Privacy & cookies

This notice describes the academy’s website and the HSK Duels learning game. Doinel Limited is responsible for the personal information it processes as controller. Doinel Chinese Academy is its standalone trading brand.

What happens when you browse

Our hosting providers process technical information needed to deliver and protect the site. This may include your IP address, browser and device details, requested pages, request times and security logs. We use this for our legitimate interests in operating a reliable, secure website and preventing abuse. Our website is hosted by Railway.

Academy pages do not add analytics trackers or third-party embedded videos. Fonts and images load from our website. Advertising in the HSK Duels game is described below. We do not sell account information or make automated decisions with legal or similarly significant effects.

HSK Duels accounts

HSK Duels stores your username, display name, password hash, learning progress, duel results, achievements and selected profile appearance. Your chosen display name, icon, frame, country or region, title and displayed medals can be seen by other players. Duel messages are available to the participants.

If you register or link an email address when email accounts are enabled, we use it for verification and password recovery, not marketing. Account emails are sent through Resend. Verification and reset links expire after 30 minutes and are single-use; expired token records are removed during account requests. Password resets revoke existing login sessions. Account and progress data remain stored so you can resume learning; privacy requests can be made to Doinel Limited using the contact details below.

Waitlist requests

When you join, we collect your name, email address, selected cohort, confirmation that you are 18 or over, the consent wording version and submission time. We use your consent to send the requested booking and availability updates for that cohort, or future cohort dates if selected. This does not subscribe you to a general newsletter. Joining the waitlist is free and does not reserve a place.

Requests are stored in the academy’s database on its persistent Railway storage. Access is restricted to authorised academy operators. We do not publish the list or share it with classmates. We review and remove inactive waitlist requests after 12 months; our routine clean-up removes entries older than that. A confirmed enrolment is handled under the student notice supplied before paid teaching begins.

The success screen gives you a private management link to remove a new sign-up and withdraw consent. Keep that link; do not share it. Duplicate requests do not replace the original link. You may also exercise your rights by writing to the registered address above. Every future cohort email must include a way to opt out.

Practice tools and access

The anonymous sample works without a sign-up. Its progress stays in the current page session. For confirmed learners, we store an email address, cohort, access status and expiry, a hash of the private access code, and word IDs you mark as learnt with update times. We use these records to deliver the tool as part of the course contract. We do not store the raw access code in the database. The tool is a self-study aid; its scores are not official exam results or proof of homework completion.

Full access normally lasts 12 months from confirmation and is extended during eligible pass support. Practice records are removed in routine clean-up 90 days after access expires. Course contracts, payment and support-claim records are handled separately under the information supplied before enrolment. No exam-result documents are uploaded through this practice tool.

Cookies and local processing

The academy does not set analytics or advertising cookies. When you unlock the tool, an essential, secure, HTTP-only access cookie named dca_access remembers access on that device for up to 30 days. It is checked against the current server-side enrolment record. Use “Lock access on this device” to remove it. Hosting infrastructure may use essential technology for security or access management. If non-essential cookies are introduced, we will explain them and request consent before they are set.

Your browser’s time zone is read on your device to display the first class time. The class-time display does not store it in a student profile. Bansho stores your account time zone to group daily progress and compare the same day across friends. Calendar files are generated on your device and downloaded only when you ask. Optional word audio uses your browser’s installed Mandarin speech voice, when available; its handling depends on your browser and operating-system provider. No microphone recording is requested by this tool.

Bansho accounts and offline practice

• Bansho stores your username, display name, time zone, hashed password and recovery code, friend requests, accepted friends, learning time, answers, exercise results and saved practice progress.
• The essential, HTTP-only bansho_session cookie keeps you signed in for up to 30 days. Log out to revoke the current session. A recovery code can reset your password and revoke existing sessions.
• Accepted friends can see your display name, username and learning statistics in comparisons. They cannot see your password, recovery code or saved answers. Remove a friend to end that access.
• Progress is also stored in your browser. Downloading the offline pack saves exercise files, audio and mock papers on that device. Pending activity syncs after you reconnect and sign in. Only use offline sign-in on a device you trust; cached progress remains on the device until its site data is cleared.
• The homepage shows an aggregate count of signed-in learners with a recently active session. It does not publish their identities.
• If you enable phone notifications, we store your Apple device token, account/session link and notification preferences. Apple Push Notification service delivers duel invitations and alerts when an accepted friend passes your all-time answer total. Notification queues are removed after seven days. You can disable either alert in Settings, revoke permission in iPhone Settings, or log out to remove that session’s device registration.
• Bansho sign-in requires no email address and Bansho itself sends no email. If you buy a paid membership, Stripe collects billing details and may send receipts. Bansho stores your Stripe customer, payment and subscription identifiers, plan, access dates and payment status; it never receives your full card details. These records link your purchase to your Bansho account and support billing, cancellation and refunds. Its account records are stored separately from course enrolment on the academy’s persistent Railway storage. You can request access or removal using the contact details below.
• Online exercise rankings use server-graded answers. Offline practice contributes to learning totals but is excluded from exercise rankings. These are self-study statistics, not official examination results.

HSK Duels advertising

• When advertising is enabled, free accounts may see Google H5 Games ads between completed games. Paid membership removes these placements.
• Google and its advertising providers may process IP addresses, device and browser information, cookies or similar identifiers, and ad interactions to deliver, measure and protect advertising.
• Where a consent message applies, you can accept or refuse the choices it presents. Reopen available choices from Account → Membership and payments → Ad privacy settings. Google may show limited or non-personalised ads according to the applicable settings.
• Our game does not send Google your username, learning answers, duel messages or payment details for advertising.
• See how Google uses information from sites and apps and Google’s privacy policy for provider processing, retention and international transfers.

If you contact us by post

We use your name, contact information and the contents of your correspondence to answer you. We rely on taking steps at your request before a contract, our legitimate interests in responding to enquiries and resolving concerns, or a legal obligation where relevant. Please send only the information needed for your request and avoid sensitive personal details unless necessary.

We normally retain routine enquiries for 12 months after the last contact, then delete them securely. Information needed for a dispute or legal obligation may be kept longer, limited to what is necessary. Access is limited to staff and service providers who need it.

Before you enrol

Enrolment will require an updated notice covering the actual services in use. We will identify the student information collected, payment processing, teaching platforms, homework handling, retention periods and contact details before requesting it. Stripe is planned as a payment provider, but it is not connected to this site.

Teaching is planned with teachers based in China, using Zoom or Tencent Meeting. Overseas access to student information can constitute an international transfer. Before any student data is shared for teaching, Doinel Limited must identify the recipients and locations, put the required processor terms and transfer safeguards in place, and provide the relevant details and a way to request a copy. This notice does not claim that those arrangements already exist.

We will not record classes by default. Any optional recordings, marketing emails or classmate contact sharing will have separate information and an appropriate lawful basis. Joining a cohort will not automatically subscribe you to marketing or make your private contact details available to other learners.

Security, providers and overseas processing

We use HTTPS, access restrictions, hashed access codes and limited data collection. To limit form abuse, our app temporarily stores request counts against a hash of the request IP, action and time window; it does not store raw IP addresses in that table. These counters expire and are removed during routine clean-up. Hosting security logs are separate. Hosting providers may process technical information in countries outside the UK, under their applicable service terms and privacy arrangements. Provider-managed technical log retention and international safeguards are described in their documentation. The site operator does not set a separate retention period for logs managed exclusively by those providers.

For more information, see Railway’s privacy policy. Doinel remains responsible for assessing the arrangements applicable to its use of these services.

Your rights

Depending on the circumstances, you can request access to your information, correction, erasure, restriction, portability, or object to processing based on legitimate interests. Where we rely on consent, you can withdraw it without affecting earlier lawful processing. Rights are subject to applicable exceptions.

Write to Doinel Limited at the address above, marking your correspondence “Chinese Academy — Privacy”. We may need proportionate information to verify your identity. We normally respond within one month and will explain any lawful extension.

You can complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint, or to the data protection authority available to you under applicable law. You do not have to contact us first.

Age and changes

The initial academy cohorts are intended for adults aged 18 and over. We do not knowingly invite children to submit information through this site. If we learn that inappropriate information has been provided, we will take appropriate steps to remove it.

We will update this notice when our processing changes and show the revision date above. Material changes affecting enrolled students will be communicated directly when that service is available.