The Listening lab is a small, non-commercial project run by Ranjan Chaudhuri in Canberra, Australia. In this statement "we" means Ranjan Chaudhuri. The lab runs on a server in Sydney (DigitalOcean's SYD1 data centre). You can reach us at hello@tinglilab.com.
Your account. A username, the kind of account (learner, teacher, student, free account (made by yourself) or the shared trial), an optional display name, an email address if the account keeps one, with when it was confirmed (see Email), when the account was made and when you last signed in. Your password is stored only in scrambled form (a one-way hash): nobody, including us, can read it. Other accounts are made by us, or for students by their teacher.
Free accounts (since version 6). Adults can also make a free account themselves on the sign-in screen. We then keep the email address your sign-up link was sent to, as the account's confirmed address (since version 10: see Email), when you signed up, which is also our record that you told us you were 18 or over and had read this statement, and the link and site that brought you here (the link's tag and the site's domain, as for Trial visits), so we can see which announcements people found the lab by. On the day you sign up we also add one to a count for the country your internet address belongs to (counts only; the address isn't kept). To stop floods of sign-ups, the sign-in service counts each internet address's sign-ups, attempts and asks for links that day, and each mailbox's emails that day (known by a one-way hash of the address; since version 11 its reset links are counted apart), in its memory only: they're never written down, and go at the end of the day or when the service restarts. Free accounts have daily limits on what the AI and the voices do, and their saved file can be up to 4 MB; anything you did on the trial isn't carried over. Since version 9 we also keep, with the account, the day it was last used (one date, replaced on each day you use the lab, so that we can count how many accounts are still in use a week after they were made), the day you joined the waitlist if you signed up with an invitation or with the address you joined it with, and, if you press Tell me when the paid version opens in Settings → Account, the day you pressed it (Undo removes it). We count those presses by the link that brought each account, to see whether a paid version is wanted, and they're our note that you asked to hear if one opens.
The waitlist (since version 9). When the free places are taken, the sign-in screen offers to put you on a waitlist instead. We then keep the email address you give (we don't check it), the day you joined, and the tag of the link that brought you if it had one (such as ?from=forum). We keep the address only because you tick Email me when a place opens, and use it only to invite you when a place opens; the day you joined is our record for the founder offer, which counts people on the list by 31 December 2026. When we invite you, we also keep when, how long the invitation holds your place (48 hours), and its links in scrambled form (one-way hashes), so the links can't be read back from the server; if Postmark refuses the address, we keep when, and later invitations pass it by until you join again or we remove it (since version 11). Since version 10 the lab sends each invitation itself, by email (see Email). The waitlist keeps your address until you make an account, with the invitation or with the same email address, or ask to come off it: every invitation has a link that takes you off, or write to us. An invitation's link waits in the tab you opened it in, in your browser, until you use it, sign in to an account you already have, or close the tab. Joining gives the same answer whether or not an address was already on the list, so nobody can use it to find out who is. To stop floods, the sign-in service counts each internet address's joins that day in its memory only, as it does sign-ups: they're never written down.
Email (since version 10). The lab sends its own email, from lab@tinglilab.com, through Postmark (see Other services), and only this: the sign-up link you ask for on the sign-in screen (or, if the address already has an account, a note saying so that names the account); a link to set a new password, when you ask for one; a link to confirm an address you add or change in Settings → Account; the waitlist's invitations; the notice about free accounts, when there is one, to every account with a confirmed address; and, only to accounts that pressed Tell me when the paid version opens, news of the paid version: its opening, and any offer to free accounts before it. Nothing else: no other advertising. Every email is plain text, with no tracking of whether it's opened or which links are followed; the two that go to many people (the notice and the paid version's) come from notices@tinglilab.com and end with an unsubscribe link.
Your email address. A free account keeps the address its sign-up link was sent to, confirmed: the link proved the mailbox is yours. Learners, teachers and admins may keep one the same way, in Settings → Account: a new or changed address is confirmed by a link sent to it, and until the link is used the account keeps the address it had. Students and the trial have none. An address belongs to one account only; to compare addresses the lab ignores capital letters, and for Gmail's (gmail.com and googlemail.com) the dots and anything from a + onwards before the @, as Gmail does. You can sign in with a confirmed address as well as with the username (since version 11): the lab uses it only to find the account, compared the same way; a wrong password is counted for the lock-out by a one-way hash of the address, in the sign-in service's memory, for a quarter of an hour. When a sign-up link is asked for an address that already has an account, the note goes to that mailbox and the screen says what it always says, so nobody can use the lab to find out whether an address has an account; asking for a reset link answers the same way whatever happened.
The links. A sign-up link works once, for 24 hours, and so does a link to confirm an address; a reset link works once, within the hour, and setting a new password with it ends every other sign-in of the account. The server keeps a link's secret part only as a one-way hash, with the address it was sent to, the account (for a reset, or a change of address), the link's tag and the site that brought you (for a sign-up, as for a sign-up itself) and when it expires: until it's used, or about an hour after it expires. Once its email has gone, the link can't be read back from the server; until then (usually seconds) the email waiting to go holds it. A sign-up or reset link you open waits in that tab of your browser, as an invitation's does, until you use it, sign in to an account you already have, or close the tab.
The queue, and what's counted. Each email waits in a queue in the sign-in service's database only until Postmark has accepted it, usually within seconds. One that Postmark refuses, or that can't go in time (within a day, or before its link would lapse), is kept with the reason for seven days, without its text, so that we can see what went wrong, and then deleted. The nightly backups leave the queue out. The lab counts the email it sends each day by kind (how many sign-up links, resets and so on), without addresses.
The lab's email to us. The lab also emails us: when the free places, or the month's spending on free accounts, reach set marks; when someone signs up (the username, the link's tag, and whether by invitation, never the address); when the AI partner stops a role-play because something said suggests danger (the account's username, its kind and class, and the time: nothing of what was said, which stays in the lab, where reading it is recorded); when the day's sign-up links or the lab's account email reach their daily limit (since version 11: counts only); and once a day, the day's counts. To send each of these only once, the server keeps a small mark: a stopped role-play's time and conversation number for 90 days, and a month's spending marks for about three months.
Staying signed in. When you sign in, your browser keeps one cookie, zl_session, so you don't have to sign in on every visit. It does nothing else, and the lab sets no other cookies: none for advertising or analytics. (On the trial, the page also keeps a yes-or-no in your browser, to count returning visitors, and the date of your Try it conversation: see Trial visits.) It lasts 60 days from your last visit (one day for students and the trial), or until you sign out. The server keeps a record of each sign-in (when it began and was last used, and your browser's type) until it ends. Signing out also clears the lab's copy of your data from that browser, which matters on a shared or school device; only the voices' audio it has played or prepared, and the stroke-order data for the characters written or prepared there, stay, for anyone using the lab there to reuse.
Your practice data. Your word bank (including when you first heard each word), your own word lists (since version 12), the text of your listening clips and passages, your drill, dictation and writing results, your conversations with the AI partner (and their debriefs), anything you flag with ⚑ as wrong (a clip, a tone item or a character), with the note you add to it, and your settings; for a student, since version 13, a short summary of how they're doing on each of their class's lists (see Students). This lives in your browser and in one file on the server under your username, so it can follow you to your other devices. Each account can reach only its own file. On the trial (Try it), practice data stays in your browser rather than in a file on the server; what the server does keep about a trial visit is described under Trial visits and in the logs below.
Writing (since version 5). When you write characters in the Write tab, each stroke is checked in your browser, and the strokes you draw are never sent or kept. For each word you write, the lab keeps when you wrote it, how (learning it, from memory, tracing it or on paper), what prompted you (its sound, pinyin or meaning) and where in the lab you were, and, for each character, whether you wrote it cleanly, needed a hint, were shown it, skipped it, traced it or marked it yourself, and how many strokes were refused. The Dictation tab now also notes which words you heard wrong, so that you can practise writing them.
Trial visits (since version 4). When you press Try it, the lab notes the day; the country your internet address belongs to, looked up on our own server in DB-IP's free country database; the site that linked you to the lab (its domain only, such as reddit.com, and never an internet address) and the link's tag if it had one (such as ?from=forum); whether this browser had tried the lab before; and (since version 9) whether it had already had its Try it conversation. The page learns the linking site and the tag when you arrive, and keeps them in that browser tab only, until a sign-up has sent them or the tab is closed: Try it sends them too, and keeps them, so that if you then make a free account from the trial we know which link brought you. Whether the browser had tried before comes from a yes-or-no the page keeps in your browser once you've pressed Try it, with nothing in it that identifies you or the browser; it stays when you leave the trial, so that we can count returning visitors, and clearing the site's data in your browser removes it. Likewise, once the first thing you say in a Try it conversation has been answered, the page keeps that day's date in your browser, so that the trial offers this browser a free account rather than another conversation; it stays when you leave the trial, and clearing the site's data removes it too.
The note doesn't hold your internet address. Instead, each visit is known by a code made from the address and the day with a secret that the lab's sign-in service holds only in its memory: it's never written down, it's dropped at midnight UTC, which is late morning in eastern Australia (the next day gets a new one), and a restart of the service also makes a new one, which gives the same address a new code. Everyone using the same internet address on the same day (a household, a school or an office, say) shares one code, and a visit keeps its code for as long as its trial lasts in that browser (until a day after it was last used). Once the day is over, nobody, including us, can work out which address a code belonged to, except from the web server logs, which record each request's address next to the code and are kept for 15 days. (The lab can be set instead to give each press of Try it a random code.) The trial uses the code to share its daily allowance out fairly between visitors; the trial's lines in the conversation log carry it, and so does the trial's sign-in record (see Staying signed in) until the trial ends in that browser.
We use these notes to count how many people try the lab, where they come from and what they use. They're kept 14 days; after that only the day's counts are kept (how many visits and presses, how many from browsers that had tried before or had had their Try it conversation, and from which countries, sites and link tags), without codes. The copies of the lab's database that we make for safekeeping leave the notes and the codes out.
Voice recordings (repeat-back, in the Tones tab). Adult learners can choose to keep them: they're uploaded to the server under your username, used only to test and improve the tone judge, and never shared. Untick keep my recordings and none are kept. Students', free accounts' and the trial's recordings are never uploaded; they stay on the device only as long as the screen needs them. If a friend records on your phone under a speaker name, their recordings are kept under your account with that name.
Voices and speech recognition through the server (since version 8). For Try it, free accounts and students, the lab's server makes the voices and passes speech to Microsoft, rather than their browser connecting to Microsoft itself (learners' and teachers' browsers still do: see Other services). The server sends Microsoft the text to read, or the sound from the microphone while it's on in the Talk tab, and Microsoft sends back the audio or the words. The server keeps no audio from a microphone and no transcript: the words go straight back to your browser, where they become your line in the conversation, kept with your conversations as before. It does keep the audio of single words it has made on the lab's paid speech plan (students' voices always are, and since version 9 the trial's and free accounts' too), for up to 30 days, and plays the same file to anyone who asks for the same word in the same voice: these are the words the voice libraries don't have, such as a class's own list. The files carry no account or visit, and their dates are set to the start of the day they were made (the server's own record of the exact time each was written stays, and only we can see it). Clips, texts and conversation lines aren't kept. DigitalOcean's weekly copies of the disk hold these files as they hold the logs; the nightly backup leaves them out (Backups). The conversation log (below) gains a line for each piece of speech the server makes and for about each minute it listens: the account (or, on the trial, the visit's code), the time, how many characters were read or how many seconds were listened to, and what they cost us; for listening, also how many times you spoke and how the listening ended. These lines are kept 90 days, like the rest of that log.
The conversation log. Every exchange with the AI partner is logged on the server: the time, the username, the role and topic, your line and the partner's reply, and any safety flag. Email addresses, links and long numbers are blanked out before anything is written. Requests for new clips and texts, and what came back, are logged the same way: all of each for students, the trial and free accounts, and its first 400 characters for other accounts; the trial's lines carry the visit's code (see Trial visits). The text read from a photo of a page for the Texts tab (since version 12) is logged as a text is, with the photo's size: never the photo itself. We read this log to check that the partner behaves well and to spot misuse. When the partner changes the subject because a conversation was heading somewhere unsuitable, or stops it because something said suggests danger, that exchange carries a safety flag; a student's teacher is shown their own students' flagged exchanges (see Students), and nobody else's.
Server logs. Like any web server, ours records each request: your internet address, the time, what was asked for, the username if you're signed in, the page that linked to it, your browser type, and for the trial the visit's code (see Trial visits). We use these to fix problems, to stop abuse (for example, repeated wrong passwords), and to count how much each part of the lab is used.
A record of what's done with accounts. The lab records who made, changed, suspended or deleted a login (including sign-ups, accounts deleted by their owners, and that an email address was changed, though not the address itself; since version 9, also that waitlist invitations were made and that addresses came off the list; since version 10, that a reset or a new address was asked for, that an address was confirmed or removed, and that a mailing went and to how many: never the addresses), who confirmed a parent's or carer's consent, who opened a student's progress page, one of their conversations or the list of safety flags, who marked a safety flag reviewed, and (since version 13) who saved or deleted a class's list, with its name and how many items, each with the time. Only we can read this record. We use it to check that accounts are looked after properly and to answer questions about them.
We can see everything on the server, and look at it only to run, fix and improve the lab and to keep it safe.
Anthropic (Claude) writes the listening clips and passages and plays the conversation partner. Our server sends it the text it needs: the words you're practising, and for conversations, the conversation so far. A photo of a page you take for the Texts tab (since version 12) goes to it the same way, to read the page's Chinese text: the lab's server passes it on and keeps no copy of it (its log keeps the text read, as it does a text's), and the text comes back to your browser for you to check. It never receives your username, password or internet address. Under its commercial terms Anthropic does not train its models on this data, deletes it within 30 days, and keeps it for up to two years only if its automated safety systems flag it. Anthropic may process it in the United States, Europe, Asia or Australia, and stores it in the United States.
Microsoft Azure Speech turns text into the lab's voices, and in the Talk tab it turns your speech into text while the microphone is on. On learners' and teachers' accounts your browser connects to Microsoft directly for this, so Microsoft sees your internet address. For Try it, free accounts and students the lab's server connects instead (since version 8: see Voices and speech recognition through the server), so Microsoft sees the server's address, not yours. Microsoft processes the audio and text in its Australia East region and, for this kind of real-time use, doesn't store them.
Postmark (AC PM LLC, part of ActiveCampaign, in the United States) sends the lab's email (since version 10). It receives each email's address, subject and text (which may name your username, never your password; our alerts name an account's username and a time, never what was said), and records when it was sent and whether it was delivered. It keeps each message, with its content and that record, for 45 days (its standard retention, which the lab doesn't lengthen), and only overall statistics after that. It doesn't track opens or links for the lab. It keeps a list of the addresses it mustn't send to again: those whose email bounced or was reported as spam, and, for the two mailings, those who unsubscribed.
Migadu (Migadu-Mail GmbH, in Switzerland) holds the lab's mailbox, hello@tinglilab.com (since version 10): the email you send us, including replies to the lab's own email, our replies, and the lab's alerts to us, under its terms until we delete them. The lab's earlier Gmail address still receives email: what reaches it, and what that mailbox held before version 10, stays with Google under its terms until we delete it.
DigitalOcean provides the server in Sydney. It stores what's on the server, and weekly copies of its disk for four weeks (Backups), but doesn't use them for anything else.
Backblaze keeps the server's nightly backups, in the United States (since version 7). They're encrypted on our server before they leave it, so Backblaze holds only what it can't read, and doesn't use it for anything else (Backups).
The page and all the code it runs come from the lab's own server: apart from the connection to Microsoft for speech on learners' and teachers' accounts, your browser loads nothing from other sites.
We don't share your data with anyone else, unless the law requires us to.
amy.k7m.| What | Where | How long |
|---|---|---|
| Your account (with its email address, if it keeps one, and when that was confirmed; for a free account, when you signed up, and the link and site that brought you) | the lab's server, Sydney | until the account is closed (an address you remove goes at once) |
| Your practice data and recordings | your browser, and the server | until you delete them or ask us to; removed from the server within a month of the account being closed |
| The sign-in cookie | your browser | 60 days from your last visit (students and trial: one day), or until you sign out |
| Conversation log (on the trial's lines, the visit's code), and the safety flags a teacher sees from it | the server | 90 days |
| The conversation log's lines for voices and speech recognition made through the server (the account or the visit's code, the time, the characters or seconds, their cost) | the server | 90 days |
| Audio of single words the server made on its paid speech plan (shared; no account or visit attached) | the server | up to 30 days (in DigitalOcean's weekly copies, four weeks more; not in the nightly backups) |
| A class's lists (their names, items, readings and meanings, and who saved each and when; since version 13) | the server; a copy on each student's device | until the teacher deletes the list, or the class is deleted; the device's copy until sign-out |
| The "reviewed" mark shown on a safety flag (who, and when) | the server | 120 days (the record of what's done with accounts, below, keeps who reviewed what) |
| The record of what's done with accounts (who did what, when) | the server | while the lab runs |
| Sign-in records (when each sign-in began and was last used, the browser's type; on the trial, the visit's code) | the server | until the sign-in ends (60 days after its last use; students and the trial: a day) |
| Web server logs (on the trial's requests, the visit's code) | the server | 15 days |
| Notes of trial visits (the day, the country, the linking site and link tag, tried before or not, had its Try it conversation or not, the visit's code) | the server | 14 days; then only the day's counts, without codes, while the lab runs |
| The site that linked you here and the link's tag, before you sign up | that tab of your browser | until a sign-up has sent them (Try it sends them too, and keeps them), or the tab is closed |
| Whether this browser has tried the lab (yes or no) | your browser | until you clear the site's data |
| The date of this browser's Try it conversation | your browser | until you clear the site's data |
| An invitation's link, or a sign-up or reset link, once you open it | your browser (that tab only) | until you use it, sign in to an account you already have, or close the tab |
| The waitlist (your email address, the day you joined, the link's tag; an invitation's day, how long it holds a place, and its links in scrambled form; when Postmark refused an invitation's address, since version 11) | the server | until you make an account (with the invitation, or with the same email address), or ask to come off the list |
| Waitlist joins from each internet address that day | the sign-in service's memory | until the end of the day, or a restart |
| A link sent by email (to sign up, set a new password or confirm an address): its secret part as a one-way hash, the address, the account (a reset, or a change of address), the link's tag and site (a sign-up), and when it expires | the server | until it's used, or about an hour after it expires (sign-up and address links last 24 hours, reset links an hour) |
| An email waiting to go (the address and the message) | the server (not in the nightly backups; DigitalOcean's weekly copies may hold one waiting then) | until Postmark accepts it, usually seconds; one it refused, or that couldn't go in time, seven days, without its text |
| The email sent each day, by kind, and when the day's limits were reached (counts only) | the server | while the lab runs |
| The marks that send each of the lab's alerts to us once (a stopped role-play's time and conversation number; a month's spending marks) | the server | 90 days (a month's marks, about three months) |
| Asks for links from each internet address, and emails and reset links to each mailbox (known by a one-way hash of the address), that day | the sign-in service's memory | until the end of the day, or a restart |
| Failed sign-ins: the username (or a one-way hash of an address typed in its place) and the internet address, with the times | the sign-in service's memory | a quarter of an hour (gone within the hour after, or at a restart) |
| A free account's last-used day, the day it joined the waitlist, and the day it asked to hear of a paid version | the server, with the account | until the account is closed (the last-used day is replaced each day; the paid-version day until you undo it) |
| Daily usage counts per account (how many clips, drills and so on) | the server | while the lab runs |
| Sign-up counts by day (how many, by link tag, linking site and country) | the server | while the lab runs (counts only) |
| Sign-ups and attempts from each internet address that day | the sign-in service's memory | until the end of the day, or a restart |
| Failed sign-in attempts (username tried, internet address) | the server's system log | up to a few months |
| Anthropic's copy of texts and conversations | Anthropic, USA | up to 30 days; up to two years if flagged by its safety systems |
| A photo of a page for Texts (since version 12) | not kept by the lab: its server passes it to Anthropic, USA | Anthropic's copy as texts', above. The conversation log keeps the text read from it (all of it for students and free accounts, its first 400 characters otherwise) and the photo's size, 90 days; never the photo |
| Microsoft's copy of voice and speech | Azure, Australia East | not stored |
| Postmark's copy of each email (the address, the subject and the text, and whether it was delivered) | Postmark, USA | 45 days; overall statistics after that |
| Postmark's list of addresses not to send to again (bounced, reported as spam, or unsubscribed from the mailings) | Postmark, USA | while the lab sends through Postmark |
| Your email to us and our replies; the lab's alerts to us | Migadu, Switzerland (the lab's mailbox, hello@tinglilab.com); at the lab's earlier address, Google (Gmail) | until we delete them |
| Backups of all of the above that the server keeps | Backblaze (encrypted), in the United States, and DigitalOcean | up to two months |
Backups (since version 7). Every night the server makes a copy of what it keeps (accounts, your progress and recordings, and the lab's own logs, but not the email waiting to go), encrypts it on the server, and stores it with Backblaze, a backup company, in the United States. Backblaze can't read it. DigitalOcean, which hosts the server, also keeps weekly copies of its disk for four weeks. Copies are kept for up to two months, so when an account is deleted, its files leave the backups within about three months: the 28 days, then the last copies that held them expire. The web server's logs aren't in the nightly backups; DigitalOcean's weekly copies hold the whole disk as it was that day, so they hold those logs too, for the four weeks. The same goes for the audio of single words the server keeps (Voices and speech recognition through the server): not in the nightly backups, but in the weekly copies.
Write to hello@tinglilab.com. We'll usually reply within two weeks. If you're not happy with our answer, the Office of the Australian Information Commissioner (oaic.gov.au) handles privacy complaints in Australia.
If we change how the lab handles your data, we'll update this page, give it a new version number and date, and say so on the lab's help page.
Version 13 (October 2026) adds the lists a teacher gives a class: the lab keeps them on its server, with who saved each and when, until the teacher deletes them or the class goes, and the class's students see them; the teacher's Progress counts each student's rounds from each list, from the practice records the lab already keeps, and shows how they're doing on it, from a short summary their page saves with their practice (the list's items met, right at the last answer, due, and marked misses, and where), worked out from what the lab already keeps. The record of what's done with accounts notes who saved or deleted a class's list.
Version 12 (October 2026) adds the photo of a page in the Texts tab: it goes through the lab's server to Anthropic, to read its text, and the lab keeps no copy; and your own word lists among your practice data. The review schedule is worked out from the practice the lab already keeps, to which it adds the syllables of the tones you hear and say, and the words you read in Dictation with whether you read them right. The conversation log's paragraph now says that every account's requests for clips and texts are logged, as they have been: for other accounts than students', the trial's and free accounts', the first 400 characters of each.
Version 11 (October 2026) says that you can sign in with the email address confirmed on your account, which the lab uses only to find the account; that a mailbox's reset links are counted apart from its other email, in memory, as its emails are; that the waitlist keeps when Postmark refused an invitation's address; that the day's counts note when the day's email limits were reached, and we're told when one is; and the failed sign-ins the sign-in service holds in memory, for its lock-out.
Version 10 (October 2026) added the lab's own email, sent through Postmark, which joins the services that see some of your data: a free account now starts from a link sent to your email address, and keeps that address, confirmed, with one account for each address; learners, teachers and admins may keep a confirmed address too, to reset a password by email; what the lab sends, and to whom; the links and how they're kept; the queue, the day's counts, and our alerts and their marks, with how long each is kept; the mailings' unsubscribe link; and the waitlist's invitations, now sent by the lab itself. The lab's mailbox is now hello@tinglilab.com, at Migadu, in place of Gmail.
Version 9 (October 2026) added the waitlist: what it keeps, why, for how long, and how to come off it; its invitations, sent from the lab's Gmail mailbox until the lab sends its own email, so Google joins the services that see some of your data; the day a free account was last used, the day it joined the waitlist, and the day it asked to hear of a paid version; and the date the trial keeps in your browser after its conversation, with the visit's note of it, and an invitation's link in the tab it was opened in. The trial's and free accounts' voices are now made on the paid speech plan, as students' are.
Version 8 (October 2026) added the voices and speech recognition made through the lab's server for Try it, free accounts and students: Microsoft sees the server's address rather than theirs; the server keeps no audio or transcript of speech; the audio of single words it keeps for up to 30 days, shared and with no account attached; and the log's lines for each synthesis and each minute of recognition.
Version 7 (October 2026) added the nightly encrypted backups: what they hold, where, and how long; Backblaze, which keeps them and can't read them, among the services that see your data; and DigitalOcean's weekly copies of the server's disk.
Version 6 (October 2026) added free accounts people make themselves, the optional email address and sign-up details kept with them, the day's counts of sign-ups (and the per-address counts held in memory), their daily limits, what the log keeps of their writing requests, and deleting your own account. Version 5 (October 2026) added writing results and the words heard wrong in dictation, says that handwriting itself never leaves your device, says that a browser keeps the stroke-order data it has loaded, and names the flags you raise with ⚑. Version 4 (October 2026) added the notes the lab keeps about trial visits: the country of the address, the site that linked here and the link's tag, whether the browser had tried before, and each visit's code, which the trial's lines in the conversation and web server logs also carry; it also describes sign-in records and the voices' audio a browser keeps. Version 3 (October 2026) added what a student's teacher sees (progress, conversations and safety flags), the record kept when teachers look and review, the class spreadsheet, students' own view of what their teacher sees, and the date each word was first heard. Version 2 (October 2026) added teachers, students and parents' consent.