PRIVACY POLICY

This Privacy Policy describes how 2705463 ONTARIO INC. (“ThePureLanguage,” “we,” “us,” or “our”) collects, uses, discloses, and safeguards personal information in connection with the website www.thepurelanguage.com (the “Website”) and the translation features and services (the “Service”). It is a notice: it explains what we do with personal information and what your rights are. Reading it, or using the Website, is not consent to anything. Where we rely on your consent (Sections 4, 7, 12 and 19.5), we ask for it separately, you may refuse it, and you may withdraw it at any time.

---

1. Scope of this Policy

• Visitors who browse the Website
• Users who access translation tools
• Users who submit text for translation
• Users who contact us via email or forms

This Policy does not apply to third-party websites, platforms, or services that we do not control.

This Policy concerns privacy and data protection only. It makes no statement about the accuracy, completeness or suitability of our learning content, and it gives no assurance about study, examination, admission, scholarship, employment or immigration outcomes. Those are governed by Sections 9.1, 9.3 and 9.4 of our Terms of Service, under which the Service is self-study reference material rather than an official study guide, we guarantee no examination or application result, and we accept no liability for one.

Likewise, this Policy makes no statement about the pictures, illustrations, icons and emoji in our flashcards, games and other learning material. They are memory aids only: they may not fully represent a word or a situation, and none is intended to insult or criticise anyone, or to promote any political, religious, sexual or other view or behaviour. That position, and how to report a picture you think is wrong, is set out in Section 9.5 of our Terms of Service.

---

2. Information We Collect

2.1 Information You Provide Directly

• Text you submit for translation (processed temporarily; see Section 8)
• Email address and name (if you contact us)
• Nothing for the leaderboards: display names are always generated automatically and there is no nickname field, so no name is collected from you (see Section 17)
• Any information you voluntarily provide in communications

2.2 Automatically Collected Data

• IP address
• Approximate location (country/region) derived from your IP address
• Device type and operating system
• Browser type and configuration
• Pages viewed, request timing, and error/diagnostic data
• Time zone and language settings
• Referring URLs
• An automated-client (“bot”) classification derived from your browser’s User-Agent string
• The outcome of our access-control and request-limit checks — whether a request was allowed, blocked or rate-limited and under which rule, and, on our data-heavy pages only, a coarse category describing the kind of client it appeared to be (see Sections 19.6 and 20)
• Whether a page was reached from another page of this Website, from another website such as a search engine, or directly — one of five fixed values, never the address of the page you came from (see Section 19.1)
• Records of the calls our own server makes to Microsoft Azure services on your behalf — which service, how long it took, whether it succeeded — never their content (see Section 19.1)
• Nine named study-activity counts — that a game was started or finished, a word saved, a streak continued, a page printed, a share button pressed, a short lesson video started or its closing link followed, or a visit that opened directly on a flashcard, dictionary-word or sentence-word page was active — each carrying no identifier and none of your content, and, where the GDPR applies, sent only with your consent (see Section 19.5)
• Contextual-link experiment and activity next-step counts — whether a tested position or result card was reached and its link followed, with fixed experiment or card-rule/activity labels and no identifier or input, under the same consent rule (see Section 19.7)

We do not operate behavioral tracking, cross-site tracking, or advertising profiles of our own. The data above is limited to standard server and security logs (see Section 9), server-side operational analytics used to keep the site working and to detect automated abuse (see Section 19), and data collected by our advertising partner, Google, for ad delivery (see Section 7). Some pages carry links to third-party learning tools and tutoring services, a few of which may be affiliate links; we collect nothing when you follow one, and Section 21 sets out exactly what does and does not happen.

Our server-side diagnostics (Section 19) are used in aggregate. They set no cookies, use no browser storage, do not follow you across websites, and are not used to build a profile of you or to personalize advertising. The study counters in Section 19.5 are different: they run as script in your browser, so where the GDPR applies they are sent only if you consent.

2.3 Do Not Track (DNT) and Global Privacy Control (GPC)

We do honour the browser “Do Not Track” signal and the Global Privacy Control signal for the study-activity counters described in Section 19.5: if either is enabled, your browser sends none of those events, and the Website works exactly as before.

These signals have no effect on the rest of our processing, because there is nothing for them to switch off. Our server-side diagnostics (Section 19) and request limits (Section 20.1) are strictly necessary to operate and protect the service and run whether or not a signal is sent; we operate no tracking, profiling or advertising analytics of our own that a signal could disable. Advertising cookies set by Google are governed by our consent banner (CMP) rather than by DNT — see Sections 7 and 12.

2.4 Cookies and Tracking Technologies

Our own code can set two first-party cookies. Both are strictly necessary, and neither is used for advertising, analytics, tracking or profiling:

• .AspNetCore.Antiforgery.<suffix> — a security cookie set when you open a page that contains a form, such as the translators or the contact form. It holds a random token that is checked when the form is submitted, so that another website cannot submit forms here in your name (cross-site request forgery). It is HttpOnly, Secure (in production) and SameSite=Lax, has no expiry date of its own, and is deleted when your browser session ends.
• .AspNetCore.Session — a session cookie that is set only when a page stores temporary session data on our server. At present the only such page is the site administrator's own sign-in page, so ordinary visits do not receive it. If it is set, it contains a random session identifier, is HttpOnly, Secure (in production) and SameSite=Lax, and is deleted when your browser session ends; the server discards the session data it refers to after 30 minutes of inactivity. If your browser sends it, it is also one secondary input to our request limits, which are applied primarily by IP address (Section 20.1).

We set no other cookies from thepurelanguage.com. However, because we display advertisements using Google AdSense/Ads, Google may set cookies, use your browser's local storage or use device identifiers for ad delivery, measurement and fraud prevention, and Google's consent message stores your choice on your device (Section 12). We do not use Google Analytics or YouTube embeds on the Website.

Local Storage: We use browser localStorage (not cookies) to store your preferences and learning progress locally on your device. This includes:

• Hear It, Then Use It remembers only your sound-effects switch (tpl_hear_use_sound). Typed answers and session results stay in page memory and are not sent to us. Words you choose to save use your existing local Review deck.
• Contextual Word Recall remembers your Gentle/challenge choice, pace, sound and celebration switches within tpl_cloze_v1. Recall answers, hints and run streaks stay in page memory; words you save use your existing local Review deck.
• Fix My Sentence remembers only your pinyin and sound-effects switches (tpl_fix_sentence). Tile moves, answers and session results stay in page memory and are not sent to us.
• Tone Switch Quest remembers your effects switch, the last level you picked and your best score within tpl_tone_switch. Answers, matches and retries stay in page memory. Only a pressed sound's audio is requested. At the end of a run you can choose to submit your score and level to the leaderboard, as on the other games; words you save use the existing local Review deck.
• Sound-to-Meaning Relay remembers your effects switch (tpl_relay_sound). Chains, answers, repairs and listening results stay in page memory. Only a clicked word's audio is requested; words you save use the existing local Review deck.
• Tone Tiles remembers your difficulty, sound/effects choices, guesses, tone-hint use, random replay answer, timer start and completed duration, legacy practice status and daily stats within tpl_pinyinWordle. Answers, guesses, hints and timer start stay on this device. Daily and fresh random replay wins at all four levels can optionally submit a score, level and solve duration in milliseconds to the leaderboard. Replays do not change daily stats; a completed loss records study without a leaderboard score. Older same-answer practice boards remain unranked. Effect sounds are generated in your browser.
• Flashcard learning progress (cards viewed, quiz results, spaced repetition data)
• User preferences (preferred HSK level, display settings including light/dark theme, learning mode)
• Session continuity data to resume where you left off
• Your daily study streak and the day's practice points
• Your review deck — the words you chose to save with the + button, together with their review schedule and history (tpl_deck_v1). This is a list of dictionary words, not of anything about you, and it is never sent to us.
• The HSK 3.0 level checker (that tool) checks what you paste inside your browser and does not store or send it; a share link keeps the words after the # in the address, which your browser never sends to a website. Its My level, new list deck builder records each batch of cards it adds to your review deck (the batch's date, the two levels you picked and which cards it added, tpl_newListBatches_v1) so the batch can be undone, and, if you give an exam date, your weekly word targets and that date (tpl_hskStudyTargets_v1). Both stay in this browser and are never sent to us.
• Your HSK exam plan from the HSK exam countdown planner: the exam date, the two levels and the minutes a day you chose, each week's new words, writing characters and grammar points, and which weeks you ticked off (tpl_hskExamPlan_v1). It stays in this browser so the page can show your plan again, and other pages on this site may read this week's targets from it in your browser. To show it again, the page sends your chosen date, levels and minutes back to the page like any form you submit; your ticks and word lists are never sent to us. The calendar (.ics) file is made in your browser and contains no alarms. "Start a new plan" deletes it.
• Your My Words Quest on that game: which of your saved words you chose to play, the level, how far you got, each stage's result and your best score per level (tpl_myWordsQuest). It names words already in your review deck, it is never sent to us, and pressing a speaker button fetches only that one word's sound. The Nemesis downloads a shared question bank for your level without sending your word list. At the trophy screen you can optionally submit your score and level using the leaderboard described in Section 17; your deck, answers and chosen words are not submitted.
• Your guided-path progress on the learning paths: which steps you ticked (tpl_pathProgress) and which steps' short checks you passed (tpl_pathChecks). These are lists of step numbers, not your answers, and they are never sent to us.
• Your practice points, daily goal, up to 180 days of per-day points, a running total of every practice point you have earned on this device (kept until you clear your browser data, and used only to work out your study rank inside your browser), activity counts and earned badges (tpl_xpLog, tpl_goal, tpl_counts, tpl_badges), shown on Your Progress
• Which flashcard deck levels you have finished on the flashcard decks: a short name for each level, the first and most recent date you finished it and how many times (tpl_decksDone), shown on Your Progress. It does not record which words you saw or how you answered, and it is never sent to us.
• Your tone report card from the Tone Pitch Mirror (tpl_toneReport_v1): four running averages, one for each Mandarin tone, together with how many practice runs you have finished, your best run and the highest difficulty rung you have reached. No audio of any kind is stored — each recording is measured in your browser's memory and replaced by the next one, and the code that keeps these averages has no access to the microphone or to a recording. The page has a button to clear them.
• Your longest chain on the Radical Walker (tpl_radicalWalkerBest): one number. Which characters you walked through is never stored.
• The destination and extra line you type on the Show-the-driver address card (tpl_addressCard), so the card still works without signal. It is never sent to us. Press Clear on that page to delete it.
• Words you missed in the speaking games and the HSKK practice, if you choose to save them (tpl_speak_review_zh, tpl_speak_review_en, tpl_speak_review_hskk). This is a list of practice words kept apart from your review deck. No audio or transcript is stored, and it is never sent to us.
• A random identifier your browser generates the first time you submit a score to a leaderboard — never just by visiting (a random UUID, stored as tpl_anonId). It is created by your device, not assigned by us, and is not derived from anything about you or your hardware.

Session storage: the translator pages remember whether you chose Table or Ruby view (translationViewMode) for as long as that browser tab is open. Your browser deletes it when you close the tab.

This data is stored on your device and is not shared with third parties. With the three exceptions below, it is never transmitted to our servers.

• If — and only if — you choose to submit a score to a public leaderboard, that submission sends the random identifier described above, together with your score, the difficulty setting you played on (one of a short fixed list the game offers, never free text), and solve duration for timed games such as Tone Tiles. No name or nickname is sent: the name shown beside your score is generated by us. Timer start timestamps are not submitted. See Section 17.
• When your study streak reaches a new day, your browser may report that a streak advanced, and how long it is as one of four broad bands (1, 2-6, 7-29, 30+) — where the GDPR applies, only if you consented (Section 19.5). The exact number of days is never sent, the random identifier above is not attached, no cookie accompanies it, and we do not link it to your leaderboard entries, to your other visits or to other events.
• If you press Share on a game result, the link you share carries that result in its address — your score and the difficulty setting you played on, or the colours of your Tone Tiles or 每日猜单词 grid (never its letters) — so that the preview a messaging app shows can picture it. Our server receives it only when someone opens the link or an app builds its preview, and the link contains nothing else: not the random identifier above and not a nickname.

Nothing else in the list above is ever sent: not your saved words, not your review schedule, not your points, goal, per-day history, activity counts, badges or tone report card.

Separately from your stored data, using the study features may send us nine counts — that a game was started or finished, a word was saved, a page was printed, a share button was pressed, a lesson video was started or its closing link was followed, or that a visit which opened directly on a flashcard, dictionary-word or sentence-word page was active — each carrying no identifier and none of your content. They record that something happened, never what. Where the GDPR applies they are sent only with your consent. Section 19.5 lists every field, and explains how to switch them off, including with your browser's Do Not Track or Global Privacy Control setting.

You can clear this data at any time by clearing your browser's local storage or site data for thepurelanguage.com. Because the identifier lives only in your browser's storage, clearing it, using a different browser, or switching devices makes you a new, unrelated visitor to us.

Export and backup. Because none of the above is stored on our servers, we cannot restore it for you and we cannot move it to another device for you. Review and Your Progress therefore let you download a backup file containing your saved words, schedule, streak, points and badges, and restore one later. That file is generated entirely inside your browser and downloaded straight to your device — it is not uploaded to us, and choosing a file to restore reads it locally without sending it anywhere.

Visitors in the EU/EEA, the UK and Switzerland are shown a consent banner (CMP), and in those regions non-essential cookies, personalized advertising and our browser-side study counters (Section 19.5) are used only where the user has provided explicit consent. No consent banner is shown elsewhere; see Section 12 for how ads may be personalized there and how to turn that off.

---

3. Purposes for Collecting and Using Information

We process data for the following purposes:

• Providing translation functionality
• Improving accuracy through caching of translation outputs (output only)
• Operating and maintaining the Website
• Ensuring security and fraud prevention
• Enforcing request limits and preventing automated bulk extraction of our data (see Section 20.1)
• Understanding, in aggregate and without trying to identify anyone, which of our free study features are actually used — with your consent where the GDPR applies (see Section 19.5)
• Service optimization
• Complying with legal obligations
• Running advertising (Google Ads / AdSense)

We do not sell personal data.

---

4. Legal Bases for Processing (GDPR / UK GDPR / ePrivacy)

For visitors in the European Economic Area (EEA), the United Kingdom (UK), Switzerland, and similar jurisdictions, we rely on the following legal bases:

• Consent — for non-essential cookies, personalized advertising, the browser-side study-activity and experiment counters described in Sections 19.5 and 19.7 (because they run as script on your device), and any other processing requiring opt-in.
• Legitimate Interests — for basic ad delivery, fraud prevention, measurement, and service security where appropriate; and for server-side diagnostics (Section 19) and request limits (Section 20.1).
• Performance of a Contract — to provide translation services requested by the user.
• Legal Obligations — when required to retain records or respond to lawful requests.

Our CMP allows users in regulated regions to review and update their consent and Legitimate Interest preferences at any time. Withdrawing consent is as easy as giving it (Article 7(3)): a “Cookie settings” link is in the footer of every page. Where our consent message applies to you, it reopens that message so you can change or withdraw any choice you made; on a page where the message cannot load, it leads to Section 12, which sets out every other way to withdraw. Withdrawal does not affect the lawfulness of processing carried out before you withdrew, and the Website continues to work in full either way.

---

5. Third-Party Microsoft AI Services (Azure Translator & Azure AI Speech)

5.1 Data Processing by Microsoft

To provide automated translation, we use Microsoft Azure Translator as a fallback when requested text is not available in our proprietary dictionary.

• Your submitted text is transmitted securely to Microsoft’s servers for processing.
• For text translation: Microsoft does not store customer text or use it to train AI models for most synchronous text translation operations.
• For document or asynchronous operations: text may be temporarily stored for up to 48 hours for reliability and debugging.
• All transmission is encrypted; temporary data is accessible only to authorized personnel under strict controls.

Microsoft Data Privacy

Refer to Microsoft’s documentation for current details on data handling:

• Azure Language Services — Data Privacy
• Translator Data, Privacy, and Security
• Microsoft Privacy Statement
• Azure Language / Translator No-Trace Policy

5.2 Caching Policy

• We cache only translation outputs returned by Microsoft for up to 6 months from when each was created, to avoid repeating the same API calls. Using a cached output does not extend its life. An automatic job deletes expired outputs every six hours, whether or not anyone asks for them again.
• We do not store your original input text as a field. Cached outputs are keyed by a one-way hash of the input. A hash cannot be decoded back into text, but the same text always produces the same hash, so someone with access to the cache who already guessed the exact text could confirm the guess; access to the cache is restricted to us.
• A cached output is a translation of what you typed, so if your text contained personal information — a name, for example — the output may contain it too. Please do not submit personal information you do not want processed.
• Translations sourced from Microsoft are marked with a cloud icon where shown in the UI.

5.3 Text-to-Speech (Microsoft Azure AI Speech)

When you use a “Listen” button to hear a word, phrase or pinyin syllable pronounced, the short text to be spoken is sent from our servers to Microsoft Azure AI Speech, which returns synthesised audio.

• The request is made server-to-server. Your IP address, cookies and browser details are not sent to Microsoft by this feature.
• Only the short text to be spoken is transmitted — capped at 100 characters, or 24 characters for a single pinyin syllable.
• In normal use this is dictionary content (a word, phrase or syllable), not information about you.
• Generated audio is cached so that the same text does not need to be sent repeatedly.
• No microphone audio is involved. This feature only plays audio to you — it never captures anything. For microphone-based features see Section 18.
• Processing region: South Central US. For visitors in the EEA, the UK or Switzerland this is a transfer to the United States, carried out under Microsoft's Standard Contractual Clauses and the Microsoft Products and Services Data Protection Addendum (DPA).
• See Azure AI Speech — Data, Privacy and Security.

---

6. Open-Source Libraries (Hosted on Our Own Server)

The Website uses several open-source libraries: Bootstrap and jQuery for layout and interactive features, jQuery Validation for forms, Font Awesome for icons, and HanziWriter for stroke-order animations. Since October 13, 2026 every one of them is served from our own server, together with the stroke data HanziWriter animates. Your browser no longer connects to a third-party content delivery network (such as cdnjs/Cloudflare or jsDelivr) to load them, so no CDN receives your IP address, your browser details or a record of which pages or characters you look at.

Their authors and licences are listed on our Open Source Licenses page, and each licence file is published alongside the library it covers. Third-party content you choose to open — for example an outside link, or Google's advertising and consent services described in Sections 7 and 12 — is governed by that provider.

---

7. Google Services, Advertising & Cookies (GDPR / LI)

We use Google AdSense/Ads, including related-search ad units, to display advertisements. Google may collect cookies, device identifiers, usage data, IP address and browser metadata, and ad interaction and measurement data. Personalized ads are served only with users' explicit consent in regulated regions.

No advertising is directed to children. The Website is a general-audience service for users aged 16 or over and contains no child-directed content, so no page is designated as child-directed content in our advertising settings — because none is. We do not ask our advertising partner to target children, and we do not use advertising formats aimed at children. See Section 14.

Related search units: Some pages display a Google-operated “related searches” box. If you type a query into it or click one of its suggestions, that search term is sent to Google and is handled by Google as the controller, under the Google Privacy Policy — in the same way as a search you run on Google directly. We never receive your search term, we do not log it, and it is not connected to anything you type into our translation tools. If you do not interact with the box, no search term is generated.

How Google uses your data: For full details on how Google processes data — including IP addresses — when you use a site that displays Google ads, see How Google uses information from sites or apps that use our services, Google's Privacy & Terms / advertising data-use page, and Google's Advertising technologies policy.

• Legitimate Interest purposes may be enabled for basic ad delivery, frequency capping, measurement, and fraud prevention where permitted by law.
• Consent or Legitimate Interest status is communicated to Google and other advertising partners via our CMP.

Cross-Border Transfers:
Google and Microsoft may process data in the United States and other countries. Data transferred outside the EU/EEA, UK, or Switzerland is protected using Standard Contractual Clauses (SCCs) approved by the European Commission, alongside Google’s or Microsoft’s supplemental commitments and technical safeguards (encryption, access controls), to provide GDPR-level protection.

Controller / Processor Roles:

• Google Ads / AdSense: independent data controller for its ad processing and targeting functions.
• Microsoft Azure Translator: data processor acting on our behalf for translation processing.

Personalized ads are shown only when the user explicitly consents in regulated regions. Users may manage ad preferences via our CMP — reopen it with the “Cookie settings” link in the footer of any page (Section 4) — and at Google Ads Settings.

Google Search Console. We use Google Search Console to see how our pages appear in Google Search. Its reports are compiled by Google from Google's own search data — for example how often a page was shown or clicked for a search term — and reach us aggregated, with nothing that identifies a visitor. No Search Console code runs on our pages; the only trace of it on the Website is a verification tag in the page header, which collects nothing.

Our CMP follows the IAB Europe TCF guidelines for communicating consent and Legitimate Interest signals to advertising vendors.

---

8. Automated Decision-Making & Profiling

We use automated systems to generate translations, display contextual or personalized ads (see Sections 7 and 12), and detect/prevent fraud or invalid traffic.

• We do not make automated decisions that produce legal or similarly significant effects on users.
• The profiling that takes place when you use the Website is personalized advertising, carried out by Google as an independent controller (Section 7) using its own cookies and identifiers. In regulated regions (EU/EEA, UK, Switzerland) it is used only if you explicitly consent via the consent banner. If you decline, no personalized ads are shown and no advertising profile is used (see Section 12 for what you may see instead).
• Outside those regions, including Canada and Québec, Google may personalize ads by default. You can turn ad personalization off at any time at Google Ads Settings (see Section 12).
• Our own analytics are not profiling. Application Insights (Section 19) sets no cookie, carries no account or device identifier and stores no IP address, and we use it only in aggregate. The study-activity counters in Section 19.5 carry no identifier, we do not attribute events to a person, and where the GDPR applies they are sent only with your consent. Nothing about you is inferred, scored or acted upon from either.
• Access to the Website is decided automatically, request by request, by the checks described in Sections 20 and 20.1 — a request may be refused or slowed based on the region it comes from, whether it appears to come from an automated client, and how many requests have recently been made. That decision is made on the request in front of us and is not based on any stored profile of you. The one piece of history involved is on the translation pages, where the waiting period after a limit is exceeded grows with a count of earlier such events held in memory for up to 24 hours (Section 20.1). The decision does not produce legal or similarly significant effects, and it affects only access to a free reference website. The identifier-free record it leaves in our diagnostics (Section 19.6) is a count of outcomes, is not used to judge any future request, and is never used for advertising or personalization. If you believe a connection of yours has been misidentified, contact us at the address in Section 22 — see also Section 13.

---

9. Data Retention

• Translation input text: not stored as a field — used only transiently in memory to produce your result. Our translation-output cache is keyed by a one-way hash of the input; an output itself may still contain personal information you typed (Section 5.2).
• Microsoft temporary storage (when used): up to 48 hours.
• Cached translation outputs: up to 6 months from creation, removed by an automatic deletion job that runs every six hours.
• Log data (server and security logs): retained up to 12 months.
• Operational analytics (Microsoft Azure Application Insights, see Section 19), including the study-activity counters in Section 19.5 and the security and access-control records in Section 19.6: retained up to 90 days, then deleted automatically by Microsoft. IP addresses are not retained in this data — see Section 19.2.
• Emails: retained as needed for administration, then archived or deleted.
• Security cookie (.AspNetCore.Antiforgery.<suffix>) and, where set, session cookie (.AspNetCore.Session): deleted when your browser session ends. The server discards session data after 30 minutes of inactivity.
• Request-limit counters (see Section 20.1): held in server memory only, for at most one hour, then discarded. Never written to disk. The identifier-free record that a limit of a given kind was reached is kept with our operational analytics for 90 days (Section 19.6).
• Advertising cookies and identifiers (Google): retained per Google's expiration policy.

Google may use data as an independent controller for its advertising optimization and measurement purposes.

---

10. Data Sharing and Disclosure

• Microsoft Corporation — translation processing (processor). See Section 5.
• Microsoft Corporation — text-to-speech audio generation via Azure AI Speech (processor). See Section 5.3.
• Microsoft Corporation — website operational analytics and diagnostics via Azure Application Insights (processor). See Section 19.
• Google — advertising (independent controller for ads).
• Google — email: messages you send to our privacy or contact address are received and stored in a Google Gmail mailbox.
• Hosting and infrastructure partners (e.g., Azure or hosting provider).
• Professional advisors (legal, accounting).
• Regulators or authorities when required by law.

We do not sell personal information. Each vendor relationship is governed by a Data Processing Agreement (DPA) where required by law. Where applicable, DPAs with Microsoft and our hosting providers ensure GDPR-compliant processing and confidentiality obligations.

---

11. International Data Transfers

Data may be processed in the U.S., Canada, EU, or other regions. Transfers are protected by Standard Contractual Clauses (SCCs) and appropriate technical safeguards (for example, encryption in transit and at rest). We conduct Transfer Impact Assessments (TIAs) where required to evaluate risks and supplemental safeguards.

Specifically, the Website is hosted in, and the following Microsoft services process data in, the South Central US Azure region:

• Website hosting and the translation-output cache;
• Azure Translator, where a word or phrase is not in our dictionary (Section 5);
• Azure AI Speech, used to generate “Listen” audio (Section 5.3);
• Azure Application Insights operational analytics (Section 19).

If you access the Website from the EEA, the UK, or Switzerland, this constitutes a transfer to the United States, carried out under Microsoft's Standard Contractual Clauses and the Microsoft Products and Services Data Protection Addendum (DPA).

---

12. Cookie Policy (Summary)

ThePureLanguage.com's own code can set two strictly necessary first-party cookies (Section 2.4): a security cookie (.AspNetCore.Antiforgery.<suffix>) on pages with a form, and a session cookie (.AspNetCore.Session) that ordinary visits do not currently receive. Each holds only a random value, is deleted when your browser session ends, and is not used for advertising or profiling. Our request limits are applied primarily by IP address rather than by either cookie — see Section 20.1. Because we display ads with Google AdSense/Ads, Google may also set cookies, use local storage or use device identifiers for ad delivery, fraud prevention, and measurement. Those are controlled by Google.

Our server-side diagnostics (Section 19) set no cookies at all and use no browser storage — they run entirely on our server, and they cannot be used to track you between visits or across other websites. The study-activity and experiment counters in Sections 19.5 and 19.7 are different: they run as script in your browser. They set no cookie, and the session cookie above is deliberately not sent with them, but because they use information generated on your device, where the GDPR applies they are sent only after you consent through our consent message (to storing or accessing information on your device and to measuring content performance). If you decline, or if the consent message cannot load, they send nothing.

Consent:

• In the EU/EEA, the UK and Switzerland, our CMP displays a consent banner. Non-essential cookies (including personalized ads) are used only after explicit consent.
• If you decline consent, you will not see personalized ads, and you will not see Google's standard non-personalized ads either, because those still use cookies for frequency capping and reporting. Google may instead show limited ads, which use no personal data for personalization but may still use cookies or local storage to detect fraud and invalid traffic, or it may show no ad at all. Declining personalization therefore does not mean that no information is stored on your device. Advertising profiling does not occur.
• Elsewhere, including Canada and Québec, no consent banner is shown and Google may show personalized ads using its cookies and identifiers. You can turn ad personalization off at any time at Google Ads Settings (below).

Changing or withdrawing your choice

• “Cookie settings” in the footer of every page. Where our consent message applies to you and has loaded, it reopens that message so you can change or withdraw any choice. Otherwise it brings you here.
• If the message does not open — for example because an ad or content blocker stops it, or on a page we serve without advertising — clear the cookies and site data for thepurelanguage.com in your browser. That removes the stored choice, and the message asks you again the next time it loads. Until you consent again, our study counters send nothing.
• Do Not Track or Global Privacy Control. Turning either on in your browser switches off our study and experiment counters (Sections 19.5 and 19.7) whatever choice is stored.
• Ad personalization, wherever you are: Google Ads Settings.
• Or contact us (Section 22), and we will help.

---

13. Your Privacy Rights

Because we do not create user accounts, collect age information, or track users across the Website by default, we generally cannot identify who used the Service unless you provide additional information that allows us to verify your identity. Depending on your location, you may still have certain privacy rights that apply to the limited data we process (for example: temporary server logs or short fragments of cached translation output).

How to submit a request: To exercise any of the rights above, please contact our Privacy Contact at thepurelanguagecom@gmail.com. Include sufficient information for us to locate the data (for example, the approximate date and time you used the Service, any text you submitted, or the email address used when contacting us). We will verify your identity before responding to rights requests. Where identity cannot be reasonably verified or where no data associated with you can be located, we will explain why the request cannot be fulfilled.

If we deny your request, you may appeal the decision by replying to our response email with the word APPEAL in the subject line. We provide alternative accessible formats of this Privacy Policy upon request for individuals with disabilities.

---

14. Children’s Privacy — This Website Is Not for Children

14.1 Our position

The Website is a general-audience reference and study tool intended for adults and for learners aged 16 or over. It is not directed to children, it is not designed to appeal to children, and we do not want children as users.

Specifically, and as a matter of ongoing policy:

• We operate no children’s section and offer no learning content directed to children.
• We use no cartoon characters, mascots, animated characters, child actors, photographs of children, songs or other child-appealing features, and we state no age range below 16 anywhere on the Website. By a cartoon or animated character we mean a named or recurring character who acts as a guide, host or friend; there is none on the Website. Our vocabulary pictures are still images; none of them moves.
• Where a word names a family member or a younger person (for example 儿子 son, 女儿 daughter or 妹妹 younger sister), it may be shown as a simple, neutral figure in a family-tree diagram, or as an adult emoji, used only as a memory aid (Terms §9.5). These figures are drawn the same way as the adults and are not designed to appeal to children.
• We do not knowingly collect personal information from anyone under 16, and we do not knowingly allow anyone under 16 to submit anything to us.
• We never request microphone access, voice recordings, photographs or video outside the two clearly-labelled optional Speaking Practice pages described in Section 18, which are likewise intended for users aged 16 or over.
• We do not operate accounts, profiles, messaging, chat, uploads, friend lists or any other feature through which a user could publish personal details or be contacted by another user.
• We do not knowingly build profiles of, target advertising at, or apply any form of behavioural profiling to children.

Because we collect no age data and operate no accounts, we cannot verify any individual visitor’s age. Our controls are therefore editorial and structural: we do not publish content aimed at children, and we have removed the content that was. Parents, guardians and teachers are responsible for supervising the internet use of anyone in their care.

14.2 COPPA (United States)

The US Children’s Online Privacy Protection Act applies to operators of websites or online services directed to children under 13, and to operators with actual knowledge that they are collecting personal information from a child under 13. Assessed against the factors the Federal Trade Commission applies — subject matter, visual and audio content, use of animated characters or child-oriented activities and incentives, the age of models, the presence of child celebrities, language, and whether advertising on the service is directed to children — this Website is a general-audience service and is not directed to children, and it contains no child-directed portion. We have no actual knowledge of collecting personal information from any child under 13. If we obtain such knowledge, we will delete the information promptly; see Section 14.6.

14.3 UK Age Appropriate Design Code (Children’s Code)

The UK Children’s Code applies to information society services likely to be accessed by children in the United Kingdom. We have assessed the Website against that standard. We do not target children, we publish no content of the kind that would appeal to a child rather than to an adult learner, and we removed the only section that plausibly would have. We have documented that assessment internally and keep it under review; where the Code’s data-protection expectations apply to us regardless of audience, we already meet them by design and by default:

• Data minimisation: no accounts, no sign-up, no email address required to use any feature, and learning progress kept in your own browser rather than on our servers (Section 2.4).
• High-privacy defaults: nothing is transmitted from your device unless you actively choose it. Submitting a leaderboard score is the only such action, it is off unless you tap the button, and no nickname is ever requested because display names are always generated automatically (Section 17).
• No profiling by default: personalized advertising is served only where a user has given explicit consent through our consent management platform in regulated regions (Sections 7 and 12). We apply no behavioural profiling of our own, and our analytics set no cookies, use no browser storage and retain no IP address (Section 19).
• No nudge techniques: we use no streak pressure, loss-framing, countdowns or dark patterns to push any user toward sharing more data or spending more time than they intended.
• Transparency: this Policy states plainly, at the top and here, that the Website is not for children.

14.4 GDPR and GDPR-K (EU/EEA and UK)

Under the UK and EU GDPR, the age of consent for information society services offered directly to a child ranges from 13 to 16 depending on the member state. We set our threshold at the highest of those, 16, and do not offer the Service directly to anyone below it.

Where we rely on legitimate interests (Article 6(1)(f)) — principally for security, abuse prevention and rate limiting, described in Section 20.1, and for server-side diagnostics described in Section 19 — we have taken account of Recital 38, which provides that children merit specific protection and that legitimate interests are a weaker basis where a child’s data may be involved. The processing in question is limited to IP address, User-Agent and request metadata; it is held in memory for no more than one hour (with the sole exception described in Section 20.1), is never used to build a profile of any individual, is never used for advertising or personalisation, and is necessary to keep a free service available against automated abuse. We consider that balance to hold even on the assumption that a child’s data could occasionally be involved — and we have reduced the likelihood of that by removing all child-directed content.

The same Recital 38 assessment applies to the study-activity counters in Section 19.5, and reaches the same conclusion more easily: those events carry no identifier at all and none of your content, so they cannot be assembled into a record of any individual, child or adult, and cannot be used to target anyone. Any browser sending a Do Not Track or Global Privacy Control signal sends none of them.

14.5 Canada — PIPEDA and Québec Law 25

We are an Ontario corporation and are subject to the federal Personal Information Protection and Electronic Documents Act (PIPEDA). The Office of the Privacy Commissioner of Canada treats the personal information of minors as inherently sensitive, and consent obtained directly from a young child is generally not considered meaningful.

Québec’s Law 25 likewise treats the personal information of a minor as sensitive: information concerning a minor under 14 may generally only be collected with the consent of a person having parental authority, and privacy settings must default to the highest level of confidentiality. We do not seek to rely on consent from a minor: we do not direct the Service to minors, we offer no accounts, and the confidentiality-affecting settings we do have — chiefly whether anything at all leaves your device — are already at their most protective by default and change only if you actively choose otherwise.

14.6 If a child has used this Website

If you are a parent, guardian or teacher and you believe a child has provided personal information to us — in practice this could only be a leaderboard entry or an email to us — please contact thepurelanguagecom@gmail.com and we will delete it promptly and without requiring you to create an account or prove anything beyond enough detail for us to find the entry.

Please note the practical limit set out in Section 17: a leaderboard entry is linked only to a random identifier held in the submitting browser. If that browser’s data has been cleared, we hold nothing that connects the entry to any person and may be unable to locate it. Where we cannot identify an entry, we cannot delete it selectively — but no leaderboard entry contains a name, an email address or an IP address in the first place, and because display names are always generated automatically, no user-entered text is stored at all.

---

15. Security

We implement reasonable technical and organizational safeguards to protect personal information, including encryption in transit, secure hosting, access controls, and monitoring. While we strive to protect your data, no security measure is perfect or impenetrable.

The most effective safeguard here is how little there is to lose. We operate no user accounts and no password database; we do not store the text you submit for translation; our translation and audio caches are addressed by a one-way hash rather than by your text; our analytics retain no IP address (Section 19.2); and your learning progress stays in your own browser rather than on our servers (Section 2.4). A breach of our systems would therefore expose very little that could identify anyone.

15.1 If a personal data breach occurs

Where a personal data breach occurs and is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, as required by Article 33 of the GDPR and UK GDPR. Where a breach is likely to result in a high risk to your rights and freedoms, we will also inform affected individuals without undue delay under Article 34 — although, since we hold no accounts and no contact details for visitors, we would generally have to do so by prominent notice on this Website rather than individually. Equivalent obligations under Swiss, Canadian and Québec law are met in the same way.

---

16. Changes to this Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated “Last Updated” date. Material changes affecting your rights will be communicated to you where feasible.

---

17. Games & Leaderboards

Your streak and progress are stored only in your browser (localStorage). They are not sent to us, apart from the identifier-free counts described in Section 19.5 — a count that a game was finished, and a count that a streak reached a new day together with its length as one of four broad bands, sent only with your consent where the GDPR applies. Neither carries the identifier described below, and we do not connect either to a leaderboard entry. If you choose to submit a score, we store a display name, your score, the date, the difficulty you played on, solve duration where timing is offered, and a random identifier your browser generated. Timer start timestamps are not sent. We do not collect your name, email address, or IP address with leaderboard entries. Seasonal boards run in calendar quarters (every three months), changing on January 1, April 1, July 1 and October 1 (UTC). Seasonal entries are kept for that season plus 90 days; all-time best scores do not expire with a season. Each board keeps only its top 100 entries. You can remove your entries at any time with the “Remove my scores” button, or by contacting us.

How the leaderboard recognises you. We do not use a cookie or an account for this. Recognition relies entirely on the random identifier your browser created and keeps in its own local storage (see Section 2.4). It is sent only when you submit or remove a score. We treat it as pseudonymous personal data: on its own it identifies no one and we hold nothing that links it to your name, email address or IP address, but it is persistent, so we describe it here rather than calling it anonymous.

The identifier is never published. The public leaderboard data returned to browsers contains only a short one-way hash of it, which your own browser recreates locally to highlight your row as “(you)”. The hash cannot be reversed to recover the identifier.

Please note: that identifier is also the only credential proving a leaderboard entry is yours, and it exists nowhere but your browser. If you clear your site data, switch browsers, or move to another device, you become a new visitor to us and the “Remove my scores” button can no longer reach entries submitted from the old browser. We are then unable to locate those entries on request, because nothing connects them to you. If you want an entry removed, please use the button before clearing your browser data, or contact us with enough detail (the game, display name, score and approximate date) for us to find it.

How your display name is set. The name shown next to your score is always generated automatically by us: a random name such as “SwiftPanda42”, built from a fixed word list and derived from the random identifier your browser created. No nickname is collected from you on any game: there is no nickname field, and any name a device sends is ignored and discarded. The generated name contains no information about you.

The display name is shown publicly on the leaderboard, where it may be seen by anyone, including minors. Because nobody can type one in, the leaderboards carry no user-written text. See Section 4.1 of our Terms of Service.

17.1 The difficulty shown beside a score

Where a game offers a difficulty setting, the setting you played on is stored with your score and displayed beside it — otherwise a score set on the easiest setting cannot be told from one set on the hardest. It is not free text: your browser sends one of a short, fixed list of values that the game itself offers (for example “Easy”, “Medium”, “Hard”, or the input mode “Hanzi” or “Pinyin” on the typing test), our server checks it against that list, and anything else is discarded rather than stored. It describes the round you played and nothing about you.

---

18. Microphone & Speech Recognition

Two optional practice pages — Chinese Speaking Practice and its English counterpart — can listen to you say a word so the page can score your pronunciation. The microphone is used only on those pages, and only after you tap the microphone button and grant your browser's permission prompt. Every other page on the Website is blocked from requesting microphone access at the browser level (via a Permissions-Policy header), including advertisements, which can never request it.

18.1 What we do not do

• We do not record your voice.
• We do not store, upload or transmit any audio to our servers. No recording of your voice is ever created or sent to us — there is nothing for us to keep.
• We do not use your voice to identify you, and we do not perform voice-print, biometric or speaker-recognition processing of any kind.
• We do not use your voice, or anything derived from it, to train artificial intelligence or machine-learning models — ours or anyone else's.
• We do not share or sell voice data, because we never receive any.
• The microphone is never activated in the background, on page load, or while you are on any other page.

18.2 Your browser's speech recognition (important)

The speech recognition itself is performed by your web browser, using the built-in Web Speech API — not by us and not on our servers. This distinction matters:

Most browsers do not recognise speech on your device. They typically send the captured audio to their own provider's servers for transcription — for example Google in Chrome, or Microsoft in Edge. That transfer happens between your browser and its vendor. It is governed by that vendor's privacy policy, we have no visibility into it, we receive no copy of the audio, and we cannot control, limit or switch it off.

We reference the relevant vendor policies here so you can review them: Google Privacy Policy (Chrome) and Microsoft Privacy Statement (Edge). If you are not comfortable with your browser transmitting audio to its vendor, simply do not grant the microphone permission, or decline it in the prompt. Both speaking pages remain fully usable without it — you can still hear the model pronunciation and practise aloud; only the automatic scoring is unavailable.

18.3 What happens to the transcript

Your browser returns a text transcript of what it heard. That text is compared to the target word inside your browser to produce a score, and is then discarded — it is never sent to us. Words you missed can be saved to a list of practice words for that game, which is stored in your browser's local storage on your device only and is separate from your review deck (see Section 2.4). If you choose to submit your result to a leaderboard, only your numeric score is sent, exactly as described in Section 17 — never the transcript and never audio. The “Listen” button is unrelated to the microphone: it sends the target word (text only) from our servers to Microsoft Azure AI Speech to generate example audio, and involves no input from you. See Section 5.3 for details of that transfer.

---

19. Website Analytics & Diagnostics (Microsoft Azure Application Insights)

We use Microsoft Azure Application Insights, a server-side monitoring service, to keep the Website running correctly, to diagnose errors and slow pages, and to detect automated abuse. Microsoft acts as our processor for this data under the Microsoft Products and Services Data Protection Addendum.

19.1 What is collected

For each request our server handles, the record may contain:

• The URL requested, the HTTP method, the response status code, and how long the request took. Before the record is sent, any query-string value that our own pages do not define is removed, so text added to an address — by you or by a link you followed — is not recorded
• Approximate location — country/region, and at most city level — derived from your IP address at the moment the data is received
• Browser and operating system type (from the User-Agent string)
• An automated-client classification (whether the request appears to come from a known crawler or bot, and which one), and whether the request arrived with no User-Agent at all
• The outcome of our access-control and request-limit checks — whether the request was allowed, blocked or rate-limited, and which rule applied — together with a coarse description of the kind of client it appeared to be on our data-heavy pages. This is described in full in Section 19.6
• How you arrived at a page, as one of five fixed values taken from a standard header (Sec-Fetch-Site) that your browser sends with every page request: from another page of this Website (same-origin, or same-site for another address on our own domain), from another website such as a search engine (cross-site), directly — typed, bookmarked or opened from an app (none) — or unknown where the browser does not say. It records that a visit came from within the Website, never the address of the page or site you came from, and it is recorded on page views only. We use it in aggregate to improve the links between our pages. On flashcard, dictionary-word and sentence-word pages, we also read this header together with the navigation mode to omit advertising code and passive study records on direct arrivals, helping reduce automated ad traffic. This decision uses no browser storage and creates no identifier; it does not personalize advertising or build a visitor profile (Section 8)
• Whether you arrived through one of our own links, as one of three fixed values. Links that this Website generates carry a short tag in their address: ?src=app (the start page of the Website installed as an app), ?src=reminder (a study reminder) or ?src=share (a link made with our share buttons). On a page view we record which of the three it was; any other value is removed from the address and not recorded. The page then removes the tag from your browser's address bar straight away, without reloading, so it is not saved in a bookmark or passed on when you copy the address; nothing is stored on your device. On the flashcard, dictionary-word and sentence-word pages described above, a direct arrival that carries one of these tags is shown advertising rather than none, but the advertising code is loaded only after your first scroll, tap or keypress, so that a copied tag alone cannot bring advertising to an automated visit
• Unhandled errors and exception diagnostics, including stack traces
• Operational log messages written by our own server code — for example that a dictionary file loaded, that a cache was rebuilt, or that a background task failed. These describe the state of the software, not of any visitor
• Records of the outbound calls our server makes on your behalf — for example to Azure Translator, Azure AI Speech or our own Azure storage — noting which service was called, how long it took and whether it succeeded. The content of those calls is not recorded: the text you submit for translation and the text sent for audio travel in the body of the request, never in the address, and our translation and audio caches are addressed by a one-way hash rather than by your text (Sections 5.2 and 9)
• Standard server performance measurements (for example memory and processor use, and request rates), which concern the server and not any visitor
• A randomly generated, short-lived identifier used to group the requests of a single visit for troubleshooting

Not every request is recorded. Application Insights is configured with fixed-percentage sampling, which keeps a representative sample of traffic rather than every individual request, so this data is statistical in nature and is not a complete log of any one visitor’s activity.

19.2 IP addresses are not stored

Application Insights is configured with IP masking enabled (the service default, which we have not disabled). Your IP address is used once, on receipt, to derive an approximate location, and is then discarded and stored as 0.0.0.0. We do not have access to the raw IP addresses of visitors in this analytics data, and we do not attempt to identify anyone from it. Masking the address greatly reduces, but does not by itself rule out, the chance that a record could be linked to a person in combination with other information, so we still treat this data as personal data.

19.3 What is never collected

• No text you submit for translation, and no translation results. Telemetry records only metadata such as input length and the options selected.
• No text you send for audio playback. Audio request parameters are removed from the address recorded by Application Insights; the route, response status and server duration remain available for troubleshooting.
• Nothing you type into the site search. The search at /search runs entirely in your browser against two files it downloads — no search request is ever sent to a server, so there is no query to log. The one place your words would otherwise appear is the page address itself (/search/…, which is what makes a set of results shareable), and that portion of the address is replaced with a placeholder before any diagnostic record is written: the visit to the search page is counted, what you searched for is not.
• Nothing you select in an on-page filter or picker. Tools such as the study-plan picker on /compare simply narrow content the page has already sent to your browser. Your selection is not submitted to a server, not written to the page address, and not stored — there is nothing to log, and nothing about your goals, plans or circumstances reaches us.
• No microphone audio and no speech transcripts (see Section 18).
• No names, email addresses, or account data — the Website has no user accounts.
• No raw IP address (see Section 19.2) and no raw User-Agent string. Where we need to describe the kind of client that made a request we record a category from a short fixed list — for example “chrome” or “crawler” — never the full User-Agent text, which is detailed enough that, combined with a country, it could help distinguish one visitor from another. What we keep is deliberately less specific than the browser and operating system names the service already derives.
• No request or response content. We do not record the body of any request or response, the contents of any form you submit, the values of any cookie, or the other headers your browser sends. The request headers play a part only in the yes/no checks described in Sections 19.6 and 20.1, and in the single five-value arrival category described in Section 19.1; their contents are not stored. The address of the page you came from (the Referer header) is not recorded.
• No cookies and no browser storage. Application Insights is used server-side only; we do not load its browser-side JavaScript SDK, so it cannot track you across sites or sessions. The study-activity counters described in Section 19.5 run as our own small script: with your consent where the GDPR applies, your browser reports nine named events to our server, which writes the record — the script does not communicate with Microsoft, and no third-party analytics code runs on any page.

19.4 Legal basis and your choices

Where the GDPR or UK GDPR applies, we rely on our legitimate interests (Article 6(1)(f)) in operating a secure, functioning website, in preventing fraud and automated abuse, and in understanding in aggregate how visitors move between the pages of our own Website so that we can improve it. This processing happens on our server, using the information your browser sends with every request; we place no cookie or script on your device for it and store no IP address, and we consider it necessary to deliver and secure the pages you ask for. You may still object to it under Article 21 — see Section 13 — and you can exercise all other rights described in Section 13 in respect of this data.

Retention is 90 days, after which Microsoft deletes the data automatically. Microsoft's privacy practices are described in the Microsoft Privacy Statement.

19.5 Study-Activity Counters

The Website offers optional study features that run entirely in your browser — a saved word deck, a study streak, points and badges (see Sections 2.4 and 17). Because those features keep everything on your own device and never send it to us, we had no way of knowing whether anyone used them at all. Some pages also carry a short lesson video, and we need to know whether those are watched and whether they help a reader find the next page. To answer those questions, and only those, we count nine kinds of event:

• game_start — someone interacted with a game or quiz page
• game_complete — a study activity was finished
• deck_add — a word was saved to the device-local deck
• streak_day — a study streak reached a new day
• pdf_download — a printable worksheet or word list was printed
• share_click — a share button was pressed
• video_play — a short lesson video was started
• video_onward — the link shown at the end of a lesson video was followed to another page
• arrival_engaged — a visit that opened directly on a flashcard, dictionary-word or sentence-word page showed some activity: a scroll, tap or keypress within its first 30 seconds, or a link followed to another page of this Website

We need arrival_engaged because, to protect our advertising account from automated traffic, those pages show no advertising to a visit that opens on them directly — typed, bookmarked, or opened from another app — and we want to know how many of those visits are people. It is sent at most once per page view, and only when the visit was active; nothing is sent for a visit that was not. It records that the visit was active, never what you scrolled to, tapped or typed.

Lesson videos are ordinary files served from our own server. No video player, script or cookie from YouTube or any other video service is loaded into the page, and nothing is downloaded until you press play. We record only that a video was started, and whether its closing link was followed. We never record how much of it you watched, when you paused, or anything else about how you watched it.

The share buttons on our articles, games and tools are ordinary buttons. Nothing from Facebook, X, WhatsApp, Reddit, Weibo or any other network is loaded into the page — no script, widget, pixel or cookie — unless you press one. Pressing one opens that service (or your device's own share sheet, or copies the link) with the page's address and title, and what you do there is governed by that service's own privacy policy. We record only that a share button was pressed, never which one.

19.5.1 Everything an event contains

• The event name, which must be one of the nine above. Our server rejects any other name.
• The path of the page it happened on — for example /games/tone-tiles — and only if that path is short, plain, lower-case text. Anything else, including any address containing Chinese characters, is discarded and recorded as (other). For arrival_engaged it is the section instead — /flashcards, /chs/englishflashcards, /dictionary or /sentences — never the word.
• A general category, such as “games”, “quizzes”, “flashcards” or “teachers”.
• For streak_day only, how long the streak is expressed as one of four bands — 1, 2-6, 7-29 or 30+. The exact number of days is never sent, because a precise, unusual figure could in principle help distinguish one visitor from another, and four broad bands make that far harder.
• For arrival_engaged only, how the visit arrived, as one of four values: none (typed, bookmarked or any other link), app, reminder or share (the tags described in Section 19.1).

19.5.2 What these events never contain

• No identifier of any kind. No account, no visitor or device identifier, no cookie. Our server does not read a cookie when it receives these events and your browser is instructed not to send one, and we do not link two events to each other, to any other request, or to any earlier or later visit. Like any request, an event reaches our server with your IP address and a time, which are handled only as described in Sections 19.2 and 20.1. In particular, the identifier that the leaderboard uses (Section 17) is not attached to them.
• No content. No text you submitted for translation, no word you saved, no score, no nickname and no share text. When you save a word we record that a word was saved — never which one. When you play a lesson video we record that it was started, never how long you watched. Our server enforces this rather than trusting the page: it accepts only the four fields described above, in a restricted character set that Chinese characters and tone-marked Pinyin cannot pass.
• No new information stored on your device. These events add no cookie and no browser storage of their own. They do use information generated on your device — that an activity finished, that a visit was active, and the streak band derived from the streak the study feature keeps there at your request — which is why, where the GDPR applies, they need your consent (Section 19.5.3).

19.5.3 Legal basis, your choices and retention

These events are sent by script running in your browser and use information generated on your device, so where the GDPR or UK GDPR and the ePrivacy rules apply — the EU/EEA, the UK and Switzerland — the legal basis is your consent (Article 6(1)(a) GDPR and Article 5(3) of the ePrivacy Directive). Our script asks the consent message described in Section 12 before it sends anything: it sends events only if you consented to storing or accessing information on your device and to measuring content performance, it sends nothing if you declined or while you have not yet chosen, and it stops as soon as you withdraw. If the consent message cannot load — for example because a content blocker stops it — nothing is sent. Withdrawing consent does not affect events sent before you withdrew.

Where those laws do not apply, we rely on our legitimate interest in understanding whether the features of our own free service are used, so that we can decide what to maintain and what to improve. The data carries no identifier, is never used for advertising, personalization or profiling of any kind (Section 8), and is never shared or sold.

You can switch them off. Besides declining or withdrawing consent (Section 12), we honour the Global Privacy Control signal and the browser “Do Not Track” setting for these counters everywhere: if either is enabled, your browser sends no study-activity events at all, and every feature of the Website continues to work exactly as before. These events are stored with the rest of our Application Insights data and are deleted after 90 days (Sections 9 and 19.4).

19.6 Security and Access-Control Records

Sections 20 and 20.1 describe the checks we make to keep this free service available: a country check, a hosting-provider check on our data-heavy pages, an automated-client check, and request limits. Those checks are performed in memory and the information they examine — your IP address, your User-Agent, your request headers — is not stored. The result of a check is. So that we can tell whether these protections are working, whether they are catching the automated bulk copying they exist to stop, and above all whether they are wrongly refusing real visitors, the diagnostic record of a request may also carry:

• Whether the request was refused, and under which rule — for example that it came from a restricted region, from a blocked crawler, from a commercial hosting range on a data-heavy page, or that it exceeded a request limit. Where a rule is being trialled, the record notes that the request would have been refused but was allowed through. Where a request was instead served without advertising (Section 20.1), the record says so and under which rule.
• Which limit was reached, where a request was rate-limited: the kind of page (translation, flashcards, audio or analytics), the kind of ceiling (per-address hourly, request-fingerprint hourly, or endpoint), and whether the client claimed an allowlisted crawler name. Nothing identifies who was limited; the record says only that a limit of that kind was reached.
• Crawler verification, for requests claiming an allowed crawler name: verified, claimed but unmatched, or unknown; a short reason such as a range match, an untrusted proxy, or unavailable verification data; and whether the check was auditing or enforcing. Verification uses the provider's published network ranges in memory. The diagnostic record contains no raw IP address, User-Agent string or DNS name.
• On our data-heavy pages only — the flashcard decks, dictionary entries, sentence bank and site search named in Section 20 — a three-part description of what the request appeared to be: which browser family its User-Agent claimed (one of nine values, such as “chrome”, “safari”, “crawler” or “other”); for Apple browsers, whether that User-Agent named a version newer or older than a fixed cut-off (one of three values); and whether the request carried the ordinary browser headers, as a single value out of four (“none”, “accept-language”, “sec-fetch” or “both”). This exists because the automated copying we are defending against sends a perfectly ordinary browser User-Agent, so “is this a bot?” cannot be answered from the User-Agent alone.

Every value above comes from a short fixed list that we define in our own code — for the browser profile, nine possible values, then three, then four — and nothing a visitor sends can add to it. That is the privacy control, and it is deliberate: a record of this kind could easily have been the raw User-Agent string, which alongside a country would be detailed enough to help single someone out. A category out of nine is not. These values describe the shape of a request, never its content, never who made it, and they are never combined with anything to build a profile, never used for advertising, personalization or automated decision-making about you (Section 8), and never shared or sold.

This information is held only in the Application Insights data described in this Section, is subject to the same IP masking (Section 19.2) and the same 90-day deletion (Sections 9 and 19.4), and rests on the same legal basis: our legitimate interests under Article 6(1)(f) of the GDPR in the security and availability of our network and information systems and in preventing abuse of a free service, a purpose expressly recognised in Recital 49 of the GDPR. You may object under Article 21 — see Section 13.

19.7 Contextual-Link Experiment Counts

Activity results also offer three next-step cards. We count a card when at least half is visible and its first click, using only the fixed rule (same words, learning path or related resource), activity type and pattern label. These activity_next_step_impression and activity_next_step_click counts follow the consent and privacy choices below; they carry no words, URLs, identifiers or stored learning progress. They cannot measure people or sessions. A requested word-game handoff is usable for 15 minutes in local storage and is removed when the target game reads it. When needed, readings are resolved through a dictionary POST request; saved-deck quest words stay on your device. Words are never placed in a request URL or analytics event. Local path progress helps choose a next step and is not sent to analytics.

On the Pinyin Without Tones translator, we may compare an extra spelling-check link with the existing page. Each page response is assigned at random to show the link or keep the existing copy. We count next_step_exposure when a reader reaches that position and next_step_click when its link is followed, at most once each per page load. A click is not proof that the next page loaded.

These counts contain only the fixed experiment label d133, source /PinyinNoTones, destination /tools/pinyin-checker or the existing /PinyinTranslation tip, and the arm (control or link). We count only the first onward click at that position per page load. The server accepts only these fixed choices. No typed text, address supplied by the browser, identifier or timestamp is included. Assignment adds no cookie or browser storage, and may change on reload. Your browser omits cookies when sending a count.

These counts have the same purpose, consent rule, choices and 90-day retention described in Section 19.5.3. Do Not Track and Global Privacy Control disable them. We do not connect them to a person, session, destination arrival or earnings. The link works even when counting is unavailable.

---

20. Geographic Availability & Access Restrictions

The Website is not available in every country. To protect the integrity of our advertising and to control infrastructure costs, we restrict access from certain regions and from certain automated crawlers. Requests from a restricted region or from a blocked automated client receive an HTTP 403 Forbidden response. Other requests we identify as automated are generally not refused: we serve the page as normal, without advertising (Section 20.1).

To apply this restriction we compare your IP address against a list of published country IP ranges at the moment of your request. This check happens in memory, during the request. We do not log, store, or share your IP address for this purpose. We do keep a record that a request was refused and under which rule — never by whom — so that we can tell whether the restriction is working and whether it is refusing anyone in error; that record carries no IP address and is described in Section 19.6. Where the GDPR applies, the legal basis is our legitimate interests (Article 6(1)(f)) in protecting the service against abuse and in maintaining the commercial viability of a free service.

On our data-heavy pages only — flashcard decks, dictionary entries, sentence bank, site search, and selected practice tools and games that expose reusable content banks — we additionally compare your IP address against a published list of commercial hosting-provider (data-centre) ranges, because automated bulk copying of those pages runs on rented servers rather than on home or mobile connections. This check is made in memory, during the request, against a list stored on our own server; we do not log, store or share your IP address for it, and we make no request to any third party to perform it. As above, the outcome of this check is recorded without any IP address, as described in Section 19.6 — which also covers the coarse description of the client that these pages, and only these pages, attach to a diagnostic record. A request to those pages from such a range is served as normal, without advertising, rather than refused. On our other pages the same comparison may be made, and its only possible effect there is the same: the page is shown without advertisements. If you use a corporate or privacy VPN you may therefore see some pages without advertisements; nothing is withheld from you.

The list of restricted regions may change at any time. If you believe your region has been restricted in error, or that a connection of yours has been misidentified, please contact us at the address in Section 22.

20.1 Request Limits and Automated-Access Protection

Some games request a small practice set from our server using the selected difficulty or quest number. These requests do not send your answers, saved word list, microphone recording or handwriting. The practice-set service does not create a player profile or store your selections; normal request limits and the security records described above still apply. Local-only recording and drawing features continue to process that input in your browser.

Self-hosted lesson videos also have request, simultaneous-download and data-transfer limits. Pressing play requests a short-lived playback token valid only for that video and network address (IPv6 addresses share a network-prefix limit). The token contains no IP address, uses no cookie or browser storage, and expires after ten minutes. Per-network counters are held in memory for at most one hour; site-wide transfer totals contain no visitor identifier and reset daily. Playback tokens are removed from Application Insights URLs. If video delivery is temporarily unavailable, the lesson and transcript remain readable.

To keep this free service available and to prevent automated bulk extraction of our dictionary data, we limit how many requests a single visitor may make in a given period. Enforcing this requires us to count requests, and to do that we must be able to tell one visitor from another.

For that purpose we process, in memory and only for the duration of the counting period:

• Your IP address;
• Your browser's User-Agent string;
• Whether your request carried the ordinary headers a web browser sends (such as Accept-Language and Sec-Fetch-*), which distinguishes a browser from an automated script;
• In some cases, your Accept-Language header and the opaque session-cookie identifier described in Section 2.4, as a secondary check.

These counters are held only in our server's memory, are keyed to short fixed periods (at most one hour), and are discarded when the period ends. They are never written to disk, never attached to your translations or any other content, never used to build a profile, and never shared with anyone. Your IP address is not stored in our operational analytics either — see Section 19.2. If your request exceeds a limit, we return an HTTP 429 Too Many Requests response.

What is kept beyond the counting period is the outcome: our diagnostic records note that a limit of a particular kind was reached, and on our data-heavy pages a coarse description of the kind of client the request appeared to come from. Neither carries your IP address, your User-Agent string or the session-cookie identifier, and neither can be traced back to you. Section 19.6 sets out exactly what those records contain and how long they are held.

On the translation pages only, a request that exceeds a limit also starts a short waiting period before the next translation is accepted — a few seconds the first time, and longer if the limit keeps being exceeded. So that repeat and one-off events can be told apart, we hold a count of these events and the time of the most recent one, keyed to your IP address, in our server's memory for up to 24 hours; the record is erased after 24 hours without a further event, and is erased in any case when our server restarts. It is never written to disk, never linked to your translations or anything else you do on the site, and is used for nothing but deciding how long that waiting period should be. Ordinary use of the site — including flashcards, games, quizzes and audio playback, however rapidly you click — never creates such a record.

When these checks conclude that a request comes from an automated script rather than a person's browser, we usually do not refuse it: we serve the page as normal, without advertising. Where the evidence is unambiguous — a request for a web address our own pages stopped issuing, or a browser identification the request itself contradicts — we also hold that IP address, and the time the record expires, in our server's memory for up to one hour, so that the rest of that connection's visit is also shown without advertising. The record is never written to disk, is erased after one hour or when our server restarts, never limits what you can read, and is used for nothing but deciding whether a page carries advertisements; it is never used to choose which advertisements you see. If you share a connection with such a script, the only effect on you is that pages may show no advertisements for up to an hour.

Where the GDPR or UK GDPR applies, the legal basis is our legitimate interests under Article 6(1)(f) in the security and availability of our network and information systems and in preventing abuse of a free service — a purpose expressly recognised as a legitimate interest in Recital 49 of the GDPR. This processing is strictly necessary to deliver the service you requested and to keep it running, so it does not depend on consent; it is not used for advertising or personalization. You may object to processing based on legitimate interests (see Section 13), though we may be unable to serve requests we cannot rate-limit.

Children. Recital 38 of the GDPR provides that children merit specific protection and weighs against legitimate interests where a child’s data may be involved. The Website is not directed to children and offers no children’s content (Section 14), so we do not expect this processing to concern children. We have nonetheless assessed the balance on the assumption that it might: the data is limited to IP address, User-Agent and request metadata, is held in memory only, is retained for no more than one hour except for the strike record described above, is never used to build a profile of any individual and never used for advertising, and without it the free service could not be kept available. See Section 14.4.

---

21. Affiliate Links

Some pages — principally How to Learn Chinese, Compared and Recommended Resources — link out to third-party learning tools, tutoring services and online retailers, including Amazon. Some of those outbound links may be affiliate links, meaning we may receive a commission if you sign up, book a lesson or buy something after following one. Where such a link is live, a disclosure is shown on the page above the link and the link is marked rel="sponsored". Where no disclosure is shown, no affiliate arrangement is in place.

21.1 We collect nothing when you click one. An affiliate link is an ordinary hyperlink. We do not add a tracking parameter of our own, we set no cookie and store no identifier when you follow one, and we do not record which link you clicked or whether you clicked at all. We share no personal information with the destination.

21.2 What happens on the other side is theirs. Following the link takes you to a third-party website, at which point that operator’s own privacy policy governs. It may set cookies or identifiers of its own — typically a referral cookie lasting around 24 hours, in Amazon’s case — and it is an independent controller of any data it collects, including anything you go on to do there. We have no access to that data and no control over it, and we cannot delete it for you; a request about it goes to that operator. See also Section 6 (third-party services) and Section 10 (data sharing).

21.3 What we receive. Only aggregate, non-identifying reporting from the affiliate programme — for example, a count of referrals or of items ordered in a period, grouped by which section of this Website they came from. We do not receive your name, email address, delivery address, payment details or any other personal information about you, we are not told what any individual bought, and we cannot connect any referral to a visit to this Website.

21.4 Consent. Because we set nothing and collect nothing at the point of the click, no consent is required from you for this on our side. Section 20 of our Terms of Service sets out the editorial position: nothing on this Website is ranked, described or worded differently because of a commercial arrangement.

---

22. Contact Information

Privacy Contact
2705463 ONTARIO INC.
Data controller for the purposes of the GDPR, UK GDPR and Swiss FADP
Email: thepurelanguagecom@gmail.com
Website: www.thepurelanguage.com

We have not appointed a Data Protection Officer, and we are not required to: we are not a public authority, we carry out no large-scale regular and systematic monitoring of individuals, and we process no special categories of data on any scale (GDPR Article 37(1)). The address above reaches the person responsible for privacy questions, and it is the correct address for any request under Section 13.

This Privacy Policy is a notice of how we process personal information. It is not a contract, and using the Website is not consent to any processing that requires your consent.