HanziHeart
Privacy Policy for HanziHeart
App-specific privacy information for HanziHeart, its website pages, and related services.
HanziHeart
App-specific privacy information for HanziHeart, its website pages, and related services.
Last updated: 28 August 2026
This Privacy Policy explains how Gladiolus Limited, using HanziHeart as an app brand/trading name ("HanziHeart", "we", "us", or "our"), collects, uses, stores, and shares personal data when you use the HanziHeart app, website pages, and related services (together, the "Service").
HanziHeart is not a separate legal entity. For UK GDPR and Data Protection Act 2018 purposes and, where applicable, the EU GDPR, Gladiolus Limited is the data controller for the personal data described in this Policy, except where a third party acts as an independent controller for its own services, such as Apple, Google, or app stores.
Some features described in this Policy may not be available to all users, devices, platforms, subscription tiers, or countries.
HanziHeart helps users understand Chinese text. You paste or type a line, import a screenshot, capture a photo of text, or use the HanziHeart keyboard where available, and HanziHeart produces a "read" of the line — the literal meaning, the natural meaning, cultural context, the emotional read, tone, key words, and suggested replies. HanziHeart may also provide companion-style practice, saved words or reads, audio pronunciation, share cards, widgets or Lock Screen content, and related learning features.
Depending on how you use the Service, we may collect or process the following categories of personal data:
If you import a screenshot or capture a photo of text, HanziHeart recognises the Chinese text on your device. The screenshot or photo image itself is not uploaded to us or to the AI provider.
Only text extracted from the image — such as the Chinese line or supporting text needed to identify the relevant message — is sent to our service to generate the read, in the same way as a line you paste or type. We do not store the original image, and we do not receive your photo library contents.
HanziHeart may check clipboard text locally to suggest a vibe check for copied Chinese text. Clipboard text is not sent to our service unless you choose to use it for a read.
If you enable the HanziHeart keyboard, the keyboard may require Full Access so it can use network access, the shared app session, and screenshot import. The keyboard may request Photos access to load a screenshot you choose or the latest screenshot for text extraction. Screenshot recognition still runs on device, but extracted or pasted text is sent to the service when you ask for a vibe check.
HanziHeart is a language-reading tool, not a place for sensitive records. Please do not submit passwords, payment card numbers, government identifiers, health or medical information, confidential business information, or other people’s private messages, screenshots, or photos where you do not have a lawful basis or permission to do so. The text you submit is sent to an AI provider to generate your read (see Section 6).
HanziHeart does not use personal data for third-party advertising or cross-app advertising tracking.
We do not expose an inviter’s or invited friend’s email address, name, subscription details, or other personal information to the other participant. A participant may see aggregate invite progress, claim or reward status, and their own codes, but not the other participant’s personal account information.
Where we create aggregated or anonymised information that no longer identifies you, we may use it to understand usage trends, improve reliability, and develop the Service.
When you ask HanziHeart to read a line, the text of that line is sent through our service to a third-party AI model provider to generate the result. For screenshot and keyboard screenshot flows, this may include extracted text needed to identify the relevant message. The result may include the read, tone estimate, dictionary-style explanations, practice content, and suggested replies.
The AI provider may process the submitted text, the generated output, and technical metadata under its own terms and privacy practices. Depending on the provider used, this processing may take place outside your country of residence, including in the United States, United Kingdom, European Economic Area, People’s Republic of China, or other provider locations. Some AI providers may use submitted inputs or outputs to improve their services unless restricted by their terms or settings.
Where optional search enrichment is enabled, the submitted text may also be used to build a search query for current slang, meme, or cultural context. We do not send your account contact details or payment information to the AI provider as part of a normal read request. AI outputs may be inaccurate, incomplete, or unsuitable for your needs, and HanziHeart is not a professional translation, legal, medical, or relationship-advice service.
We do not currently:
If any of these practices change, we will update this Policy and provide any required notices, consents, or opt-out mechanisms under applicable law.
We may share personal data with service providers that process data on our behalf, and with professional advisers, regulators, law enforcement, or authorities where legally required. We do not sell your personal data and do not use it for cross-app advertising tracking.
| Recipient category | Purpose | Data categories | Country or region |
|---|---|---|---|
| Cloud hosting, database, and authentication providers | Account access, app data storage, account deletion, service reliability, usage metering, and security. | Account identifiers, email address, authentication/session metadata, preferences, saved reads, saved words, onboarding profile data, subscription state, affiliate attribution, friend-invite and reward records, analytics events, the text submitted to read, and related app data. | May include the UK, EEA, United States, and other provider or support locations. |
| AI model providers | AI reading of submitted Chinese text, extracted screenshot or camera text, dictionary-style explanations, practice content, and suggested replies. | The submitted line of text or extracted text, generated request/response content, and technical metadata needed to provide the result. We do not intentionally send contact or payment details as part of normal read requests. | May include the United States, United Kingdom, EEA, People’s Republic of China, and other provider locations depending on the provider used. |
| Subscription entitlement providers | Subscription entitlement management, purchase restoration, trial status, renewal status, and subscription events. | App user ID or customer ID, product ID, entitlement ID, purchase state, trial/renewal/expiry/cancellation/billing-issue metadata, app-store environment, offer-code and friend-invite qualification status, and related subscription events. | May include the United States, EEA, and other provider locations. |
| App store, platform, and sign-in providers | App distribution, sign-in, in-app purchases, subscriptions, billing, refunds, platform permissions, keyboard extension support, widgets, system speech/sharing tools, and on-device text recognition. | Account-linked identifiers, email address or private relay address where provided, purchase/subscription metadata, refund status, local keyboard session data, and device/app-store metadata. On-device text recognition runs locally and does not send your screenshots or photos to us for text extraction. | Platform providers operate globally and may process data in multiple countries depending on the relevant service. |
| Product analytics and crash-reporting providers | Understanding feature usage, onboarding and subscription funnels, reliability monitoring, crash reporting, error diagnosis, and abuse prevention. | App events, anonymous install identifiers, app user ID where signed in, device and platform information, app version, timestamps, safe event properties such as screen or feature names, and crash or error details. We do not intentionally send raw submitted Chinese text, OCR text, reply text, screenshots, photos, account contact details, or payment details to these providers. | May include the United States, EEA, and other provider locations. |
| Search or context providers, where configured | Optional current slang, meme, or cultural-context enrichment for selected read requests. | Search query derived from the submitted text and technical metadata needed to return search context. | May include the United States and other provider locations. |
Where a provider acts as our processor, we aim to use provider data processing terms or equivalent contractual terms covering processing instructions, confidentiality, security, assistance with user rights, retention, deletion, and breach support. Some app store, platform, billing, and sign-in providers may also act as independent controllers for their own services.
We are based in the United Kingdom. Some providers we use may process personal data outside your country of residence, including in the United Kingdom, European Economic Area, United States, People’s Republic of China, Canada, Asia Pacific countries and regions where HanziHeart is made available, or other countries where they operate. The recipient-category table above identifies material provider categories that may involve overseas processing.
Privacy and data protection laws in those countries may differ from the laws in your country of residence. By using HanziHeart, you understand that personal data may be processed in those locations, subject to this Policy, applicable law, and any safeguards required for the relevant transfer.
Where you submit a line to be read, that text is sent to an AI provider, which may process it outside the UK depending on its infrastructure. Depending on the provider used, AI processing may include the People’s Republic of China or other provider locations. Where applicable privacy law requires safeguards for international transfers, we use appropriate measures such as adequacy decisions, approved contractual terms, data processing agreements, or other lawful transfer mechanisms.
If Gladiolus Limited or HanziHeart is involved in a merger, acquisition, financing, reorganisation, insolvency process, sale of assets, assignment, change of control, or similar transaction, personal data may be transferred to the acquiring or successor entity as part of that transaction.
The successor entity will continue to process personal data in accordance with this Policy, applicable law, and any required notices, consents, and opt-out rights. If we materially change how personal data is used, shared, sold, licensed, or processed after a transfer, we will provide notice and obtain consent or apply required mechanisms under applicable law.
| Data category | Typical retention | Notes |
|---|---|---|
| Account and subscription data | Active account plus up to 24 months | Longer where needed for legal, fraud-prevention, support, tax, accounting, or dispute reasons. |
| Affiliate attribution and friend-invite records | Active account plus up to 24 months | Includes inviter and invited-friend account identifiers, codes, claim and reward status, timestamps, and related subscription events. Limited records may be retained longer to enforce programme limits, prevent fraud, reconcile refunds, or resolve disputes. |
| Saved reads, saved words, share preferences, and app preferences | Until deleted, account deletion, or no longer needed | User-controlled app content used to provide the Service. |
| Keyboard extension session data | Until sign-out, account deletion, token expiry, or local app data removal | Stored locally so the keyboard can use the Service while you are signed in. |
| Account deletion requests | Deleted or anonymised within 30 days after verification | Limited records may be kept where legally, technically, or security-required. |
| Support records | Up to 6 years | Used for business records, disputes, and legal claims. |
| Product analytics events | Usually up to 24 months | Used to understand app usage, onboarding, subscription funnels, reliability, and product performance. Aggregated or anonymised information may be kept longer. |
| Diagnostics and security logs | Usually up to 90 days | Longer if needed to investigate abuse, security incidents, or reliability issues. |
Subject to applicable law, you may have the right to request access to your personal data, correction of inaccurate data, deletion of your personal data, restriction of processing, to object to processing based on legitimate interests, to withdraw consent where processing relies on consent, to opt out of certain sale, sharing, targeted advertising, direct marketing, or profiling practices where applicable, and to request portability of certain data.
You can request account deletion or exercise privacy rights by contacting hanziheart-privacy@gladiolus.dev. You can also read the account deletion section on HanziHeart Support for the deletion request process.
We may ask you to verify your identity or clarify your request before responding. We will respond within the period required by applicable law. Some rights are not absolute and may be subject to legal, security, fraud-prevention, record-keeping, or other lawful exceptions.
This Policy is intended to apply globally. The sections above explain the main facts about HanziHeart’s collection, use, sharing, AI processing, retention, security, and international transfers.
If UK data protection law applies, you may have rights to access, correct, delete, restrict, object to processing, withdraw consent where processing relies on consent, and request portability of certain personal data. You may complain to the UK Information Commissioner’s Office.
If the EU GDPR or other EU data protection law applies to your use of HanziHeart, you may have rights to access, correct, delete, restrict, object to processing, withdraw consent where processing relies on consent, data portability, and to lodge a complaint with your local EU data protection supervisory authority.
We have appointed an EU representative under Article 27 GDPR — FGND Core GmbH, Hauptstrasse 151, 10827 Berlin, Germany, hanziheart@core-privacy.eu — for GDPR-related privacy matters and requests from EU supervisory authorities and individuals in the EU.
If United States federal or state privacy law applies, including where applicable California privacy law, you may have rights to know or access personal information, request deletion, request correction, obtain information about categories of data collected, sources, purposes, and disclosures, opt out of sale or sharing of personal information or targeted advertising, limit certain uses of sensitive personal information, and not be discriminated against for exercising privacy rights. HanziHeart does not currently sell personal data, share personal data for cross-context behavioural advertising, or use personal data for third-party targeted advertising.
If Canadian privacy law applies, you may have rights to access personal information we hold about you, request correction, withdraw consent subject to legal or contractual restrictions, and challenge our compliance. We collect, use, and disclose personal information for the purposes described in this Policy and aim to limit collection, use, disclosure, and retention to what is reasonable for those purposes.
If privacy law in an Asia Pacific country or region where HanziHeart is available applies to your use of the Service, you may have local rights to be informed about processing, request access to or correction of personal data, request deletion or erasure where available, withdraw consent, object to or restrict certain processing, request portability where available, and contact us or a local privacy regulator with complaints. This may include privacy laws in places such as Australia, New Zealand, Singapore, Malaysia, Thailand, the Philippines, Indonesia, Japan, Korea, Hong Kong, Taiwan, and other Asia Pacific countries or regions where HanziHeart is available.
We describe the purposes of processing, categories of data, disclosures, security, retention, overseas processing, and service-provider accountability in this Policy. We will handle privacy requests, notices, and complaints in accordance with applicable local law where it applies.
HanziHeart is generally intended for people aged 16 or older and is not directed to anyone below the applicable minimum age. The localized minimum is 15 in Korea and 18 in Brazil, where the app may be displayed with an A18 rating. If local law or the applicable app-store rating requires a higher minimum age, that higher age applies.
If you meet the applicable minimum age but are under the age of legal adulthood in your country or region, a parent or legal guardian should review this Policy and be responsible for your use of the Service. We do not knowingly collect personal data from anyone below the applicable minimum age or knowingly use children’s personal data for marketing, advertising profiling, or cross-app tracking. If you believe someone below the applicable minimum age has provided personal data to HanziHeart, contact us using the details below so we can investigate and delete it where required.
We use reasonable technical and organisational measures intended to protect personal data, including encryption of authentication tokens in transit and at rest. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a personal data breach, we will assess the likely risk, keep an internal record, work with relevant providers, and notify relevant regulators, authorities, app stores, and affected users where required by applicable law.
Our App Store privacy disclosures describe the data we collect and how we use it and should be read together with this Policy. They may identify data types such as name, email address, user ID, device ID, purchase history, product interaction, and other user content where applicable, linked to your identity where associated with an account, subscription customer, or device/session identifier.
Our website pages may use essential cookies and similar technologies for security, session management, and basic analytics. We do not use cookies for cross-site behavioural advertising. See our Cookies Policy for more detail.
Most browsers let you refuse or delete cookies. Some browser settings may affect website functionality. We do not currently respond to browser "Do Not Track" signals, but we honour the choices and opt-out rights described in this Policy where applicable.
The Service may link to third-party websites, app stores, support pages, payment flows, authentication providers, or other services. Those third parties are responsible for their own privacy practices. This Policy applies to HanziHeart’s collection and use of personal data, not to personal data you provide directly to third-party services.
We may update this Privacy Policy from time to time. We will post the updated version on our website and update the "Last updated" date above. Where required by law, we will take additional steps to notify you.
If you have privacy questions or want to exercise your rights, contact us using the details below.
Gladiolus Limited
71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, England
ICO registration reference: ZC112773
Privacy: hanziheart-privacy@gladiolus.dev
Support: hanziheart-support@gladiolus.dev
FGND Core GmbH
Hauptstrasse 151, 10827 Berlin, Germany
Email: hanziheart@core-privacy.eu
This contact is for GDPR-related privacy matters and requests from EU supervisory authorities and individuals in the EU.