Privacy policy

This policy explains how Lê Công Hoan, an individual based in Vietnam (“Puchi”, “we”, “us”) collects and uses personal data when you use the Puchi mobile and web apps, the website at puchi.io.vn and related services (the “Service”). We keep it short and specific. We follow Vietnamese law on personal data protection (including Decree 13/2023/ND-CP) and, for people in the European Economic Area and the UK, the GDPR.

1. Who is responsible

Data controller: Lê Công Hoan, an individual based in Vietnam. Contact for privacy questions and requests: privacy@puchi.io.vn. The data controller is also the person responsible for personal data protection; there is no separate data protection officer.

2. What we collect

Category	What	Why
Account	Email address (for one-time-code sign-in), or the email address and account identifier your Google, Facebook, TikTok or Apple account shares when you choose that sign-in (where offered); a random account ID. Guests: a random guest ID created on your device.	Create and secure your account, keep progress across devices, contact you about the Service
Learning data	Your accent choice (Northern or Southern), goals and settings (daily goal, time zone, reminder preferences), lessons and exercises completed, answers, XP, streaks, review schedule, stories read	Run the lessons, spaced-repetition review and gamification; check answers
Premium	Gift codes you redeem and the Premium period granted	Unlock and manage Premium
Device and technical	App version and platform, IP address and request logs	Deliver the Service, prevent abuse, limit request rates, fix bugs
Server logs and traces	Error logs and performance traces produced by our own servers when you use the apps (time, request type, error details, IP address)	Keep the Service running and fix problems
Messages to us	What you send when you contact us	Reply and keep a record

We do not collect payment card details (there are no payments in the Service today), contacts, precise location, or voice recordings. The website sets no cookies and loads no third-party scripts, and neither the apps nor the website currently use third-party analytics or error-reporting services. If we add one, we will update this policy first and ask for your consent where the law requires it.

3. Why we use it, and our legal basis

• To provide the Service you asked for (contract): account, lessons, progress, review, Premium.
• With your consent: any optional feature that needs it, such as reminders or analytics if we add them later. You can withdraw consent at any time, without affecting earlier use.
• For our legitimate interests: security, abuse prevention, fixing errors and improving the Service, in ways that respect your rights.
• To comply with law: responding to lawful requests and keeping required records.

We do not sell your personal data and we do not use it for advertising.

4. Who we share it with

We use service providers who process data on our instructions:

• Hosting, content delivery and security — Cloudflare (DNS, CDN, web hosting and object storage, including our database backups). Cloudflare processes requests worldwide. Our application servers and database are operated by us on servers located in Vietnam.
• Sign-in — Google, Facebook, TikTok and Apple, only when you choose those methods and they are offered.
• Email delivery — a third-party transactional email provider, to send your one-time sign-in codes and service messages.

We do not currently use push-notification, analytics or error-reporting providers. If that changes we will update this policy before any data is shared with them.

We may also disclose data when the law requires it, to protect rights and safety, or in a merger or sale of the business, in which case you will be told.

5. International transfers

Some providers store or access data outside Vietnam and your country. Where required, we rely on appropriate safeguards (such as contractual protections) and complete the notices or assessments required by Vietnamese law for transferring personal data abroad.

6. How long we keep it

• Account and learning data: while your account is active. If you delete your account we delete or anonymise this data within 30 days, except where the law requires us to keep something longer.
• Guest data: up to 12 months after the guest was last active.
• Logs and diagnostics: kept for up to 30 days.
• Backups: deleted data disappears from backups on their normal rotation, within 14 days.

7. Your rights

Depending on where you live, you can ask to: know what we process, access a copy, correct it, delete it, restrict or object to some processing, withdraw consent, and receive your data in a portable format. Under Vietnamese law you may also ask us to stop providing your data to third parties where possible and may complain or seek remedies through the competent authorities. In the EEA/UK you may complain to your local data-protection authority.

To change or delete your data, or to use any other right, email privacy@puchi.io.vn (an in-app option to delete your account is planned). We will respond within the time required by law and may need to verify your identity first.

8. Children

Puchi is not directed at children under 13. Under Vietnamese law, the personal data of a child under 16 may be processed only with the consent of a parent or guardian. If you are a parent or guardian and believe a child has given us data without your consent, contact privacy@puchi.io.vn and we will delete it.

9. Security

We use measures such as encrypted connections, hashed refresh tokens, short-lived access tokens, access controls and monitoring. No system is perfectly secure; if there is a breach that affects you we will notify you and the authorities as the law requires.

10. Changes

If we make material changes, we will tell you in the app or by email before they take effect and update the effective date above.

11. Contact

Lê Công Hoan, an individual based in Vietnam — privacy@puchi.io.vn.