Learn Languages with Retriever — Privacy Policy

1. Purposes of processing

We process personal data only for the purposes below. If a purpose changes we obtain separate consent as required by PIPA Article 18.

2. Data we collect

Generated automatically while you use the Service:

• Learning record — XP, completed lessons, streak, taste picks, hearts, review schedule
• Usage analytics — session id, event name and non-identifying properties, platform (iOS/Android/web), app version. No email, name or free text is ever placed in an event.
• Notification data — push token, device time zone and language, app version (only if you enable notifications)
• In-app purchase records — product id, transaction id, store platform
• Referral records — the referring account and the invitee's email address
• A hash of the IP address used at sign-up — the raw address is never stored anywhere; only an HMAC of it is kept, solely to detect self-referrals and bulk sign-ups made for referral rewards
• AI report records — only if you use the report button: the reported sentence and a short surrounding excerpt
• Error and crash records — technical details captured when the app or site fails, so we can find the cause: error name and message, the list of code locations involved, screen path, platform, app version and session id. Strings that look like email addresses and long tokens are masked automatically before storage. When an iOS or Android app terminates unexpectedly, the diagnostic data of that moment (error details and code locations, device specifications such as model, manufacturer, OS version and memory size, app version, the screen you were last on and the API request paths before it, your account ID if you are signed in, and a random per-installation identifier) is transferred to the error-reporting processor in section 5. Your IP address, device name, email address, request bodies, screen contents and anything you wrote or said are removed before transmission, or never captured in the first place. In every case the records are deleted automatically within 90 days of collection.
• Server logs — access records written automatically by our hosting provider (request path, response code, timestamp, IP address)
• Region of access at sign-up — the country code and city name (e.g. KR · Seoul) that our hosting provider (Vercel) infers from the connecting address and attaches to the sign-up request. It is used only for the operational notification in section 1; we do not store it in our database and never put the raw IP address in the notification. We receive nothing more precise than a city, such as coordinates or an address, and because it is inferred from the connecting address it may differ from where you actually are
• Developer feedback — only if you send it with 'Send feedback to the developer' in Settings, the feedback text (up to 2,000 characters) is stored together with your display language, app version and platform under your account ID. Your email address is not attached. In the Apps in Toss mini-app you can send it only while signed in with Toss; we do not accept feedback from users who are not signed in
• App satisfaction rating — only if you rate or close the rating prompt, the app satisfaction rating (1–5) or the fact that you closed it, an optional comment (≤300 chars), where the prompt opened, platform and app version are stored under your account ID. If we show a store-review prompt we also keep its time, platform and app version (to limit how often we ask; we cannot know whether you left a store review)

If you use the Apps in Toss mini-app, none of the email, password or name items in the table above are collected (even if you choose Toss sign-in). Instead the following are processed (details in section 10-2).

• Toss anonymous key — a per-user hash the Toss app issues to the mini-app. It accompanies read-aloud, speaking and AI conversation requests to our server; the server only asks Toss whether it is valid and never stores the raw value. To count daily usage we keep only a value re-hashed with our secret key (irreversible), together with a per-day count
• Speaking-round recordings — the mini-app has no on-device speech recognition, so the audio you speak is received by our server and forwarded to the speech-recognition processor in section 5 to be turned into text. Our servers do not store the audio; the processor (OpenAI) keeps it only for abuse monitoring for up to 30 days, then deletes it
• AI conversation text and AI Call audio — only if you have consented to AI conversation in Settings, the sentences you type in an in-lesson AI conversation round or Daily Talk and the earlier lines of that conversation, the audio recorded in AI Call (received by our server and forwarded to the speech-recognition processor in section 5 to be turned into text), the figure you chose to talk to, the language you are learning, the lesson difficulty and your native-language setting (Korean) pass through our server to the AI processor in section 5, and AI Call replies are turned into speech by the speech-synthesis processor in section 5. Our servers do not store the conversation or the audio; the processor keeps it only for abuse monitoring for up to 30 days (Google: 55 days), then deletes it. Our server keeps only the time of your latest consent (erased when you withdraw) and a daily conversation count, under the usage-counting identifier above
• Toss sign-in (optional) — only if you choose Toss sign-in in the mini-app's Settings, we verify with Toss the user identifier (userKey) Toss assigns to this Service to create or find your account, and store the account id, Toss link status and link time and a hash of the sign-up IP address. Toss sends your name (USER_NAME) encrypted; we never decrypt, store or display it. We receive no email, phone number, birthday, gender or CI. The authorization code and the tokens Toss issues during sign-in are used only for verification and never stored, and our session token is kept only in the mini-app screen's memory, never saved on the device
• Records of a signed-in account — only while you are signed in with Toss, the analytics records in section 2 (no identifying data) and the dates and number of lessons you finish are kept on our server under that account (to decide friend-invitation rewards). Feedback you send yourself with 'Send feedback to the developer' in Settings is likewise stored under that account, as in the developer-feedback item above, and triggers an arrival notification. Nothing of this is sent if you do not sign in, and the feedback menu is not shown
• Account linking (optional) — if you create a link code to merge your mini-app account with an existing web/app account, the code's hash (the code itself is never stored), issue and use times, and link attempt and audit records (account id, time, result)
• Progress and settings — kept only in the mini-app storage inside the Toss app. If you sign in with Toss, a copy of that account's server record is also kept there, but the mini-app's learning record is never uploaded to our servers

We do not collect special-category/sensitive data or government identifiers, and we do not collect advertising identifiers (ADID/IDFA) or location data (the region of access at sign-up above is a country- and city-level value inferred from the connecting address, not your device's location; we never receive GPS, cell-tower or Wi-Fi location). In the iOS/Android apps and on the web, microphone audio in speaking practice is processed on your device only (see section 10) and is never collected; the exception for the Apps in Toss mini-app is in section 10-2.

3. Retention periods

We process and retain personal data within the retention period required by law or agreed with you when the data was collected.

We do not automatically archive or delete dormant accounts. You may delete your account at any time (section 8).

4. Disclosure to third parties

We do not sell or share your personal information, including for cross-context behavioural advertising as those terms are used in the CCPA/CPRA, and we have not done so in the preceding twelve months. We disclose personal data to third parties only with your separate consent or where the law specifically requires it (PIPA Arts. 17 and 18). Where we are compelled by a lawful request from an authority, we notify the affected user unless legally prohibited from doing so. Processing carried out on our behalf by service providers is listed in section 5.

5. Processors

To run the Service we entrust the following processing to the providers below.

Each processing agreement records, as PIPA Article 26 requires, the prohibition on processing beyond the entrusted purpose, technical and administrative safeguards, restrictions on sub-processing, supervision of the processor, and liability. We publish any change of processor on this page.

Confirmation that our AI processors provide equal protection — we send data to the AI processors above (OpenAI, Google, Groq) only after confirming that they provide protection equal to or greater than our own. Specifically, we confirm and contractually require that they (i) do not use the data for model training, (ii) do not use it for any purpose beyond generating the requested reply, (iii) apply technical and administrative safeguards including transport encryption (TLS) and access control, and (iv) restrict sub-processing and notify us of any incident. These commitments come from each provider's business (API) terms and data-processing addendum, and we re-verify them periodically.

Verifying the Toss anonymous key — the anonymous key used by the Apps in Toss mini-app is issued by the operator of the Toss app (Viva Republica Inc.), and our server asks Toss's partner API whether a key is valid. This is a platform function Toss provides for its mini-apps, not processing we entrust to Toss; the handling of personal data inside the Toss app is governed by Toss's own privacy policy.

6. International transfers

Most of the processors in section 5 are incorporated and operate servers outside Korea, so personal data is transferred abroad to the extent needed to run the Service (PIPA Art. 28-8). There are two legal grounds: processing and storage entrusted for the performance of the Service (database and server hosting, read-aloud synthesis, speech recognition in the Apps in Toss mini-app, notification and email delivery, collection of error and crash reports from the iOS and Android apps) rests on Art. 28-8(1)(iii) and is disclosed through this policy, while transfers for the AI tutor, Daily Talk and pronunciation coaching rest on Art. 28-8(1)(i) and require your separate in-app consent (section 10). Transfers for AI conversation in the Apps in Toss mini-app likewise rest on Art. 28-8(1)(i) and require your separate consent in the mini-app's Settings (section 10-2). The operational notifications of new sign-ups and of developer feedback and app satisfaction ratings (Slack) are processing and storage of member accounts entrusted to a processor and disclosed through this policy under Art. 28-8(1)(iii). For transfers from the EEA/UK we rely on the European Commission's Standard Contractual Clauses included in each provider's data processing agreement.

How to refuse a transfer — storing your account and learning record (rows 1–2) is essential to the Service, so refusing it means you cannot register or sync progress. Every other transfer can be refused by turning the feature off: Settings > Sound to disable AI voice, simply not using the AI tutor, and Settings > Notifications to disable notifications. Refusing these does not restrict the rest of the learning features. The transfer of error and crash reports from the iOS and Android apps (row 10) is built into the app so that we can find why it terminated unexpectedly, and cannot be refused other than by no longer using the app — it carries only technical data and your account ID, never anything you wrote or said. This transfer does not occur on the web or in the Apps in Toss mini-app. The operational notification of new sign-ups (row 11) happens once when an account is created, so it cannot be refused other than by not registering — it carries only the items in the table above, never your password, name or IP address. In the Apps in Toss mini-app it happens once when Toss sign-in creates a new account (there is no email address), and not at all if you do not sign in. The notification of developer feedback and app satisfaction ratings (row 11 of the table above) happens only when you send feedback or a rating yourself, and not at all if you do not — even then your account's email address, name and account ID are never attached.

Refusing in the Apps in Toss mini-app — the transfer for mini-app AI conversation (rows 3–5) happens only if you consent on the AI conversation consent card in Settings; if you do not consent, or tap 'Turn off AI conversation (withdraw consent)' on the same card, our server blocks the request itself and nothing you write is sent — you lose only the AI conversation round, Daily Talk and AI Call, and the rest of the lesson continues. The transfer of speaking-round audio does not happen if you decline microphone permission; only that round is skipped and the rest of the lesson continues. Read-aloud in the mini-app uses server AI voice only (there is no built-in device voice), so the transfer of app-authored study sentences cannot be refused other than by not using the mini-app — those sentences contain none of your personal data. Account and learning-record storage (row 1) happens in the mini-app only if you choose Toss sign-in; if you do not, the mini-app works the same (and even when signed in, the mini-app's learning record itself is never uploaded). This notice is also available as a separate page.

7. Destruction of personal data

We destroy personal data without delay once the retention period expires or the purpose is fulfilled.

• Procedure — when you delete your account, the account row and every learning record, referral record and purchase record attached to it are removed together by database cascade. Data we must keep by law is moved to separate storage and destroyed at the end of the statutory period.
• Method — electronic files are erased permanently in a way that makes recovery impossible; any printed material is shredded or incinerated.
• Backups — deleted data may persist in operational backups for up to 30 days and disappears when the backup expires. During that window backups are used for recovery only.

8. Your rights and how to exercise them

You may at any time request access to, correction of, deletion of, or suspension of the processing of your personal data, and you may object to processing based on legitimate interests and request data portability. We respond without delay and in any case within 10 days of receiving your request. EEA/UK users may also lodge a complaint with their supervisory authority; California residents may exercise the CCPA rights of access, deletion, correction and opt-out (we do not sell or share personal information) and will not be discriminated against for doing so.

You may act through a legal representative or an authorised agent, in which case we require evidence of the authorisation. We verify that a person making a request is the data subject or a legitimate representative.

9. Cookies and other automatic collection

We use no advertising or tracking cookies, no advertising identifiers (ADID/IDFA), and we do not collect or share behavioural data for targeted advertising. No third-party advertising or behavioural-analytics SDK is bundled in the app. The error-reporting SDK (Sentry) bundled in the iOS and Android apps is used only for the error and crash reporting described in sections 5 and 6, never for advertising or behavioural analytics.

10. Speech features and the AI tutor

In speaking practice in the iOS/Android apps and on the web, microphone audio is processed entirely on your device. Your device's own speech recognition converts it to text, which is compared with the answer; the recorded audio is never transmitted or stored. Microphone permission is requested only the first time you start this exercise, and declining simply skips those questions with no penalty. The Apps in Toss mini-app, which has no on-device speech recognition, is governed by section 10-2.

Consent before any AI sharing — the AI tutor (Talk), Daily Talk and pronunciation coaching can only answer by forwarding your text to the AI providers listed in section 5. Before any sentence is sent, the app shows a separate in-app consent screen stating (i) what data is sent, (ii) who it is sent to, and (iii) what is not sent, and asks for your permission. If you decline, only those three features are locked — lessons, review and listening practice keep working — and the server blocks the AI requests, so nothing is transmitted. You can withdraw consent at any time in Settings > AI conversation, and the same block applies immediately.

• What is sent — the text you type, the text your device transcribes from your speech, and the settings the conversation needs (level in the language you are learning, native language, the partner and scenario you chose).
• What is NOT sent — account identifiers such as your email address and name, and your learning history, are never sent to an AI provider. In the iOS/Android apps and on the web, microphone audio itself never leaves your device (speech recognition runs on-device only).
• Who receives it and why — the AI processors in sections 5 and 6 (primary provider: OpenAI, L.L.C., United States), solely to generate the reply or tip; the processor keeps it only for abuse monitoring for up to 30 days (Google, an alternate provider: 55 days), then deletes it, and never uses it for model training. Our servers do not store the conversation.

Conversations are kept on your device only, are not part of progress sync, and our servers do not store them. If you report an inappropriate answer, only the reported sentence and a short surrounding excerpt are stored for review.

Read-aloud uses server AI voice by default. What it sends is an app-authored study sentence or the AI reply just generated — never text you wrote yourself. Turning off 'AI voice (online)' in Settings > Sound switches to your device's built-in voice, after which no sentence leaves the device.

Generative AI notice and labelling — we use generative AI to (i) write lesson questions, options, explanations and context notes, (ii) generate replies in the AI tutor, Today's Talk and pronunciation coaching, and (iii) synthesize read-aloud voices. Under Article 31 of the Korean Framework Act on Artificial Intelligence we give you this notice in the app the first time you use the Service (and keep it permanently available in Settings), and we label the output in the way that fits it: output generated on the spot (AI tutor, Today's Talk, calls, pronunciation tips) carries a notice on the screen where it appears that it was made by AI (a line of text below it, or a label), while content we prepared in advance (lesson questions and read-aloud speech) is disclosed through that prior notice and the permanent notice in Settings — the Enforcement Decree allows this label to take any form a person or a machine can read, including in-UI display and an initial notice. This is not the same thing as the prior consent above — consent is about whether your sentences may be sent out; the label is about what you receive. Labelling therefore applies even if you decline consent.

We never provide your personal data or conversations to any AI provider for model training. We also make no automated decisions producing legal or similarly significant effects — difficulty and review scheduling are learning conveniences and do not affect your rights or obligations.

10-2. The Apps in Toss mini-app

The Learn Languages with Retriever mini-app offered inside the Toss app through "Apps in Toss" (the "mini-app") differs from the iOS/Android apps and the web in the ways below. For mini-app users this section prevails over the other sections of this policy.

• An account is optional. You can use the mini-app without signing in, and then you are identified solely by the Toss anonymous key the Toss app issues to the mini-app. The key is not linked to any account; our server verifies the key that accompanies a read-aloud, speaking or AI conversation request with Toss, counts daily usage only under a value re-hashed with our secret key, and never stores the raw key. What happens if you choose Toss sign-in ('Confirm account with Toss') in Settings is described in the Toss sign-in item below.
• Your learning record stays on the device. Progress and settings are kept only in the mini-app storage inside the Toss app, and even if you sign in with Toss the mini-app's learning record is never sent to or synced with our servers. Removing the mini-app from the Toss app deletes them, and we cannot restore them.
• Speaking practice audio goes through our server. The mini-app has no on-device speech recognition, so the audio recorded in a speaking round is received by our server and forwarded to the speech-recognition processor in sections 5 and 6 (OpenAI, L.L.C., United States) to be turned into text. Our servers do not store the audio; the processor keeps it only for abuse monitoring for up to 30 days, then deletes it, and the resulting text is used only to check your answer and is not stored. Microphone permission is requested the first time you start a speaking round; declining skips only that round, with no penalty.
• Read-aloud uses server AI voice only. The mini-app has no built-in device voice, so the switch to device voice described in section 10 does not apply. What is sent is only an app-authored study sentence, never text you wrote.
• AI conversation is used only if you consent. Mini-app AI conversation means three things — the short 'AI conversation' round that appears now and then in a lesson, Daily Talk (messaging with a figure) and AI Call (talking with a figure by voice); there is no pronunciation coaching. All three open only after you consent on the AI conversation consent card in the mini-app's Settings, and then (1) the sentences you type and the earlier lines of that conversation, the audio you speak in AI Call, the figure you chose, the language you are learning, the lesson difficulty and your native-language setting (Korean) are sent (2) to the AI processors in sections 5 and 6 (primary provider: OpenAI, L.L.C., United States) (3) solely to generate replies and for speech recognition and read-aloud. No name, contact details, Toss account data or learning record is sent; our servers store neither the conversation nor the audio; the processors keep it only for abuse monitoring for up to 30 days (alternate provider Google: 55 days), then delete it, and never use it for model training. Consent is recorded only as the time of your latest consent under the usage-counting identifier above; tapping 'Turn off AI conversation (withdraw consent)' on the same card erases it at once, and from then on our server blocks AI requests. If you do not consent, only these three do not open and the lesson is otherwise unchanged; there is a daily cap on conversations.
• No push notifications, email or in-app purchases. The mini-app is free, and we collect no push token, email address or purchase record from it. The error and crash records described in section 2 are collected in the mini-app on the same terms (identifying strings masked, deleted after 90 days). The mini-app has no native app process of ours, however, so nothing is transferred to the error-reporting processor (Sentry) in section 5. Friend invitations create a link to share: a link shared without signing in carries no code at all, and a link shared by a Toss sign-in account carries that account's invitation code (a short random string).
• Toss sign-in is used only if you choose it. When you tap 'Confirm account with Toss' in the mini-app's Settings, the Toss app shows its consent screen, and only if you agree does our server check with Toss and create or find your account using your user identifier (userKey). Toss sends your name (USER_NAME) encrypted; we never decrypt, store or display it, and we receive no email, phone number, birthday, gender or CI. We never merge accounts automatically by name, email or CI; to merge with an existing web/app account you must create a one-time link code valid for 10 minutes and enter it yourself. Only while you are signed in are the analytics records in section 2, lesson-completion records (date and count), any app satisfaction rating you leave (rating and comment — the rating prompt opens only for Toss-signed-in accounts) and any feedback you send with 'Send feedback to the developer' in Settings (feedback text, display language, app version — its arrival triggers the operational notification in section 6; the feedback menu is shown only to Toss-signed-in accounts) kept under that account and friend-invitation rewards credited to it; our session token is kept only in the mini-app screen's memory. If you unlink this Service in the Toss app, withdraw consent to the Toss sign-in terms or leave Toss, Toss notifies our server, and we remove the Toss link and any unused link codes from that account and end existing sign-ins. If Toss is the account's only sign-in method, the account and its server learning record are deleted too. If processing fails we do not treat the deletion as done and process it again. Unlinking is not the same as deleting your account — to delete the whole account use the methods in section 8.
• Your rights — for a user who has not signed in, the only records our server keeps are per-day usage counts and the time of AI-conversation consent, both tied to the usage-counting identifier; we cannot identify a person from that identifier, so there is no further personal data to disclose or correct. You delete your AI-conversation consent record by withdrawing consent on the AI conversation consent card in Settings, which takes effect at once, and the learning record and settings on the device are erased by removing the mini-app from the Toss app. A Toss sign-in account can be deleted from the account card in the mini-app's Settings (after you confirm your identity with Toss again — or with the password, for an account that has one), and you can remove the Toss link by unlinking in the Toss app. For anything else, write to contact@apochopo.com.
• The handling of personal data by the Apps in Toss platform and the Toss app itself (including issuing the anonymous key) is governed by the Toss operator's privacy policy.

11. Marketing messages

Promotional notifications (milestone congratulations, weekly summaries, widget tips) are sent only if you turn them on in Settings > Notifications, and we record the time you consented, as Article 50 of Korea's Network Act requires. You can withdraw consent at any time on the same screen, and no promotional notification is sent between 21:00 and 08:00. Learning reminders (streak, review, goal and return-visit prompts) are part of providing the Service and do not require separate consent.

12. Children under 14

The Service is available only to users aged 14 or over, and we do not collect personal data from children under 14. You confirm you are 14 or older when you sign up. If we learn that an account belongs to a child under 14, we verify and delete the account and its personal data without delay. Guardians may write to contact@apochopo.com and we will act immediately.

13. Security measures

The measures below are actually in place, not aspirational.

• Administrative — the number of people who handle personal data is kept to a minimum, access is limited to what the work requires, and this policy plus our internal baseline (`docs/SECURITY.md`) are updated whenever collected data or processors change.
• Access control — every database table has Row Level Security enabled deny-by-default; only the server reads and writes, through a dedicated connection. No database key is shipped in the app or browser bundle, and all access goes through our own API.
• Passwords — stored only as irreversible bcrypt hashes, so not even an operator can read them.
• Session protection — session tokens are signature-verified and checked against a per-account epoch, so a password reset, a sign-out-everywhere, or account deletion invalidates every existing token at once. On mobile, tokens live only in the iOS Keychain / Android Keystore.
• Encryption in transit — all traffic between the apps and our servers uses HTTPS/TLS only.
• Data minimisation — analytics events carry no identifying data, the sign-up IP is kept only as a hash, and error and crash records have the IP address, device name and request bodies stripped before transmission.
• Abuse protection — sign-up, sign-in and other authentication endpoints are rate-limited.

If we become aware of a breach we notify affected users of the data, timing and remedial steps without delay, report it to the supervisory authority as the law requires, and immediately invalidate affected sessions.

14. Data protection officer and contact

We have appointed the privacy officer below to take overall responsibility for personal data handling and to deal with complaints and remedies. You may direct any privacy-related enquiry arising from your use of the Service to this contact, and we will answer and act on it without delay.

• Privacy officer: 윤민정
• Contact: contact@apochopo.com
• Controller: apochopo Inc. (주식회사 아포초포)
• Representative: 윤민정
• Business registration number: 178-86-04021
• Address: 서울특별시 강남구 개포로 264, 107동 902호 (개포동, 개포래미안포레스트)

15. Remedies

In Korea you may seek help from the bodies below. Users elsewhere may also contact their local supervisory authority.

• Personal Information Dispute Mediation Committee — 1833-6972 (www.kopico.go.kr)
• Privacy Infringement Report Centre — 118 (privacy.kisa.or.kr)
• Supreme Prosecutors' Office Cybercrime Division — 1301 (www.spo.go.kr)
• National Police Agency Cyber Bureau — 182 (ecrm.police.go.kr)

16. Changes to this policy

This policy applies from its effective date. We announce additions, deletions or corrections in the Service or on this page at least 7 days before they take effect, and at least 30 days before for changes that materially affect your rights.