Privacy Policy

Last updated 23 August 2026

Xuetang is run by one person in Singapore. It is not a company, and it does not sell data to anyone. This page says exactly what is stored, who else sees it, and how to get it deleted.

What is collected

Data	Why
Username and grade	To sign in and to pick the right questions
Email address (optional for a child)	To send the login details and password resets
Password	Stored as a hash, never in readable form
Practice answers and scores	The product itself — progress, weak topics, the parent report
IP address at sign-up	Abuse prevention only
Where you came from (`src` tag in the link)	To know which channel brings parents in
Cookies from Google Analytics and Google Ads	Visitor counts, and whether an ad click led to a sign-up

A child's data

The people doing the practice are primary-school children. Three rules follow from that:

A child's email is optional. An account works without one — a parent can create it and hold the login.
Nothing a child writes is used to train an AI model. Answers are sent to the AI provider below to be marked and explained, and that is all they are used for.
No advertising is shown to children. There are no ads anywhere inside the app, and the analytics tags are only on the public marketing pages and the sign-up confirmation page — never on a child's dashboard or practice screens.

Who else sees it

These services process data on Xuetang's behalf. Each one only receives what it needs to do its job.

Service	What it gets
Anthropic (Claude)	Question text and the child's answer, to mark it and explain the step. No name, no email.
Google Analytics & Google Ads	Page views on the public pages, and whether a visit turned into a sign-up. Cookies only — no email is sent to Google.
Resend	Email address and message content, to deliver login and reset mail.
Turso	The database itself.
Cloudflare	Images used inside questions, and the domain.
Vercel	Hosting and server logs.

Nothing is sold, rented, or shared for anyone else's marketing.

How long it is kept

Account and practice data is kept while the account exists. Ask for deletion and it goes — the account, the answers, the email, all of it. Server logs roll off on the hosting provider's own schedule (weeks, not years).

What you can ask for

Under Singapore's Personal Data Protection Act you can ask what is held about you, ask for it to be corrected, or ask for it to be deleted. Email the address below and it will be done — no form, no account-closure survey.

Cookies

Two kinds. A session cookie keeps you logged in; the site does not work without it. Google Analytics and Google Ads cookies count visits and connect an ad click to a sign-up — those only load on the public pages listed above. Blocking them in your browser does not affect the practice product at all.

Changes

If this policy changes in a way that matters, the date at the top changes and anyone with an account gets an email.

Contact

xuetang@fuofuo.com

A real person reads this address. Expect a reply within 5 working days.