Privacy Policy

Scope and operator

This policy applies to the Aptenyo app and website for users in every region where the service is offered (currently Taiwan, Hong Kong, Macao, Singapore, Malaysia, Japan, and Korea). The data controller and service operator is Shihchun Tai (brand: Aptenyo). Contact details appear in the final section.

When collecting personal data, Aptenyo gives notice of the matters in this policy under Article 8 of Taiwan’s Personal Data Protection Act. This is the processing practice Aptenyo actually follows, and it applies in the same way wherever a user is located. The specific Taiwan laws cited in this policy (such as the Personal Data Protection Act) describe the operator’s obligations under Taiwan law and the rights users may exercise. If the law where a user is located (for example, Hong Kong, Macao, Singapore, Malaysia, Japan, or Korea) separately grants personal-data protection rights that cannot be waived in advance, those rights are not limited or excluded by this policy. Users in Korea are also covered by “Additional terms for users in Korea.”

Some features may be used while signed out. In that case, data remains on the device.

This policy is a translation of the Traditional Chinese version. If the English and Traditional Chinese versions differ or conflict, the Traditional Chinese version prevails.

Data collected and how it is collected

Account data: email address, display name, selected sign-in method, and identifiers provided by Apple, Google, LINE, or Email sign-in. Email passwords are stored only as hashes and cannot be read by Aptenyo.

Learning data: score goal, expected exam date, time zone, preferences, vocabulary progress and review schedule, Part 1–7 responses and correctness, missed questions, and practice progress. This data is created while a signed-in learner uses the service.

Device and security data: device information, sign-in time, sessions needed to stay signed in, and IP addresses that hosting providers may process in server logs.

Data submitted voluntarily: Contact us messages and question reports, including item identity, issue category, selected answer, and written details. A signed-in report includes the account email only so the team can reply to that report. Do not submit passwords, payment details, or other sensitive data.

Purchase data: Apple-signed transaction identifiers, product, purchase and expiry times, and renewal status used to enable, renew, or restore access. Apple processes payment; Aptenyo does not receive card or payment-account details.

Referral and invite records: the account’s own referral code and, when a referral, invite, or promotional code is redeemed at sign-up or later, the redeemed code, when it was redeemed, the link between the referring and referred accounts (who referred whom), and the reward status. This data is created when a code is issued or redeemed and is used only to grant referral rewards, prevent abuse, and measure and settle promotional partnerships. It is kept until the related account is deleted; when either account is deleted, the referral link is deleted with it.

Age confirmation record: where the Korea age requirement applies (for example, when the Korean interface is used or the connection comes from Korea), account creation first asks the person to confirm that they are 14 or older. Aptenyo records when the confirmation was given and the minimum age required at that time (14), to show that the confirmation was obtained before the account was created. No date of birth is collected; the record is kept until the account is deleted.

On-device storage: cookies and browser storage used for sessions, display and playback preferences, and free-use allowances. A daily reminder schedule stays on the device. Cookies and site data can be blocked or deleted in browser settings (in the app, deleting the app clears them); when they are blocked, sign-in cannot be kept and display and playback preferences are not remembered.

Aptenyo does not collect location, contacts, photos, microphone recordings, health data, or advertising identifiers.

Purposes of collection and use

Data is used only to create and manage accounts and sign-in; store learning records; provide questions and practice; schedule vocabulary and review; enable and restore purchased access; grant referral rewards and settle promotional partnerships; confirm the age requirement for account creation; protect accounts and systems; handle support and rights requests; meet legal obligations; and debug and improve the product.

A new purpose requires consent or another lawful basis. Aptenyo does not secretly build profiles unrelated to learning.

Retention, locations, recipients, and processing

Retention: account and learning data is kept until account deletion or service termination; sessions for up to 7 days; one-time verification and reset links only for their short validity period; support messages until deletion is requested or the service ends; and records required by law for the legally required period.

Locations: Taiwan and regions where cloud providers operate, which may include Singapore and the United States.

Recipients: Aptenyo and processors engaged to provide the technical services listed below.

Method: electronic processing, network transmission, and storage in cloud databases and object storage, limited to the purposes above.

Personalization and algorithms

Aptenyo uses responses, the score goal, and the expected exam date to sequence vocabulary, schedule reviews, and suggest practice. These are learning aids, not official test scores.

Personal data is not currently sent to third-party AI services for processing.

Third-party services and data sharing

Necessary providers may include cloud hosting and networking, cloud databases, object storage, email delivery (verification, password-reset and account-security emails, learning records sent on request, and support notifications), the selected Apple, Google, or LINE sign-in service, and App Store or Google Play payment and transaction verification.

Processors must provide equivalent protection and process data only on Aptenyo’s instructions.

Aptenyo does not sell personal data. Data is disclosed only as necessary to provide the service, with consent, to necessary processors, or when required by law.

Aptenyo currently uses no advertising, cross-site tracking, or third-party behavioral analytics service.

Some data may be stored or processed on servers outside Taiwan through cloud or third-party services. Reasonable security measures are used to protect that data.

Notifications

Daily study reminders use local device notifications. Reminder time and schedule stay on the device. Notifications are optional and may be turned off in the Me tab of the app or in the device’s system settings.

Support messages

Contact us messages are stored in R2 object storage and may be copied to support.aptenyo@gmail.com when support notifications are enabled. They are used to read the message, investigate issues, or improve the service.

Question reports are stored the same way and may be copied to support.aptenyo@gmail.com. A signed-in report includes the account email only for replying to that report, not for marketing.

Questions about how support messages are handled or deleted may be sent through Contact us.

Third-party sign-in and Apple authorization

Linked Apple, Google, or LINE sign-in methods may be removed in the app under Me → Account and plan as long as at least one sign-in method remains. Authorization may also be revoked from Apple ID or Google account settings.

For Apple sign-in, the authorization credential is retained only so Aptenyo can notify Apple to revoke it when the account is deleted. It is not used to access other Apple data, and social-network passwords are not stored.

Retention and deletion

In the app, Me → More settings → Delete account permanently deletes the account, sign-in methods, sessions, goals, preferences, learning progress, and purchase-entitlement records. Apple authorization is also revoked when applicable. Copies of already submitted support messages and records that must be retained by law are exceptions.

Go to account deletion

Consent and withdrawal

Links to this policy and the Terms of Service are shown when an account is created or a third-party sign-in is used. By continuing, you confirm that you have read this policy and agree to the collection, processing, and use it describes. Paid access is not conditioned on unrelated data.

Consent may be withdrawn by signing out and stopping use, disabling optional preferences, unlinking third-party sign-in, or deleting the account. Withdrawal does not affect lawful processing completed earlier.

Rights and how to exercise them

Under Article 3 of Taiwan’s Personal Data Protection Act, a person may inquire about or review personal data, request a copy, request correction or supplementation, request that collection, processing, or use stop, and request deletion. These rights cannot be waived in advance or restricted by contract.

Goals, preferences, and sign-in data can be corrected in the app, and an account can be deleted there. Other requests may be emailed to support.aptenyo@gmail.com with the account email and requested action. Identity may need to be verified. Data required by law may not be deleted immediately.

Effect of not providing data

Providing personal data is optional. Some account and learning data is necessary for sign-in, stored progress, or core learning functions. Without it, features such as cross-device storage or restoring purchased access may be unavailable. Some features remain available while signed out.

Security and incident notice

Reasonable authentication, access control, encryption in transit, and other technical and organizational safeguards are used, but no online service can eliminate all information-security risk.

If personal data is stolen, disclosed, altered, or otherwise compromised, affected users and authorities will be notified as required by law.

Minors

A minor must obtain any consent required from a legal representative under applicable law before using the service.

Additional terms for users in Korea

This section is provided under Korea’s Personal Information Protection Act (개인정보 보호법) and applies to users of the service in Korea. Matters not covered here are governed by the other sections of this policy.

Privacy officer: the operator of Aptenyo. Contact: support.aptenyo@gmail.com. Questions, complaints, and requests to exercise rights concerning personal data may be sent to this address.

Processors: Aptenyo entrusts the processing of personal data to the following services, which act on Aptenyo’s instructions and only to the extent necessary to provide the service.

Vercel Inc. (cloud hosting and networking): runs the website and app backend and processes the data sent and received (including account, learning, and purchase data) and connection records such as IP addresses. The backend runs in Singapore; connections may first pass through Vercel network locations in other regions closer to the user.

Cloud database provider (PostgreSQL): stores account data (email address, display name, password hash, sign-in methods and third-party account identifiers, the Apple authorization credential), sign-in and session data (including temporary verification data used during sign-in), profile settings and placement-test results, learning data, referral codes and invitation relationships, account sources (such as referral or promotional codes), purchase-entitlement and transaction records, and account administration and security audit records.

Cloudflare, Inc. (R2 cloud object storage): stores Contact us messages and question reports (including the account email when signed in). It also stores and delivers learning media such as listening audio; when a device downloads audio directly from R2 (for example, the full audio of a mock test), Cloudflare processes connection records such as the IP address.

Google LLC (Gmail email delivery): sends verification emails, password-reset emails, account security notices, and learning-record PDFs sent on request, processing the recipient’s email address and the message content. Notification copies of support messages and question reports are also sent through Gmail to the support mailbox.

Third-party services chosen by the user: the following sign-in and payment services are used at the user’s choice and process data as independent parties under their own privacy policies. Aptenyo exchanges the data below with them only to the extent necessary to provide sign-in and purchases.

Apple Inc. (Sign in with Apple, App Store): when Apple sign-in is chosen, processes the Apple account identifier, email address, and name, and the authorization credential retained so that it can be revoked; for App Store subscriptions, processes payment and transaction information and receives the user’s Aptenyo account identifier, which links the purchase to the account.

Google LLC (Google sign-in, Google Play): when Google sign-in is chosen, processes the Google account identifier, email address, and name; for Google Play subscriptions, processes payment, the purchase token, and subscription status and receives the user’s Aptenyo account identifier, which links the purchase to the account.

LY Corporation (LINE Login): when LINE sign-in is chosen, processes the LINE user identifier, email address, and display name.

Transfer of personal data outside Korea: the servers of these services are located outside Korea (for example, in Singapore or the United States). The data described above is transmitted to them over the network while the service is used; the data items and purposes are as listed above, and retention follows “Retention, locations, recipients, and processing.” A user who does not want data transferred abroad may choose not to create an account (while signed out, data stays on the device) or may delete the account; features that need an account, such as cross-device syncing and restoring purchased access, will then be unavailable.

Users under 14: a person under 14 cannot create an account, and no consent route through a legal representative is offered. When creating an account, users are asked to confirm that they are 14 or older.

Policy changes

Material changes will update the date on this page and may be announced through the app, website, email, or another reasonable method.

Contact

Questions about this policy or personal-data processing may be sent to support.aptenyo@gmail.com.