Privacy Policy

Who we are

Exchange Notes (the “app”) is operated by Hungchi Studio, an independent studio run by an individual in Taiwan and not a registered company. Hungchi Studio decides how and why the personal data described here is processed and is responsible for it. You can reach us at the address at the end of this page.

What we get from your Google account

You sign in with Google. With your permission, Google shares your name, email address, profile photo and a unique Google account identifier with us. We use them only to create and secure your account, show your profile, and keep you signed in.

We never receive your Google password, and we don’t request access to Gmail, Drive, Contacts or any other Google service. We don’t sell Google user data, use it for advertising, or use it to train AI models. You can remove the app’s access at any time from your Google Account’s security settings.

What you create and send

Depending on the features you use, we store what you put into the app so it can work and sync across your devices:

• Your profile: display name, Exchange ID, profile photo, native and learning languages, and app preferences such as interface language, mode and daily goal.
• Notes and vocabulary: words, translations, examples, notes, sources, tags, pictures you save with them, collections and review history.
• Messages and sharing: messages, attachments and words you send, notes you share, friend requests and friendships.
• Learning and Yumi: pronunciation scores (we keep scores, not recordings), review results, Yumi’s state, energy cookies and the items she wears.

What is collected automatically

A little information is collected as the app runs:

• Notification subscriptions: if you turn on reminders, your browser’s push endpoint and keys, the device name and browser type, or your iPhone’s push token, plus your time zone so reminders arrive at a sensible hour.
• Widget access: if you connect the home-screen widget, a token we store only in hashed form.
• Approximate location: the shop’s sky uses the weather where you are. Our host derives a rough position from your IP address; we round it to about 10 km, use it to fetch the weather and do not store it.
• Usage limits and errors: daily counts of AI requests per account, so the shared limit can be enforced, and records of failed AI calls that contain no content from you.
• Server logs: our hosting and database providers keep technical logs (such as IP address, browser type and request time) to run and secure the service.

We don’t use advertising cookies, advertising IDs or third-party analytics. Nothing about how you use the app is sent to an analytics provider.

How we use it

To provide the app: sign-in, saving and syncing, translation and recognition, reviews, messages, sharing, reminders and the widget. To keep it working and safe: preventing abuse, enforcing usage limits, fixing problems and protecting accounts. To comply with the law.

Where data protection laws such as the GDPR apply, we rely on performing our agreement with you (providing the features you use), our legitimate interests (keeping the service secure and working), your consent (notifications and device permissions, which you can withdraw), and legal obligations.

AI features and Google Gemini

Features such as recognising objects and menus, translating, explaining words, notes and messages, voice lookup and Yumi’s interpretations send the relevant text, note context, image or audio from our server to Google’s Gemini API. Some camera recognition runs entirely on your device and sends nothing. Speech recognition in your browser or operating system may be handled by Apple, Google or another provider under their own terms.

Exchange Notes currently uses Gemini’s unpaid tier. Under Google’s terms for unpaid services, Google may use the content it receives, and the responses it generates, to provide, improve and develop its products and machine-learning technologies, and human reviewers may read, annotate and process it. Please don’t send sensitive information — such as health details, identity documents, passwords, financial data or private details about other people — to AI features.

AI results can be wrong. Treat translations, recognitions and cultural interpretations as suggestions, not facts.

Service providers

We use these providers to run the app. Each processes data under its own terms and only for the purpose described:

• Supabase — accounts, database and file storage (servers in Canada).
• Vercel — hosting and server functions (servers mainly in the United States, with a global network).
• Google — Sign-In, the Gemini API, web fonts, and an on-device image model downloaded from Google’s servers.
• MyMemory (Translated, Italy) and the Free Dictionary API — the single word or short phrase being looked up, sent from our server, for some translations and pronunciations.
• Open-Meteo — rounded coordinates only, for the shop’s weather.
• Apple, Google and Mozilla push services — to deliver the notifications you turn on.

Who can see what

Other signed-in people can find your public profile — display name, Exchange ID, profile photo and languages — so they can add you as a friend. Messages, shared notes and shared words are visible to the people you send them to, who may keep copies or screenshots. Profile photos are stored at public web addresses so friends’ devices can show them; anyone who has the link can view the photo.

We don’t sell or rent personal data. We disclose it only to the providers above, when required by law or to protect people’s safety, or, if the app is ever transferred to a new operator, to that operator under this policy, with notice to you.

International processing

We operate from Taiwan and our providers process data in Canada, the United States and other countries where they have facilities. Those countries may have different data protection laws from yours. We rely on our providers’ contractual data protection commitments, including standard contractual clauses where they apply.

How long we keep it

• Your account and content: until you delete them or your account.
• When you delete your account: your profile, content, messages you sent, friendships, files and Yumi are deleted from our active database and storage straight away. Copies may remain in our provider’s encrypted backups for a short time, normally no longer than 30 days, before they are overwritten.
• Shared caches of word translations and pronunciations are kept to speed up lookups; they are stored by word, not by person.
• Server logs are kept by our providers for short periods under their own retention settings.
• Content sent to Gemini is retained by Google under its own terms.

We don’t currently delete inactive accounts automatically. If that changes, we will tell you first.

Your choices and rights

You can edit your profile, delete individual notes, words and messages, stop sharing, turn notifications off and change camera, microphone and notification permissions at any time. You can delete your whole account in Settings → Delete account.

Depending on where you live, you may also have the right to access your data, get a portable copy, correct it, delete it, restrict or object to its processing, and withdraw consent. In Taiwan, the Personal Data Protection Act gives you the right to inquire about, review, copy, supplement or correct your data, and to ask us to stop collecting, processing or using it, or to delete it. Email us to make a request; we will answer within 30 days and may need to confirm it is you. You may also complain to your local data protection authority.

We don’t sell or share personal information for cross-context behavioural advertising.

Age

Exchange Notes is for people aged 18 and over, because our AI provider’s terms do not allow services directed at or likely to be used by anyone younger. We don’t knowingly collect data from anyone under 18. If you believe someone under 18 has an account, contact us and we will delete it.

Security

Connections are encrypted with HTTPS. Database rules limit every account to its own data and to what others have shared with it, pictures saved with your words are kept in private storage, and the keys that can bypass those rules are held only on our server. Some of your notes and words are also kept on your device for offline use and are cleared when you sign out.

No online service is perfectly secure. Please don’t store passwords, identity documents or other sensitive information in the app. If we learn of a breach affecting your data, we will notify you and the relevant authorities as the law requires.

Cookies and local storage

We use only what the app needs to work: sign-in cookies, your language and display preferences, and offline copies of your content on your device. None are used for advertising or cross-site tracking.

Changes to this policy

When we change this policy we will update the date at the top. If a change materially affects how your data is used, we will tell you in the app or by email before it takes effect and, where the law requires, ask for your consent.