MengYin Study
Privacy Policy
MengYin Study is a revision and practice app. We keep data collection to a minimum: no advertising, no behavioural tracking, and no selling of personal data. This policy explains what we collect, why, where it is stored, and how you can inspect, export or delete it.
01Scope
This policy covers the MengYin Study website, the desktop app, and the deck, practice, exam, AI-generation and cloud-sync features both provide.
It does not cover the AI endpoint you configure yourself, the Google or GitHub sign-in pages, or any other external site. Those are run by their own operators under their own privacy policies.
In this policy, “we” means MengYin Study and “you” means the person using the service.
02What we collect
The table below is the complete list. Only the rows marked “cloud” ever leave your device.
| Data | Contents | Stored in |
|---|---|---|
| Account | Email address, display name, avatar URL, sign-in method, sign-up date | Cloud (Supabase) |
| Google Sign-In | Google account ID, name, email address and avatar URL (only when you choose Google Sign-In) | Cloud (Supabase Auth) |
| Your decks | Title, description, tags, questions and answers | Cloud (readable only by your account) and this device |
| Progress | Attempts, mistakes, notes, review schedule, exam results | Cloud (readable only by your account) and this device |
| AI settings and materials | API base URL, key, model, material files and extracted text | This device only |
| Preferences and offline cache | Language, theme, text size, practice preferences, cached decks | This device only |
| Technical logs | IP address, browser type, request time and path | Short-lived logs at Cloudflare and Supabase |
- Account data exists only once you register or sign in. You can also practise entirely as a guest, on your own device.
- Passwords are stored by Supabase Auth as an irreversible hash. We never see the plain password and cannot recover it.
- When you sign in with Google or GitHub, that provider gives us an account identifier, a display name and an avatar URL. We do not receive your password or any other data from that account.
- We never ask for your phone number, address, date of birth, payment details or identity documents.
03Google Sign-In and Google API data
Google Sign-In is optional. If you choose it, we request only basic profile data from Google: your Google account ID, email address, display name and profile picture URL (OAuth scopes: openid, email, profile). We do not request access to Gmail, Google Drive, Google Calendar, Contacts, Photos or any other Google service.
We use this data only to create and authenticate your account, display your name and avatar, and sign you in. We do not use Google user data for advertising, behavioural analytics, profiling, sale or rental, and we do not use it to train AI models. We do not share Google user data with third parties except the infrastructure providers needed to run the service (Supabase and Cloudflare) or where the law requires it.
MengYin Study's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is not used to provide or improve other apps, devices or AI models.
- You can delete your account at any time from the Account page; the account data linked to your Google sign-in is deleted with it. You can also write to us to request deletion.
- To revoke Google access, open your Google Account’s Security → Third-party apps & services and remove MengYin Study. After revocation you can no longer sign in with Google, but you can use email and password.
- Google's Privacy Policy and Google API Services User Data Policy apply to Google's handling of your data.
Google APIs are used only for sign-in, never for AI generation. We do not use Google APIs, and we do not permit anyone to use the app or its AI feature, to create, generate or distribute AI-generated non-consensual intimate imagery (AI NCII), child sexual abuse material, sexualised content, or content that harasses or degrades another person.
04How we use it
- To provide the service: signing you in, syncing across devices, showing progress, scheduling reviews and computing statistics.
- Security and abuse prevention: spotting unusual sign-ins and protecting your account and the integrity of your data.
- Support: answering your questions and handling access, correction, export or deletion requests.
- We do not currently use your data for behavioural analytics, advertising or profiling. If we ever add analytics, we will update this policy first and provide a way to opt out.
Where the law requires us to name a legal basis (for example the EU General Data Protection Regulation), we rely on performance of our contract with you (providing the service), our legitimate interests (keeping the service safe and improving it), and your consent where you have explicitly given it.
05AI generation and your API key
AI generation uses an API endpoint and key that you obtain yourself (any OpenAI-compatible service). The key stays on your device and is never uploaded to our servers.
When you start a generation, the app sends your prompt, the material excerpts you selected and your question settings from your browser straight to the endpoint you configured. That endpoint may be in another country and its operator will handle that content under its own policy, which may include logging requests or using content to train models. We do not proxy, relay or store those requests.
- Materials are parsed on your device, and the app deletes the files and the extracted text as soon as generation finishes.
- We never receive your materials, prompts or generated output. A deck is uploaded to your account only when you are signed in, and only your account can read it.
- Do not put content you would not want disclosed into your materials, and prefer an endpoint you trust. You are also responsible for following that AI provider’s terms.
The app and its AI generation feature are for academic revision only. We do not use Google APIs, and we do not permit anyone to use the app or its AI generation feature, to create, generate or distribute AI-generated non-consensual intimate imagery (AI NCII), child sexual abuse material, sexualised content, or other content that harasses or degrades a person. Such content is prohibited and may result in account suspension.
06Sharing
We do not sell, rent or trade your personal data for marketing. We share it only in these cases:
- Service providers: Supabase (database and authentication), Cloudflare (static hosting and content delivery), and Google or GitHub (only when you choose that sign-in method). They may process data only to provide those services.
- Legal requirements: where required by law, a court order or a competent authority, and only to the extent necessary.
- Protecting rights: where necessary to prevent fraud or abuse, or to keep the service and its users safe.
Your decks and progress are private by default. The database isolates every account with row level security, so an ordinary account cannot read another learner’s data or promote itself to administrator. Official decks are public content and contain none of your personal data.
07Where data lives and cross-border transfer
- Account and synced data live in a Supabase PostgreSQL database, currently in the Asia Pacific (Seoul) region.
- Static site files are served from Cloudflare’s global network.
- Your synced data may be transferred outside your country. We rely on our providers’ standard data protection terms for those transfers.
- AI requests go from your browser straight to the endpoint you configured, never through our servers, so they are not part of the transfers above.
08Retention
- Account data and synced content: kept until you delete your account or ask us to.
- On-device data: kept on your device until you clear it in the browser or the app.
- Technical logs: kept for our providers’ short default retention periods and then discarded.
- After deletion: we remove or de-identify the data, and existing backups are overwritten in the next backup rotation.
09Your rights
Under Taiwan’s Personal Data Protection Act, and under other laws where they apply to you (such as the EU General Data Protection Regulation), you may:
- Access and obtain a copy: choose Export backup in Settings → Data to download a JSON file containing your decks, attempts and notes.
- Correct: change your display name on the Account page, or ask us to correct anything else.
- Delete: choose Delete account on the Account page. The account, cloud decks, progress and notes are erased immediately and permanently. If you can no longer sign in, write to us and we will delete the account for you.
- Restrict or object to processing, or withdraw consent: just write to us; this does not affect what happened before.
- Complain: to Taiwan’s personal data authority, or to the data protection authority where you live.
We will not refuse service or treat you differently for exercising these rights. Guest data exists only on your device, so clearing your browser data removes it.
10Children and teenagers
The service is not designed for children under 13, and we do not knowingly collect personal data from them. If you are under 18, please use it with the consent of a parent or guardian. If we learn that we have collected a child’s data, we will delete it promptly.
11Cookies and local storage
- We use no advertising or tracking cookies, and no third-party analytics or social trackers.
- The app uses browser storage (localStorage and IndexedDB) for your session, preferences, offline decks and AI settings. These are necessary to provide the service.
- You can clear your browser data at any time. You will then need to sign in again and offline decks will re-download.
- The desktop app keeps its own local storage, which you can remove together with the app.
12Security
- All traffic to our servers uses TLS encryption.
- The database restricts access with row level security: only your account can read and write its own data.
- Passwords are stored as hashes by Supabase Auth; our staff never see them.
- No system can be guaranteed completely secure. If a breach affects your rights, we will notify you as the law requires and explain what was affected and what we are doing about it.
13Changes to this policy
We may update this policy, for example when we add a feature or change a provider. Material changes will be announced in the app and the version and effective date on this page will be updated. Continuing to use the service means you accept the updated policy.
14Contact us
For questions about privacy, your account or these terms, contact us through the channels below. We reply within 30 days.