Privacy Policy
Effective date: 2026-10-12 (UTC+09:00)
1. Scope and Operator
This policy covers the Hangul Dot app and official website. The operator is WHITE, represented by Sejin Kim. There is no separate app account. Learning records are stored on your device and cannot be viewed or deleted remotely by the operator.
2. Information We Process and Why
- Learning progress, completion status, study time: stored on your device to let you continue learning and to display rewards.
- Language, volume, and guide-display settings: stored on your device to keep your usage environment.
- Card name and message: content you enter is stored on your device to display on the card. Please don't enter unnecessary real names or sensitive information.
- We use your email address, inquiry, attachments and app/device information you voluntarily provide to respond and resolve issues. Do not send passwords, full card numbers or identity documents; hide unrelated personal information in screenshots.
3. External Transfer, Outsourcing, and Cross-Border Transfer
App Store or Google Play and RevenueCat are used to verify purchases and manage paid access. RevenueCat processes an anonymous App User ID and purchase information. The iOS app also transmits IDFV, an identifier scoped to the app vendor, to RevenueCat. The word anonymous does not by itself mean the identifier cannot be personal data.
Please send personal data deletion requests first to hanguldot@gmail.com. The Hangul Dot operator receives and handles your request and coordinates with RevenueCat when needed. RevenueCat, Inc. provides compliance@revenuecat.com as an additional privacy contact. This additional contact does not replace the Hangul Dot operator’s responsibility to receive and handle your request.
4. Saving and Sharing Cards
5. Website and Cookies
Website feedback includes email, unit, language, rating, comments, app version and submission, consent and delivery information. It is stored in SQLite on the Railway-hosted server and forwarded through Resend to the operator’s Gmail. Request limiting uses an HMAC-derived IP value: its expiry threshold is 24 hours, with cleanup on a later submission, not guaranteed deletion at exactly 24 hours.
Learning feedback is optional; you can continue free learning without submitting it. Opening the form may still create page requests and access logs. Not submitting feedback does not stop the app’s purchase SDK communication, and the app has no separate switch that disables only these international transfers.
External services and processing outside Korea
RevenueCat, Inc.
Customer data is stored in the United States. The app sends an anonymous App User ID and purchase information through SDK/API communication for purchase verification and access management; iOS also sends IDFV. Transfers are not limited to the moment of purchase. Some details of server-side IDFV retention, linking and deletion remain unverified, so no specific retention period or complete erasure of every copy is guaranteed.
Railway Corporation
Website feedback is received and stored on servers in California, United States. Email, unit, language, rating, comments, app version and submission, consent and sending information are transferred over the internet when feedback is submitted, for support and feedback review. Operator-managed records follow the retention and deletion rules below. The Pro plan’s 30-day log viewing window is not a deletion deadline for all server records.
Plus Five Five, Inc. (Resend)
This service delivers feedback to the operator by email. Unsent feedback older than 24 hours is collected; email addresses and feedback content are sent via API when the notification email is sent. Sending takes place in Tokyo, Japan; data is stored in the United States. Official retention is 30 days for emails and logs and 7 days for backups. These are not an added, uniform deletion deadline or the retention period of the operator’s Gmail.
Google LLC · Gmail
The operator receives email addresses, message bodies and attachments in Gmail and uses them to reply. Processing occurs by email when inquiries or feedback are received and replies are sent. The Korean Google terms viewed for this account identify Google LLC as the service provider. Google describes processing on servers worldwide; this mailbox’s storage cannot be limited to the United States alone. Operator-managed mail follows the rules below; Google’s own copies are subject to its separate retention and deletion policies.
Web feedback is received over HTTPS, which is also used for the external email API. The server checks input formats and submission requests and limits request frequency. The main database files are outside the public web folder and are configured so only the operating process owner can read and write them.
6. Retention Period and Disposal
General inquiries are deleted without delay once their purpose has been fulfilled and the information is no longer needed. Feedback and past tester applications are assessed separately according to their purpose; the end of recruitment does not mean past records have been deleted. Where a statutory retention duty applies, only the relevant records are kept separately: consumer complaints/disputes for 3 years, and contract/withdrawal and payment/supply records for 5 years each. These South Korean statutory categories do not justify retaining every inquiry or RevenueCat identifier for 3 or 5 years. On-device data may remain until you delete app data and may return from an OS backup. Deleting app data does not also delete inquiries or external-service records. Feedback and past tester-application information that is no longer necessary is also deleted, except for the specific records that must be retained under applicable law.
The operator verifies the requested records and your identity using only the information needed, and identifies any records that must be retained by law. For operator-managed data to be deleted, the operator checks the relevant database, pending transmissions, mail and attachments and handles deletion; where external service action is needed, the operator requests it. You are informed of the outcome and any limits and reasons. This does not mean automated deletion exists or that existing records have already been deleted.
Moving mail to Trash is different from permanent deletion, so the status of the selected messages is distinguished. Database deletion also includes reviewing residual-data cleanup; when restoring a backup, previously handled deletions are reapplied. Backups currently exist, and immediate erasure of every supplier copy is not guaranteed.
7. User Rights and Deletion
Send access, correction, deletion, restriction-of-processing or consent-withdrawal requests to hanguldot@gmail.com, identifying the email previously used and the scope of your request. We request only the minimum additional verification needed. Guardians may contact us about a child’s data.
For correction or deletion requests, we notify you of the legally required result within 10 days of receipt. If deletion is restricted by law, we explain the reason and how to object. Completed actions and information requiring supplier confirmation are distinguished; unverified deletion is not reported as complete. This is not a promise to fully erase every supplier backup within the same period.
8. Changes to This Policy
When processing practices change, we announce the changes and effective date and follow any legally required procedures.
Operator Information
The operator, WHITE, represented by Sejin Kim, answers support and privacy inquiries directly at hanguldot@gmail.com.
Operator Information
- Company name: WHITE · Sole proprietorship
- Representative: Sejin Kim
- Business registration no.: 898-03-03045
- Mail-order business registration no.: 2025-서울구로-0859
- Address: Seoul, Guro-gu, Gyeongin-ro 248-13
- Support & privacy inquiries: hanguldot@gmail.com
- Official domain: hanguldot.com