Privacy Policy
Last updated: 2026-10-11
This Privacy Policy explains how we collect, use, store and share your personal information when you use LevelDoo, and the rights you have by law.
1. Data Controller
The data controller for this Service is:
- Name: Zhang He (individual operator)
- Privacy contact: privacy@leveldoo.com
- Data Protection Officer (DPO): not applicable
2. Personal Information We Collect
2.1 Information you provide:
- Account: name, email address, profile picture — via Google sign-in.
- Payments: transaction amount and status. We never store full card numbers — card data is handled by our payment processor (Section 5).
- Communications: emails and feedback you send us.
- Learning data: level, saved vocabulary, reading sessions, XP and streaks — the core records that power your learning.
2.2 Information collected automatically:
- Device & network: IP address, device/OS/browser type, timezone.
- Usage: pages visited, features used, session duration.
- Logs: request times, error logs, performance data (Cloudflare edge logs).
- Push: notification subscription endpoints and preferences, if you opt in.
3. How We Use Your Information
| Purpose | Legal basis |
|---|---|
| Provide and maintain the Service | Contract performance |
| Billing & payment processing | Contract performance |
| Customer support | Contract / legitimate interest |
| Service notices (billing, security, policy updates) | Legitimate interest |
| Security & fraud prevention | Legitimate interest |
| Product improvement & anonymized analytics | Legitimate interest |
| Legal compliance | Legal obligation |
We may aggregate or de-identify data for statistical analysis; such data cannot identify you.
4. Cookies and Tracking
| Type | Purpose | Can disable |
|---|---|---|
| Strictly necessary | Login session, core functionality | No |
| Functional | Language preference, theme, learning state (localStorage) | Yes |
We currently use no third-party analytics or advertising trackers. You can clear functional storage anytime via your browser settings.
5. Sharing and Disclosure
We do not sell your personal information, including any “sale” as defined by laws such as the CCPA.
We share information only in these cases:
- Service providers: Cloudflare (hosting, Workers AI, D1 database), Waffo Pancake (payment processing — our PCI-DSS-compliant merchant of record; card data never touches our servers), Google (OAuth sign-in), Plunk (transactional email).
- Legal requirements: lawful requests by courts or authorities.
- Business transfers: merger or acquisition, with prior notice and continued protection.
- With your consent: for purposes you explicitly approve.
6. Data Security
- Encryption in transit: TLS / HTTPS everywhere.
- Credential security: sign-in is via Google OAuth — we store no passwords.
- Access control: least-privilege access to production systems.
- Breach notification: within 72 hours of discovery where required by law.
7. Data Retention
| Data type | Retention | Then |
|---|---|---|
| Account data | Active duration + 90 days after deletion | Deleted or anonymized |
| Transaction records | 7 years (tax/audit) | Deleted or archived |
| Support records | 2 years | Securely deleted |
| Security/audit logs | 6 months | Securely deleted |
8. Your Rights
To exercise any right below, contact privacy@leveldoo.com — we respond within 30 calendar days.
| Right | What it means |
|---|---|
| Know | Learn what data we collect and how it is used |
| Access | Get a copy of your personal data |
| Rectification | Fix inaccurate or incomplete data |
| Erasure | Request deletion under specific conditions |
| Restriction | Pause processing in specific cases |
| Portability | Get your data in machine-readable form (Settings → Export) |
| Object | Object to legitimate-interest or marketing processing |
| Withdraw consent | Revoke consent-based processing |
If you believe we have not handled your data properly, you may lodge a complaint with your local data-protection authority.
9. Marketing and Opt-Out
With your consent, we may send product updates or learning tips via email or push notification. You can opt out anytime: unsubscribe links in emails, notification toggles in Settings, or by contacting us. Opting out does not affect essential service notices (billing, security).
10. International Transfers
Our infrastructure and providers are located globally (Cloudflare edge network) and in the United States. For cross-border transfers we rely on safeguards including data-processing agreements incorporating EU Standard Contractual Clauses (SCCs) and transfers only to recipients with equivalent protection levels.
11. Children
The Service is intended for users 16 years and older. We do not knowingly collect information from children under this age. If you believe your child has provided us information, contact us and we will delete it promptly.
12. Third-Party Links and Services
The Service may link to or integrate with third-party services. This policy applies only to information we collect directly — we are not responsible for third-party data practices; please review their policies before use.
13. Changes to This Policy
For material changes we will notify you at least 15 days in advance via in-app notice or your registered email, and update the “Last Updated” date at the top of this page. Continued use after the effective date constitutes acceptance.
14. Contact Us
- Privacy: privacy@leveldoo.com
- Support: support@leveldoo.com
- Operator: Zhang He
- Website: https://leveldoo.com