RootoryRootory Privacy Policy — Updated 14 October 2026
Operator: Bo Wang (王波). Contact: support@rootory.app.
1. Your choices
Rootory provides bundled vocabulary and local learning storage. Reading this policy does not grant consent. You can choose offline learning and review the privacy information in Profile. Contact support@rootory.app for privacy requests, including withdrawal of consent. The first three roots are available to guests; later roots require an account, and roots from the ninth require Plus. An internet connection is needed for account services, synchronization and store verification.
2. Information used
Account features process the information you provide, such as email, display name and an optional avatar, authentication credentials and session identifiers. Cloud synchronization processes your learning progress, review records, saved words and preferences. Support processes the messages and contact information you submit. Network services receive IP addresses and request/device metadata. Purchase providers process store transactions, product identifiers, entitlement status and an app user identifier; Rootory does not receive your full payment card details.
3. Purposes and providers
Data is used to operate accounts, synchronize learning, deliver requested support, verify purchases and protect the service. The deployed API runs on Cloudflare Workers and stores online records in Neon PostgreSQL in AWS US East (Northern Virginia, United States). Cloudflare R2 stores your optional avatar and encrypted Apple authorization tokens used to revoke access when you delete your account. Resend delivers account verification and password-reset emails. Cloudflare Email Routing forwards support@rootory.app to the operator's Microsoft Hotmail mailbox. RevenueCat and Apple StoreKit process configured purchases. RevenueCat also uses purchase history and the account identifier for purchase-service analytics. Android purchases depend on distribution-channel configuration. Sign-in providers are used only when configured and selected. Local reminders use your device's permission and can be disabled in system settings. Automatic Expo updates are disabled in this release. No advertising SDK or cross-app advertising tracking is configured. Optional usage analytics are described below.
4. Local storage and security
Learning records and preferences are stored locally; session tokens use device secure storage. Server requests use HTTPS. A shared device may retain local learning records after sign-out. Do not share your account credentials. No security measure can guarantee absolute protection.
5. Access, deletion and withdrawal
Profile provides account management, account deletion and privacy choices. Withdrawal blocks new app API requests; after online SDK initialization, close and reopen the app to stop the existing native session. Withdrawal does not delete your account or cancel a store subscription. The current server deletion implementation disables the account and revokes sessions; account-associated cloud learning records and other personal records are removed within 30 days. The scheduled purge removes live records after 29 days; the current database history window is six hours. We do not retain independent user-data snapshots beyond this period. Avatar deletion is requested when the account is closed. If deletion fails, contact support for investigation. Contact support for access, correction or deletion requests. Local learning records remain on this device after account deletion unless separately cleared.
6. International processing and retention
This release is intended for regions outside mainland China. Cloudflare operates globally; Neon database records are stored in the United States; RevenueCat, Apple and Microsoft may process data in the United States and other countries. We use these providers to deliver the features described above, with access limited to service needs. Applicable provider terms, safeguards and data-subject rights apply; contact us for details or concerns about international processing. Online account and learning records remain while your account is active and are removed within 30 days of account closure. Operational logs and support correspondence are retained while needed to resolve the request, protect the service or meet applicable legal obligations. You may request deletion of support correspondence by contacting support. Store providers independently retain transaction information under their own policies. A separate mainland China release will require domestic infrastructure and its own disclosures; this overseas consent does not enable that release.
7. Age requirements
Rootory is intended for adults and users aged 13 or older. Users aged 13–17 should use the service with a parent or guardian and obtain any consent required by local law. We do not knowingly collect personal information from children under 13. If you believe a child has provided information, contact support so we can investigate and remove it.
8. Optional usage analytics
Only if you separately enable usage analytics, the app and website send selected page views, learning actions, favorites, sign-in outcomes and purchase outcomes to PostHog US Cloud (United States) to understand usage, retention and feature conversion. Events use a random installation/browser identifier, language, difficulty and basic app/platform metadata. We do not send your account identifier, email address, password, form contents, search text, audio text or authentication-link tokens. We do not use session recording, advertising identifiers or cross-site identity matching. Requests necessarily expose network metadata to PostHog; automatic IP geolocation is disabled. The app batches a bounded queue of events locally; the website holds its queue in memory. This option is off until you enable it, and can be disabled in Learning settings or the website's Usage analytics control. Turning it off stops new analytics requests and discards pending events; already transmitted events are not recalled. A request already in flight may have reached PostHog. Existing service consent does not enable analytics. App and website identifiers are separate and are not linked to your Rootory account. Analytics events follow the current free plan's one-year retention period and are not account-associated records covered by the account-deletion schedule. Contact support for analytics access or deletion requests; because we do not link events to your account, we may need your installation/browser analytics identifier to locate them. These choices do not affect learning or account services.
9. Changes and contact
Material processing changes require an updated policy version and renewed consent where applicable. Contact support@rootory.app with privacy questions. You may request access, correction, deletion, portability or restriction where applicable, withdraw consent, or contact your local data-protection authority. We respond to privacy requests within 30 days, subject to identity verification and applicable law. This policy is bundled for offline reading. English and Chinese versions are available; other interface languages display English legal text.
This website translation follows the approved English/Chinese text dated 14 October 2026. The app currently bundles English and Chinese legal documents for offline reading.