CTN Hub ("the app", "we") is a web app available at https://www.ctnhub.io.vn. It shows the public activity schedule and events of our group, a Library of past programs for signed-in members, and a personal English tool: you write English sentences, an AI model corrects and explains them, and your learning history is saved in a Google Sheet inside your own Google Drive. This policy explains what data the app accesses, how it is used, where it is stored and who it is shared with. Contact: lhduy.dev@gmail.com.
1. Summary
- The English tool runs in your browser; your learning data is stored in one Google Sheet in your own Google Drive, which you own and control.
- Events and the Library are stored in a shared Google Sheet owned by the app administrator. Our server reads your Google email address only to check that you are signed in and whether you may edit the Library (see section 3).
- We do not collect, sell, rent or share your personal data, and we do not use it for advertising.
- We do not use analytics, tracking cookies or advertising scripts.
2. Google user data we access
Scope requested
When you sign in with Google, the app requests: https://www.googleapis.com/auth/drive.file ("See, edit, create and delete only the specific Google Drive files you use with this app"), and openid + email (your Google account email address). The app does not request your contacts or access to any other file in your Drive.
What the app does with this permission
- Creates one spreadsheet named "CTN Hub – Dữ liệu cá nhân" in your Drive the first time you sign in, and finds that same file again when you sign in on another device (using a private file property set by the app).
- Reads and writes rows in that spreadsheet: the sentences you write, the AI corrections and explanations, daily goals and topics, daily summaries and your app settings, including your Gemini API key so it can be loaded automatically when you sign in on another device or browser.
- The app cannot see, read or change any other file in your Google Drive.
Access token
The Google access token is short-lived (about one hour). So that reloading the page does not require signing in again, the app keeps the current token and its expiry time in your browser's local storage on your device. It is used only to call Google's APIs, never sent to any other server, ignored once expired, and deleted when you sign out.
Email address
Your email address is shown in the account menu and stored in your browser while you are signed in. When you open the Library, your browser sends your Google access token to our server, which asks Google to confirm the token and the email address it belongs to, then compares the email with the list of editors set by the administrator. The server does not save your email address or token (it keeps the verification result in memory for a few minutes so it does not ask Google again on every request), and does not use your token to access your Drive.
3. Events and Library
The schedule, events and Library are read from and written to a Google Sheet owned by the app administrator, using a service account. Anyone can view published schedules and upcoming events without signing in. The Library (past programs and their internal documents) requires signing in. When an editor creates or changes an item, their email address and the time are saved with that item in the shared sheet.
4. AI processing (Google Gemini API)
To correct sentences and create exercises, the app uses the Google Gemini API with an API key that you create and enter yourself. The key is saved in your own spreadsheet (see section 2) and in your browser; anyone you share that spreadsheet with can see it, so do not share the file. When you submit a sentence or request exercises, your browser sends the following directly to Google's Gemini API (generativelanguage.googleapis.com):
- the sentence you wrote, and the exercise prompt if you are answering an exercise;
- learning context: your work domain, the exercise topic, and the types of mistakes you made recently (taken from your spreadsheet) so the exercises target your weak points;
- for the daily summary, the sentences you wrote that day.
With your own key, this data goes from your browser to Google only and never passes through any server operated by us. Its processing is governed by Google's Gemini API Additional Terms of Service, which you accepted when creating your key. Under those terms, content sent with keys on Google's unpaid tier may be used by Google to improve its products, so please do not write confidential or sensitive information in your sentences.
Group backup key
If your own key is missing, busy or rejected, the app may use a backup Gemini key provided by our group. In that case your browser sends the same data listed above, with your Google access token, to our server function on Vercel (/api/ai). The server checks with Google that you are signed in, builds the request and forwards it to the Gemini API with the group key, then returns the answer. The server does not save your sentences, your email address or your token; it only logs the task type, the model used, the time taken and error codes, to keep the service working.
We do not use your data, including Google user data, to develop, improve or train AI or machine learning models.
5. Data stored in your browser
The app stores the following in your browser's local storage on your device. It is not sent to us.
- your Gemini API key (removed when you sign out; it is reloaded from your spreadsheet when you sign in), and which Gemini models are temporarily busy so the app can switch to another one;
- the ID of your data spreadsheet, a flag that you have signed in before, the current short-lived Google access token and your Google email address (both deleted when you sign out);
- sentences that were graded but could not yet be saved to your spreadsheet (for example when offline);
- today's exercise sets, recent topics, and display preferences such as view mode and speech rate.
Pronunciation playback uses your browser's built-in text-to-speech feature; the app sends no audio or text to us for this.
6. Hosting
The app's web pages are served by Vercel. Like any web host, Vercel may process standard technical request data (such as IP address, browser type and time of request) to deliver and secure the website. See Vercel's Privacy Policy. The app does not send your learning data to Vercel. When you open the Library, your access token is sent to our server function on Vercel only to verify your email address as described in section 2; it is not stored.
7. Sharing and transfer
We do not sell, rent, share or transfer your data to anyone. The only transfers are the ones you trigger yourself as described above: to Google Drive and Google Sheets (to store your data in your own file), to the Google Gemini API (to grade your sentences, directly or through our server when the group backup key is used), and to our server to verify your sign-in for the Library. We do not allow humans to read your data, except when you contact us and explicitly ask for help with it, or when required by law.
8. Google API Services User Data Policy
CTN Hub's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
9. Retention and deletion
- Your spreadsheet stays in your Google Drive until you delete it. You can open, edit, download or delete it at any time from Google Drive.
- You can revoke the app's access at any time at myaccount.google.com/permissions.
- You can remove data stored in your browser by clearing this site's data in your browser settings. Signing out in the app revokes the current access token.
- We keep no copy of your English learning data. If you are a Library editor, your email address is saved with the items you create or change in the shared sheet; contact us to have it removed.
10. Children
The app is not directed to children under 13 and we do not knowingly process their data.
11. Changes
If this policy changes, the new version will be published on this page with a new "Last updated" date.
12. Contact
Questions or requests about privacy: lhduy.dev@gmail.com.
Tóm tắt bằng tiếng Việt
- Phần Tiếng Anh chạy trên trình duyệt, dữ liệu nằm trong Drive của bạn. Chúng tôi không thu thập, bán hay chia sẻ dữ liệu của bạn, không dùng công cụ theo dõi hay quảng cáo.
- Khi đăng nhập Google, web xin quyền
drive.file(tạo và dùng đúng một file "CTN Hub – Dữ liệu cá nhân" trong Drive của bạn cho phần Tiếng Anh) và email Google của bạn. Web không xem được file nào khác. - Lịch sinh hoạt, chương trình và Thư viện lưu trong một Google Sheet chung của quản trị viên. Ai cũng xem được lịch và chương trình sắp tới; Thư viện cần đăng nhập. Máy chủ chỉ dùng email để kiểm tra bạn đã đăng nhập và có quyền sửa hay không, không lưu email hay token của bạn. Khi người sửa lưu một mục, email và thời điểm được ghi kèm mục đó.
- Để chấm câu và soạn bài tập, trình duyệt gửi câu bạn viết, lĩnh vực, chủ đề và các loại lỗi gần đây thẳng tới Google Gemini API bằng khóa do bạn tự tạo. Khi khóa của bạn chưa có, đang bận hoặc lỗi, web có thể dùng khóa dự phòng của nhóm: nội dung trên đi qua máy chủ của web rồi tới Gemini; máy chủ không lưu câu, email hay token của bạn, chỉ ghi loại việc, model và thời gian xử lý. Với khóa miễn phí, Google có thể dùng nội dung này để cải thiện sản phẩm, vì vậy đừng viết thông tin bí mật.
- Khóa Gemini được lưu trong Google Sheet của bạn để tự nạp khi đăng nhập ở máy khác (đừng chia sẻ file Sheet). Khóa Gemini, ID file dữ liệu, token đăng nhập Google ngắn hạn (khoảng 1 giờ) và email Google (xóa khi đăng xuất), câu chưa lưu được, bộ bài tập trong ngày và tùy chọn hiển thị chỉ lưu trong trình duyệt của bạn.
- Bạn có thể xóa file trong Drive, thu hồi quyền tại myaccount.google.com/permissions và xóa dữ liệu trang web trong trình duyệt bất cứ lúc nào. Liên hệ: lhduy.dev@gmail.com.