Privacy Policy

HanziSkills is a free dictionary. You can read every character and word page without an account. This policy explains what is stored when you use the optional account and when you play pronunciation audio.

What we store

• Account: your email address, an optional display name, a scrypt hash of your password (if you set one), your preferred locale, and the saved characters/words you choose. We never store the password itself. If you sign in with Google, we store the Google account ID and verified email, but not Google access or refresh tokens.
• Session: a random session token in an HttpOnly cookie. The server stores only an HMAC of the token, an expiry date and basic request metadata (IP and user agent) for security.
• Recently viewed: when you are signed in, the last 100 character or word pages you open are stored on the server so you can return to them. You can clear this from your account page or by deleting the account. Search queries are not stored in this history.
• Local storage: recent characters, local favourites and your theme preference stay in your browser. They are not uploaded unless you are signed in and save a favourite.
• Audio requests: the character or word you request is sent to our self-hosted text-to-speech service and cached on the server. It is not linked to your account.
• Server logs: standard request logs (IP, user agent, timestamp, path) may be kept for security and rate limiting.

What we do not do

• We do not sell personal data.
• We do not run third-party advertising or cross-site advertising pixels.
• We do not use your saved characters to train a model.
• We do not require an account to read the dictionary.
• We do not send dictionary search text or saved characters to analytics.

Analytics

We use Google Analytics 4 (measurement ID G-3P7BPD5YYR) to understand which pages are used and how the dictionary can be improved. Google Analytics may set first-party cookies such as _ga and collect usage data (pages viewed, approximate location, device/browser, referrer). Our analytics page-view events send the path only; search query strings are not included in those events. We do not send saved characters or account email addresses to Google Analytics. You can opt out with the Google Analytics opt-out browser add-on or by blocking analytics cookies in your browser. See Google’s privacy policy.

Cookies

The only required cookie is the session cookie, set after you log in. It is HttpOnly, SameSite=Lax and Secure in production. Local storage is used for theme, recent characters and local favourites. You can clear both from your browser settings.

Retention and deletion

Account data is kept until you delete the account. The account page has a permanent delete action that removes the user, sessions, saved items, OAuth links and recently viewed history. You can also email [email protected] to request deletion. Audio cache entries contain only dictionary text and are not tied to an account.

Children

The dictionary is suitable for general learners, but accounts are intended for users aged 13 or older. If you believe a child has created an account, contact us and we will remove it.

Third parties

The site is served from our own server. Pronunciation audio is generated by a self-hosted TTS engine. Dictionary data is derived from CC-CEDICT, Make Me a Hanzi, OpenCC and wordfreq; those projects are credited on the About page. The only third-party script is Google Analytics 4, described above. No advertising network or social tracking pixel is loaded.

Changes and contact

If this policy changes, the effective date above will be updated. Questions can be sent to [email protected]. See also the terms of use.