Privacy Policy

Last updated: May 27, 2026

RushMandarin ("RushMandarin," "we," "us," or "our") operates the RushMandarin web application at app.rushmandarin.com, the RushMandarin browser extension, and the website at rushmandarin.com (collectively, the "Service"). This Privacy Policy explains what information we collect, how we use it, who we share it with, and the choices you have.

By using the Service, you agree to the collection and use of information in accordance with this Privacy Policy.

This Service is operated by RushMandarin LLC.

1. Information We Collect

1.1 Information you provide directly

• Account information. When you create an account, we collect your email address. If you sign in with email and password, we collect a securely hashed password (we never store your password in plain text). If you sign in with Google, we receive your email address, name, and profile picture from Google (see Section 3).
• Learning content and activity. As you use RushMandarin to study Mandarin, we collect the content you interact with and data you generate — for example, words you save, texts and videos you read or watch within the Service, your review history, vocabulary lists, and learning progress and settings.
• Communications. If you contact us (e.g., by email), we collect the information you choose to provide.

1.2 Information collected automatically

• Usage data. We may collect information about how you access and use the Service, such as pages or features used, actions taken, and timestamps.
• Device and technical data. We may collect technical information such as browser type, operating system, and approximate region, as well as data necessary for the Service to function (such as session tokens stored in your browser).

1.3 Browser extension

The RushMandarin browser extension reads page content on supported sites (such as YouTube) only to provide its language-learning features (for example, displaying definitions and overlays over text you choose to study). The extension reads your RushMandarin session information from your logged-in RushMandarin web session in order to associate your saved words and progress with your account. We do not sell the contents of the web pages you visit, and we do not track your general browsing history for advertising.

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Service;
• Authenticate you and keep your account secure;
• Save and sync your learning data (saved words, progress, vocabulary) across the web app and browser extension;
• Send you account-related and transactional emails (such as email confirmation and password reset);
• Respond to your requests and provide support;
• Diagnose technical problems and understand which features are used, so we can improve, personalize, and develop the Service;
• Personalize content, recommendations, and (where offered) advertising;
• Detect, prevent, and address fraud, abuse, and security issues;
• Comply with legal obligations.

Selling your information. We do not sell your personal information in exchange for money. Depending on your jurisdiction, some of our data-sharing for advertising or analytics (described in Section 3) may be considered a "sale" or "share" under laws such as the California Consumer Privacy Act; where that applies, you may opt out as described in Section 6.

De-identified and aggregated data. We may de-identify, anonymize, or aggregate information so that it no longer reasonably identifies you, and we may use and share that de-identified or aggregated data for any purpose, including understanding learning trends, research, improving and developing the Service, and training machine-learning models.

New uses. If we introduce materially new uses of your personal information, we will update this Privacy Policy and provide notice as described in Section 10.

3. Third-Party Service Providers

We rely on a small number of trusted third-party providers to operate the Service. Each receives only the information needed to perform its function:

• Supabase — authentication, database, and backend infrastructure. Supabase stores your account information and learning data on our behalf. See Supabase's privacy policy at https://supabase.com/privacy.
• Google (Sign in with Google / Google OAuth) — if you choose to sign in with Google, Google provides us your email, name, and profile picture to create or access your account. Your use of Google sign-in is also subject to Google's Privacy Policy at https://policies.google.com/privacy. We request only the basic email, profile, and openid scopes; we do not access your Gmail, Google Drive, or other Google data.
• Resend — transactional email delivery. Resend processes your email address to deliver account emails such as confirmation and password-reset messages on our behalf. See https://resend.com/legal/privacy-policy.
• Railway — hosting for the RushMandarin web application and backend API (app.rushmandarin.com). See https://railway.com/legal/privacy.
• Vercel — hosting and content delivery for the RushMandarin marketing website (rushmandarin.com). See https://vercel.com/legal/privacy-policy.

We may also use analytics and advertising providers to understand how the Service is used and, where applicable, to deliver or measure advertising. We will update the list above as our providers change.

These providers act as our service providers and are expected to protect your information and use it consistent with this Privacy Policy.

4. Legal Bases (for users in the EEA/UK)

Where the EU/UK GDPR applies, we process your personal data on the following bases: performance of a contract (to provide the Service you requested), our legitimate interests (to operate, secure, and improve the Service), your consent (where required, e.g., for optional communications), and compliance with legal obligations.

5. Data Retention

We generally retain your personal information for as long as your account is active or as needed to provide the Service. When you delete your account, we will delete or de-identify your personal information within a reasonable period, except where we need to retain it to comply with legal obligations, resolve disputes, enforce our agreements, or maintain security. We may retain de-identified or aggregated data (which no longer identifies you) for longer.

6. Your Rights and Choices

Depending on your location, you may have the right to:

• Access the personal information we hold about you;
• Correct inaccurate information;
• Delete your account and associated personal information;
• Export your data;
• Object to or restrict certain processing;
• Opt out of any "sale" or "share" of your personal information or of targeted advertising, where those rights apply (e.g., under the CCPA);
• Withdraw consent where processing is based on consent.

To exercise any of these rights, including to opt out of any sale/share or targeted advertising, contact us at eugene@rushmandarin.com. You can delete your account at any time from your account settings, or by contacting us.

7. Data Security

We use commercially reasonable safeguards to protect your information, including encryption in transit (HTTPS), hashed passwords, and access controls. No method of transmission or storage is 100% secure, so we cannot guarantee absolute security.

8. Children's Privacy

The Service is not directed to children under 13 (or the minimum age required in your jurisdiction), and we do not knowingly collect personal information from children under that age. If you believe a child has provided us personal information, contact us and we will delete it.

9. International Data Transfers

We are based in the United States, and our service providers may process data in the United States and other countries. By using the Service, you understand your information may be transferred to and processed in countries that may have different data-protection laws than your own.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated version on this page and update the "Last updated" date. Material changes will be communicated through the Service or by email where appropriate.

11. Contact Us

If you have questions about this Privacy Policy or our data practices, contact us at: