Who I am
joshuawwy.com is run by Joshua Wong in Singapore. I sell the MOE Chinese Anki Deck through the Chinese-deck shop on this site (until 19 October 2026 it was sold on Gumroad). This page explains what personal data the site collects and what I do with it, in line with Singapore's Personal Data Protection Act 2012 (PDPA). I am the contact for any data protection question: hello@joshuawwy.com.
What the site collects
There are no accounts or comments here. Apart from the Chinese-deck shop (below), what the site collects is gathered automatically when you visit:
- Meta Pixel (Meta Platforms). It records the pages you view and when you click through to the deck's pages. It uses cookies and sends Meta your IP address, browser details and the page address. Meta may link this to your Facebook or Instagram account.
- Google Analytics (Google). It counts visits and shows how people use the site. It uses cookies and sends Google your IP address, device and browser details, and the pages you view.
- Google Ads tag (Google), loaded with Google Analytics. It records visits that come from my Google search ads and uses cookies to do so. When you take a free sample, it tells Google about the sign-up so I can see which searches lead to one, together with your email address hashed (scrambled so it can't be read) in your browser before it is sent; Google uses the hash only to match the sign-up to its ad.
- Microsoft Advertising UET tag (Microsoft). It records visits that come from my Bing (Microsoft) search ads and uses cookies to do so. When you take a free sample, it tells Microsoft about the sign-up so I can see which searches lead to one, together with your email address hashed (scrambled so it can't be read) in your browser before it is sent; Microsoft uses the hash only to match the sign-up to its ad.
- Microsoft Clarity (Microsoft), on the Level pages and the articles my search ads open. It records how the page is used (scrolling, taps, mouse movement) so I can see where it is unclear, and uses cookies to do so. What you type is masked before it leaves your browser. Microsoft receives your IP address, device and browser details and the pages you view.
- Where you came from. On your first visit, your browser keeps the first page you opened, the site that sent you there (the referrer, without the search terms) and any ad click ID in the link (Google's gclid, gbraid or wbraid, Microsoft's msclkid, Meta's fbclid), plus the link's campaign tags, for 30 days or until you arrive through another ad. They are sent to the shop only if you take a free sample or buy (below), to tell which ad or search led there.
- Google Fonts. The site's fonts load from Google's servers, so your browser sends Google your IP address when it fetches them.
- Cloudflare, which hosts the site. It processes your IP address and request details to deliver pages and protect the site from abuse, and keeps standard server logs.
- The 听写 list reader (/tingxie-reader). The words you paste are sent to the site to look them up and are not stored. A Cloudflare Turnstile check confirms you are not a bot, and your IP address feeds a rate-limit counter that expires after 10 minutes.
- Your light or dark theme choice is saved in your own browser and never sent to me.
Why
- To run and secure the site.
- To see which pages are useful (Google Analytics) and where a page is unclear (Microsoft Clarity).
- To measure which of my Google and Microsoft (Bing) search ads lead to free samples and purchases, so I can spend on the searches that work (the Google Ads tag and Microsoft's UET tag, and the purchases the shop reports to Google and Microsoft).
- To measure how my Facebook and Instagram ads perform, including visits from those ads, and to show ads to people who have visited this site or who are similar to them (Meta Pixel).
I do not sell personal data.
Gumroad
Until 19 October 2026 the free sample and the deck were sold on Gumroad, which handled payment, delivery and purchase emails under its own privacy policy, with the same Meta Pixel as this site. If you got the deck there, your Gumroad library keeps working. As the seller I received your email address and order details from Gumroad; I used them to move your purchase to My decks in the shop below and to email you about it, and you can unsubscribe from any marketing email at any time.
The Chinese-deck shop
The free sample and the deck come from my own shop on this site, under /chinese/. When you ask for a free sample or buy there, the shop stores:
- your email address and your child's Level (P1 to P6);
- your IP address, browser user agent and country, and the Meta cookie ids (fbp and fbc) your browser holds;
- where you came from, as your browser kept it (above): the ad click IDs, the first page you opened, the site that sent you and the campaign tags;
- what you bought and when, if you buy.
I use them to send you the free sample and your decks, to send you emails about setting up Anki and about the deck, and to send Meta Conversions API events when you take a free sample or buy. Those events carry your email address hashed (scrambled so it can't be read), with your IP address, user agent, country (hashed) and Meta cookie ids, so Meta can match the event to its ad without me sending your address. When you buy, the shop also reports the purchase to Google Ads through Google's Data Manager API, if you took a free sample here first or came from a Google ad: your email address hashed the same way, the Google click ID if there is one, an order reference, the amount and the time. If you came from a Microsoft (Bing) search ad, the shop likewise reports the purchase to Microsoft Advertising: the Microsoft click ID (msclkid) from that ad, your email address hashed, the amount and the time. If you get a refund, the shop corrects the amount it reported. A Cloudflare Turnstile check on the shop's forms confirms you are not a bot.
The shop uses these services:
- Stripe handles payment. Your card details go to Stripe, never to me, under Stripe's own privacy policy.
- Resend sends the shop's emails, from mail.joshuawwy.com.
- Cloudflare D1 and R2 store the shop's records and the deck files.
- Trustpilot sends you an invitation to review the deck after a purchase. It receives your email address and an order reference for that.
Every email about the deck has an unsubscribe link at the bottom; one click stops them. Emails you need for something you asked for or bought (a sign-in link to My decks, for example) still come. To have your data deleted, email hello@joshuawwy.com and I will delete it, apart from purchase records I must keep for tax and accounting.
Who else receives it
Meta, Google, Microsoft, Cloudflare, Gumroad, Stripe, Resend and Trustpilot, as described above. They may process data outside Singapore, including in the United States. Meta and Google also use the data under their own policies: Meta, Google. In their reports to me I see totals, not who you are.
Your choices and consent
By using this site with cookies enabled, you consent to the collection and use described here. You can withdraw that consent at any time:
- Block or clear cookies for this site in your browser, or use a tracker blocker. The site works without them.
- Opt out of Google Analytics with Google's browser add-on.
- Change how Meta uses your activity in your Meta ad preferences.
- Email me at hello@joshuawwy.com, and I will stop using your data for the purposes you withdraw from, as far as it is in my control.
Access and correction
Under the PDPA you can ask what personal data I hold about you and how it has been used or disclosed in the past year, and ask me to correct it. Email hello@joshuawwy.com and I will reply within 30 days.
Keeping and protecting it
I keep personal data only as long as needed for the purposes above, and use reasonable security arrangements to protect it.
Changes
If this policy changes, I will update this page and its effective date.