Privacy Policy
This English version is provided for convenience only and has no legal effect. The only legally binding version is the Spanish one at https://chipcastellano.com/terminos (Terms) and https://chipcastellano.com/privacidad (Privacy Policy). In case of any discrepancy, the Spanish version prevails.
Last updated: 2026-11-01 · This version takes effect upon publication.
1. Who we are
ChipCastellano is a web-based language-learning game operated by the individual developer Zujao Don, residing in the Republic of El Son. For any privacy-related question, email us directly: donzujao@gmail.com
2. The one-sentence summary
We run no ads, sell no data, and embed no analytics or tracking tools of any kind. Your game data is stored in association with your account; passwords are stored only as hashes. We do not send your answers or learning text to AI models: content generation and voice synthesis receive course text only. The details follow.
3. What we collect
Login identity (depending on the method you choose, only one):
- Email registration: email address + password (the password is stored as a salted scrypt hash; we cannot see it in plain text);
- Wallet login: the wallet address;
- Google / X login: the user ID and nickname/username provided by the third party.
Game data: learning progress, cards, units, furniture, themes, Chips, Glue, and onboarding progress.
Payment data: order information: receiving address, currency, amount, Glue applied as a discount, and transaction hash. Note: payment records on the blockchain are public by nature.
Technical information: IP address and server access logs; session cookie (sid, HttpOnly, used only to keep you signed in; the server does not store session data); browser localStorage (local state such as interface language).
4. What we do not collect or do
- We do not integrate any advertising, analytics, or tracking SDK;
- We do not sell or rent your data;
- We do not track you across sites;
- We do not verify age or identity (age is based on your own declaration; see Section 3 of the Terms and Conditions).
5. Where data goes (third parties)
Data leaves our servers only when it is "necessary to provide the service":
| Provider | Purpose | What we send |
|---|---|---|
| Resend | Sending the login verification code email | Your email address and the code content |
| Login (if you choose it); content generation and voice synthesis (Gemini/TTS) | Login: OAuth identifier; content and voice: course text, with no personal data | |
| DeepSeek | Course content generation | Course text, with no personal data |
| X | Login (if you choose it) | OAuth identifier |
| Hosting provider | Server provisioning | Technical logs (IP, etc.) |
Clarifications:
- Content generation and voice synthesis receive only course text (words, sentences, and descriptions of furniture or themes). They do not receive your answers, your email address, or your wallet address.
- Your game data is stored in the Service's database separated by account identifier; it is not mixed with other people's data in the same row or shared with other users.
- Payment information on the public blockchain can be viewed by anyone; this is not a leak attributable to us.
6. Storage location and cross-border transfers
- The Service is provided from a single server located in Asia. When you use the Service, data is transmitted directly from your device to that server and stored there.
- We do not have multiple servers; therefore, there is no data replication or further transfer between servers; wherever you are in the world, the data path is a single one: "your device → this server".
- If you are in Europe or any other region, your use of the Service means that you understand and agree that your data will be transmitted and stored in the country where the server is located, in the manner described above.
7. Retention periods
| Data | Retention period |
|---|---|
| Orders and payment records | 5 years (covering tax checks, payment disputes, and fraud review); after that, deleted or anonymized |
| Server logs (including IP) | 90 days |
| Login verification codes | 10 minutes; they expire automatically |
| Other game data | Kept while the account exists; deleted immediately when you delete your account (the rows associated with your account and login identity records are removed) |
8. Your rights
You can, at any time:
- Access and correct your data (in the in-game settings, or by contacting us);
- Export your backup data (by contacting us);
- Delete: the "Delete account" option in the game immediately deletes your game data and login identity records (only financial records are retained under Section 7).
To exercise any right, email us directly: donzujao@gmail.com
9. Security measures
- HTTPS encryption across the site;
- Game data is separated by account identifier in the Service's database, so each account can access only its own records;
- Passwords are stored only as a salted scrypt hash;
- Login sessions use a signed HttpOnly cookie, unreadable by page scripts; the server does not store session data, so the token cannot be leaked through a database dump.
10. Minors
- People under 13 years old are not the target audience of the Service; if we detect such accounts, we will delete them.
- Age is based on the user's declaration; we do not verify age or identity.
11. Changes to this policy
Updates to this policy will be published on this page (https://chipcastellano.com/privacidad) with an updated date; material changes will be announced in the game.