Privacy Policy

This Privacy Policy explains how Shinobi LLC ("Shinobi", "we", "us", or "our") collects, uses, discloses, and protects personal information when you use the Coco Chinese mobile application, website, and related services (collectively, the "Service"). By using the Service, you agree to the practices described below.

1. Information we collect

Information you provide

• Account data: email address, display name, password (stored as a salted hash), and profile preferences.
• Learning data: lessons completed, review history, SRS scheduling state, quiz results, bookmarks, and notes.
• Purchase data: subscription status and receipts. Payment card details are handled by Apple or Google and are never transmitted to or stored by us.
• Support communications: messages you send to get@coco-chinese.com, including attachments.

Information collected automatically

• Device and usage data: device model, operating system version, app version, language, time zone, crash logs, and interaction events (screens viewed, features used).
• Identifiers: a randomly generated installation ID. We do not use the IDFA (Apple's identifier for advertisers) for tracking and we do not present the App Tracking Transparency prompt because we do not track you across apps or websites owned by other companies.
• Log data: IP address (truncated after processing), request timestamps, and error traces.

Information we do NOT collect

• We do not collect precise location, contacts, photos, microphone audio, or health data.
• We do not use third-party advertising SDKs and we do not build advertising profiles.
• We do not knowingly collect information from children under 13 (see Section 8).

2. How we use information

• Provide, maintain, and improve the Service (including syncing your progress across devices).
• Personalize your review schedule based on your learning history.
• Process subscription purchases, renewals, and refund requests via Apple or Google.
• Communicate with you about updates, security notices, and support.
• Detect, investigate, and prevent fraud, abuse, and violations of our Terms.
• Comply with legal obligations and enforce our agreements.

3. Legal bases for processing (EEA/UK users)

If you are in the European Economic Area or the United Kingdom, we process your personal data under the following legal bases:

• Contract: to deliver the Service you signed up for.
• Legitimate interests: to keep the Service secure, prevent fraud, and improve our product.
• Consent: where required, for example for optional analytics; you can withdraw consent at any time.
• Legal obligation: to comply with applicable law.

4. How we share information

We share personal information only with the categories of recipients listed below, and only as necessary.

• Apple Inc. and Google LLC, for processing in-app purchases and subscriptions on their respective platforms.
• Cloud hosting and infrastructure providers, to host the backend, store user data, and deliver application traffic. Providers are bound by contractual confidentiality and data-protection obligations.
• Crash and performance analytics providers, to diagnose crashes and performance regressions. Data is pseudonymized.
• Professional advisors, lawyers, accountants, and auditors, under confidentiality obligations.
• Authorities, when required by law, subpoena, or court order, or to protect the safety, rights, or property of Shinobi LLC, our users, or the public.
• Successors, in connection with a merger, acquisition, reorganization, or sale of assets, subject to equivalent protections.

We do not sell or "share" personal information for cross-context behavioral advertising as those terms are defined under the California Consumer Privacy Act (CCPA/CPRA).

5. Data retention

We retain personal information for as long as your account is active and for a reasonable period thereafter to comply with legal obligations, resolve disputes, and enforce our agreements. Typical retention periods:

• Account and learning data: until account deletion, plus up to 30 days in backups.
• Purchase records: up to 7 years, as required by tax and accounting law.
• Support correspondence: up to 3 years after the matter is resolved.
• Log data: up to 90 days in identifiable form.

6. Security

We use technical and organizational measures designed to protect your data, including encryption in transit (TLS), encryption at rest for sensitive fields, least-privilege access controls, and regular security reviews. No system is perfectly secure; if we learn of a breach that affects your personal information, we will notify you as required by law.

7. International data transfers

Our infrastructure is located in the United States. If you use the Service from outside the US, your information will be transferred to, processed in, and stored in the US or other jurisdictions where we or our service providers operate. Where required, we rely on Standard Contractual Clauses or equivalent safeguards for such transfers.

8. Children's privacy

The Service is not directed to children under 13, and we do not knowingly collect personal information from anyone under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at get@coco-chinese.com and we will delete it. For users between 13 and the age of digital consent in their jurisdiction, a parent or guardian must provide consent where required.

9. Your rights

Depending on where you live, you may have the following rights:

• Access a copy of the personal information we hold about you.
• Correct inaccurate or incomplete information.
• Delete your account and associated personal information.
• Port your data to another service in a machine-readable format.
• Object to or restrict certain processing.
• Withdraw consent where processing is based on consent.
• Lodge a complaint with your local data-protection authority.

To exercise any of these rights, email get@coco-chinese.com. We will respond within the time frame required by applicable law (typically 30 days). You can also delete your account directly from the app settings.

California residents

Under the CCPA/CPRA, California residents have the rights to know, delete, correct, and limit the use of sensitive personal information, and the right to non-discrimination for exercising these rights. We do not sell or share personal information as defined by the CCPA/CPRA.

10. Third-party links

The Service may contain links to third-party websites or services. We are not responsible for the privacy practices of those third parties; please review their policies before providing any information.

11. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the Service or by email before the changes take effect. The "Last updated" date at the top of this page indicates the most recent revision.

12. Contact us

For privacy questions, requests, or complaints, contact us at: