Learn Languages with Retriever — International Transfer of Personal Data
This page reproduces the international-transfer section (6) and the Apps in Toss mini-app section (10-2) of the Learn Languages with Retriever Privacy Policy. Under Article 28-8 of Korea's Personal Information Protection Act it states who receives your data, in which country, how to contact them, what is transferred, when and how, for what purpose and for how long, together with your right to refuse and the consequences of refusing. The Privacy Policy (Korean text) is the authoritative document; where the two differ, the Privacy Policy prevails.
6. International transfers
Most of the processors in section 5 are incorporated and operate servers outside Korea, so personal data is transferred abroad to the extent needed to run the Service (PIPA Art. 28-8). There are two legal grounds: processing and storage entrusted for the performance of the Service (database and server hosting, read-aloud synthesis, speech recognition in the Apps in Toss mini-app, notification and email delivery) rests on Art. 28-8(1)(iii) and is disclosed through this policy, while transfers for the AI tutor, Daily Talk and pronunciation coaching rest on Art. 28-8(1)(i) and require your separate in-app consent (section 10). For transfers from the EEA/UK we rely on the European Commission's Standard Contractual Clauses included in each provider's data processing agreement.
| Recipient | Country | When and how | Data | Purpose | Retention |
|---|---|---|---|---|---|
| Supabase, Inc. (privacy@supabase.io) | United States (data is stored in the Seoul region `ap-northeast-2`; remote administrative access may occur from the US) | Continuously, over HTTPS/TLS, whenever you sign in or sync progress | Account data and learning records | Database hosting | Until account deletion |
| Vercel Inc. (privacy@vercel.com) | United States | Continuously, over HTTPS/TLS, whenever you use the Service | Data in requests, access logs | Web and API hosting | Until end of contract (logs 3 months) |
| Google LLC | United States | Alternate/fallback provider — same trigger and method as the OpenAI row below. In the Apps in Toss mini-app used only as the fallback path for read-aloud; recorded audio is never sent | Same items as the OpenAI row below (excluding recorded audio) | AI replies and speech synthesis | Discarded immediately |
| Groq, Inc. (privacy@groq.com) | United States | Alternate provider — same trigger and method | Text you type or say; level in the language you are learning, native language, chosen partner and scenario | AI replies | Discarded immediately |
| OpenAI, L.L.C. (privacy@openai.com) | United States | After you consent to AI sharing inside the app, over HTTPS/TLS at the moment you use AI conversation, pronunciation coaching or read-aloud. In the Apps in Toss mini-app: a study sentence is sent when read-aloud plays, and the recorded audio is sent when you grant microphone permission and start a speaking round, by the same method | Text you type or say (the on-device transcript of your speech); level in the language you are learning, native language, chosen partner and scenario; sentences to be read. In the Apps in Toss mini-app: the audio recorded in a speaking round | AI replies, speech synthesis, speech recognition (Apps in Toss mini-app) | Discarded immediately |
| 650 Industries, Inc. (privacy@expo.dev) | United States | Over HTTPS/TLS, when a notification is sent | Push token, notification content | Push delivery | Until notifications off / account deleted |
| Resend, Inc. (privacy@resend.com) | United States | Over HTTPS/TLS, when an email is sent | Email address, message body | Service and invitation email | The provider's log-retention period |
| RevenueCat, Inc. (support@revenuecat.com) | United States | Over HTTPS/TLS, at the moment of purchase | Purchase history, app user id | Receipt validation | Payment-dispute handling period |
| Apple Inc. · Google LLC | United States | Over each platform's encrypted channel, at purchase or notification delivery | Store account identifier, transaction data, push token | Payment processing and push delivery | Per each company's policy |
How to refuse a transfer — storing your account and learning record (rows 1–2) is essential to the Service, so refusing it means you cannot register or sync progress. Every other transfer can be refused by turning the feature off: Settings > Sound to disable AI voice, simply not using the AI tutor, and Settings > Notifications to disable notifications. Refusing these does not restrict the rest of the learning features.
Refusing in the Apps in Toss mini-app — the mini-app has no AI conversation feature, so nothing you write is transmitted. The transfer of speaking-round audio does not happen if you decline microphone permission; only that round is skipped and the rest of the lesson continues. Read-aloud in the mini-app uses server AI voice only (there is no built-in device voice), so the transfer of app-authored study sentences cannot be refused other than by not using the mini-app — those sentences contain none of your personal data. Account and learning-record storage (rows 1–2) does not occur in the mini-app. This notice is also available as a separate page.
10-2. The Apps in Toss mini-app
The Learn Languages with Retriever mini-app offered inside the Toss app through "Apps in Toss" (the "mini-app") differs from the iOS/Android apps and the web in the ways below. For mini-app users this section prevails over the other sections of this policy.
- There is no account. The mini-app has no sign-up or sign-in; you are identified solely by the Toss anonymous key the Toss app issues to the mini-app. We collect no account data such as an email address or name, and the key is not linked to any apochopo account. Our server verifies the key that accompanies a read-aloud or speaking request with Toss, then counts daily usage under a value re-hashed with our secret key; the raw key is never stored.
- Your learning record stays on the device. Progress and settings are kept only in the mini-app storage inside the Toss app and are never sent to or synced with our servers. Removing the mini-app from the Toss app deletes them, and we cannot restore them.
- Speaking practice audio goes through our server. The mini-app has no on-device speech recognition, so the audio recorded in a speaking round is received by our server and forwarded to the speech-recognition processor in sections 5 and 6 (OpenAI, L.L.C., United States) to be turned into text. Neither we nor the processor stores the audio; it is discarded as soon as it has been recognised, and the resulting text is used only to check your answer and is not stored. Microphone permission is requested the first time you start a speaking round; declining skips only that round, with no penalty.
- Read-aloud uses server AI voice only. The mini-app has no built-in device voice, so the switch to device voice described in section 10 does not apply. What is sent is only an app-authored study sentence, never text you wrote.
- The AI tutor, Daily Talk and pronunciation coaching are not offered in the mini-app. There is therefore no prior AI-sharing consent step in the mini-app, and nothing you type is ever sent to an AI provider.
- No push notifications, email or in-app purchases. The mini-app is free, and we collect no push token, email address or purchase record from it. The error and crash records described in section 2 are collected in the mini-app on the same terms (identifying strings masked, deleted after 90 days). Friend invitations only create a link to share; the link carries a short code derived from the anonymous key, never the key itself.
- Toss Login is not used. If we later adopt Toss Login (which would provide Toss account data such as your name), we will amend this policy in advance under section 16, describe the data collected and the deletion steps on unlinking or withdrawal, and ask for your separate consent in the app.
- Your rights — since our servers hold no personal data that could identify a mini-app user, access, correction and deletion are exercised by removing the mini-app from the Toss app. For anything else, write to contact@apochopo.com.
- The handling of personal data by the Apps in Toss platform and the Toss app itself (including issuing the anonymous key) is governed by the Toss operator's privacy policy.
Your right to refuse, and what refusing means
- You have the right to refuse consent to the transfers above.
- Storing your account and learning record (rows 1–2 of the table in section 6) — if you refuse, you cannot register or sync your progress across devices. This transfer is processing and storage essential to providing the Service and is disclosed through this policy under Art. 28-8(1)(iii).
- Transfers for the AI tutor, Daily Talk and pronunciation coaching (rows 3–5) — these do not happen if you choose 'Don't allow' on the in-app consent screen. Refusing locks only those three features; lessons, review and listening practice remain available.
- Speaking audio in the Apps in Toss mini-app — not transferred if you decline microphone permission; only that round is skipped, with no penalty. Read-aloud in the mini-app (the transfer of app-authored study sentences) cannot be refused other than by not using the mini-app, because the mini-app has no built-in device voice — those sentences contain none of your personal data.
- Other transfers (push notifications, email delivery, payments) can be refused by not enabling, or by turning off, the feature concerned.
- To withdraw consent or ask anything else, use the app's Settings screen or write to contact@apochopo.com.
Consent statement
I have read and understood the notice above and consent to the transfer of my personal data abroad as described.
Effective date: 19 September 2026
Last revised: 19 September 2026 (announced 12 September 2026)