already know) are shared with AI vendors such as OpenRouter and OpenAI to generate the response, and voice recordings may be transcribed using AI speech-recognition services. These vendors may keep a copy of the content they process under their own policies, so please do not submit personal or confidential information when using AI features. We store AI requests and responses to provide the feature, prevent abuse, and improve quality.

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Service;
• Authenticate you and keep your account secure (including captcha protection, see Section 3);
• Save and sync your learning data (saved words, progress, vocabulary) across the web app, mobile app, and browser extension;
• Generate AI-powered explanations, transcriptions, and coaching you request;
• Send you account-related and transactional emails (such as sign-in codes and password reset);
• Send you updates and marketing emails if you subscribed to our email list (you can unsubscribe at any time);
• Respond to your requests and provide support;
• Diagnose technical problems and understand which features are used, so we can improve, personalize, and develop the Service;
• Personalize content, recommendations, and (where offered) advertising;
• Detect, prevent, and address fraud, abuse, and security issues;
• Comply with legal obligations.

Selling your information. We do not sell your personal information in exchange for money. Depending on your jurisdiction, some of our data-sharing for advertising or analytics (described in Section 3) may be considered a "sale" or "share" under laws such as the California Consumer Privacy Act; where that applies, you may opt out as described in Section 6.

De-identified and aggregated data. We may de-identify, anonymize, or aggregate information so that it no longer reasonably identifies you, and we may use and share that de-identified or aggregated data for any purpose, including understanding learning trends, research, improving and developing the Service, and training machine-learning models.

New uses. If we introduce materially new uses of your personal information, we will update this Privacy Policy and provide notice as described in Section 10.

3. Third-Party Service Providers

We rely on a small number of trusted third-party providers to operate the Service. Each receives only the information needed to perform its function:

• Supabase — authentication, database, and backend infrastructure. Supabase stores your account information and learning data on our behalf, and sends authentication emails (such as sign-in codes) to your email address. See https://supabase.com/privacy.
• Google (Sign in with Google / Google OAuth) — if you choose to sign in with Google, Google provides us your email, name, and profile picture to create or access your account. Your use of Google sign-in is also subject to Google's Privacy Policy at https://policies.google.com/privacy. We request only the basic email, profile, and openid scopes; we do not access your Gmail, Google Drive, or other Google data.
• Apple (Sign in with Apple) — if you choose to sign in with Apple, Apple provides us your name and email address (or a Hide My Email private relay address). See https://www.apple.com/legal/privacy/.
• PostHog — product analytics and (in the mobile app) masked session replay, hosted in the United States. PostHog receives usage events, technical data, and your internal user ID. See https://posthog.com/privacy.
• Sentry — error and crash reporting for the web and mobile apps. See https://sentry.io/privacy/.
• AI vendors — OpenRouter and OpenAI — process the text and context described in Section 1.4 when you use AI features (OpenRouter routes requests to third-party language models; OpenAI also provides speech-to-text transcription). See https://openrouter.ai/privacy and https://openai.com/privacy.
• Microsoft Azure — cloud storage and processing for voice recordings, speech services, and image text recognition. See https://privacy.microsoft.com/.
• Sender.net — email list management and delivery for the updates you subscribe to on rushmandarin.com. Sender.net processes the email addresses of subscribers on our behalf. See https://www.sender.net/privacy-policy/.
• Cloudflare (Turnstile) — captcha protection on sign-in and sign-up, which processes technical browser data to distinguish humans from bots. See https://www.cloudflare.com/privacypolicy/.
• Railway — hosting for the RushMandarin web application and backend API (app.rushmandarin.com). See https://railway.com/legal/privacy.
• Vercel — hosting and content delivery for the RushMandarin marketing website (rushmandarin.com). See https://vercel.com/legal/privacy-policy.
• Apple App Store / Google Play & Expo — mobile app distribution and app updates. Installing the mobile app is also subject to the app store's own terms and privacy policy.

We may also use analytics and advertising providers to understand how the Service is used and, where applicable, to deliver or measure advertising. We will update the list above as our providers change.

These providers act as our service providers and are expected to protect your information and use it consistent with this Privacy Policy.

4. Legal Bases (for users in the EEA/UK)

Where the EU/UK GDPR applies, we process your personal data on the following bases: performance of a contract (to provide the Service you requested), our legitimate interests (to operate, secure, and improve the Service), your consent (where required, e.g., for optional communications), and compliance with legal obligations.

5. Data Retention

We generally retain your personal information for as long as your account is active or as needed to provide the Service. When you request deletion of your account, we will delete or de-identify your personal information within a reasonable period, except where we need to retain it to comply with legal obligations, resolve disputes, enforce our agreements, or maintain security. We may retain de-identified or aggregated data (which no longer identifies you) for longer.

6. Your Rights and Choices

Depending on your location, you may have the right to:

• Access the personal information we hold about you;
• Correct inaccurate information;
• Delete your account and associated personal information;
• Export your data;
• Object to or restrict certain processing;
• Opt out of any "sale" or "share" of your personal information or of targeted advertising, where those rights apply (e.g., under the CCPA);
• Withdraw consent where processing is based on consent.

To exercise any of these rights — including deleting your account, requesting a copy of your data, or opting out of any sale/share or targeted advertising — contact us at eugene@rushmandarin.com from the email address associated with your account. We will respond within the timeframe required by applicable law.

7. Data Security

We use commercially reasonable safeguards to protect your information, including encryption in transit (HTTPS), hashed passwords, and access controls. No method of transmission or storage is 100% secure, so we cannot guarantee absolute security.

8. Children's Privacy

The Service is not directed to children under 13 (or the minimum age required in your jurisdiction), and we do not knowingly collect personal information from children under that age. If you believe a child has provided us personal information, contact us and we will delete it.

9. International Data Transfers

We are based in the United States, and our service providers may process data in the United States and other countries. By using the Service, you understand your information may be transferred to and processed in countries that may have different data-protection laws than your own.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated version on this page and update the "Last updated" date. Material changes will be communicated through the Service or by email where appropriate.

11. Contact Us

If you have questions about this Privacy Policy or our data practices, contact us at: