XiYouQuest Privacy Notice
Last updated 25 September 2026
Draft for review. This notice is awaiting review by the responsible HKUST unit and the University Data Privacy Officer. It describes how the system works today; wording may change after that review.
What we collect
- Your HKUST identity: name, HKUST email address and, if your account provides one, a profile picture, received from HKUST single sign-on.
- Your learning record: practice sessions and scores, pronunciation scores, mock-exam results with AI feedback, study plans, quest progress, experience points, streaks and achievements.
- Companion chats: your messages, transcripts of what you say, and the scores for them.
- Images: an avatar you upload, and scene images generated for your chats.
- Security and technical records: for each sign-in session, your IP address and browser; a security log of sign-ins, refused sign-ins, data exports, account deletions, avatar uploads and rate-limit refusals.
Voice recordings are not stored by XiYouQuest. They are sent to iFLYTEK for scoring and recognition and discarded by XiYouQuest afterwards.
Why we use it
- To run Putonghua (PSC) practice: scoring, feedback and study plans.
- To run the game and social features: levels, the leaderboard and friends.
- To keep the service secure: preventing abuse and investigating faults or incidents.
XiYouQuest is a practice tool. Its scores are not official PSC results and are not used for grading. We do not use your data for marketing or advertising.
Signing in with an HKUST account is required to use XiYouQuest. Microphone access is needed only for speaking and pronunciation exercises.
What other students can see
- Any signed-in user can find you by name or friend code and see your display name, avatar, level and friend code. The global leaderboard shows the top 20 students by experience points, accuracy or streak, with their names and avatars.
- Your friends also see your total experience points, login streak, number of practice sessions, average practice score for each component, your achievements with their dates, and your chosen companion.
- Only you see your mock-exam results, chats and transcripts, study plans, detailed practice history and AI feedback.
Your display name starts as your name from HKUST sign-on and can be changed on your Profile page. There is currently no setting to hide yourself from search or the leaderboard; this is under review.
Who processes it, and where
These service providers process data on our behalf. All of them are outside Hong Kong, so using XiYouQuest transfers your data outside Hong Kong.
| Service | Role | Receives | Location |
|---|---|---|---|
| Microsoft Entra ID (HKUST tenants) | Sign-in with your HKUST account | Your HKUST sign-in | HKUST's Microsoft tenants |
| Supabase | Database and file storage | All account, practice, chat and learning records; avatar and scene images | Mumbai, India (AWS ap-south-1) |
| Vercel | Hosts the website and its server code | Every request you make to XiYouQuest | United States (primary processing), global edge network |
| iFLYTEK Open Platform (SYNLAN Technology Pte. Ltd.) | Speech recognition, pronunciation scoring, text-to-speech | Your voice recordings and the text being practised or spoken | Singapore |
| OpenRouter | Routes AI requests to a model host | Practice results, chat messages and speech transcripts needed for feedback, study plans and companion replies | United States |
| AI model hosts chosen by OpenRouter | Generate feedback, study plans, companion replies and scene images | The same request content as OpenRouter | Hosts outside mainland China that retain no prompts and do not train on them (for example DeepInfra, Microsoft Azure, Google Vertex AI) |
How long we keep it
- Your learning record and chats are kept while your account exists.
- Security log entries are deleted after 180 days.
- A sign-in session ends after 8 hours without use.
- When you delete your account, your records and images are erased at once. Security log entries about the account remain until they expire.
Your rights
- Access: download a copy of your data from Profile, Your Data, Download.
- Correction: change your display name on your Profile page. To correct anything else, contact the Data Privacy Officer.
- Deletion: delete your account from Profile, Danger Zone, Delete Account.
Contact
Questions about your personal data: the University Data Privacy Officer, ispdpo@ust.hk. To report a security problem: HKUST ITSO, security@ust.hk.