Privacy Policy

Last updated: 2026-11-04

tab-hunmin (hereinafter the "Company") complies with Korea's Personal Information Protection Act and other applicable laws, and establishes and discloses the following Privacy Policy to carefully protect users' personal information.

1. Data Controller Information

Service name: tab-hunmin

Operator (company name): Hoppe AI

Representative: Hong Beompyo

Address: 375, Jungbu-daero, Giheung-gu, Yongin-si, Gyeonggi-do, Republic of Korea

Contact: hbpjjang2@gmail.com

Data Protection Officer: Hong Beompyo / Representative / hbpjjang2@gmail.com

2. Personal Information Collected

The Company collects the following personal information to provide the Service.

  • Account information (social login): email address, name (nickname), profile image, social login identifier (information provided upon signing in with Google or with Apple (iOS app). For Sign in with Apple, the Company receives from Apple the user's name (only at the first sign-in and only if the user provides it), email address (or, if the user chooses not to share their real email address, a private relay email address generated by Apple), and Apple user identifier; no profile image is received from Apple)
  • Anonymous account information (app): an anonymous account identifier generated for each device when the app is used without signing in
  • Learning records: typing records, accuracy and speed, words/sentences/expressions studied, mastery level, streaks, and experience points
  • Content entered by the user: sentences the user types or pastes in order to create a learning course, topics entered in the AI Sentence Maker, and the learning courses created from them (title, sentences, translations, pronunciation notation, word explanations, and audio files)
  • Hall of Fame (leaderboard) records: display name (the account name, or a default name if there is none), score, typing speed, accuracy, difficulty and category, and time of the record. Hall of Fame records are public to other users, and top records are shown on the Hall of Fame screen together with the display name, score, typing speed, and accuracy. Which account each record belongs to (the account identifier) is stored separately, only on the Company's servers, so that the account's records can be deleted when the account is deleted, and is not made public.
  • Inquiries and feedback (when a signed-in user sends feedback): the feedback content, the path of the screen from which the feedback was sent, and the account's email address and name (feedback is also forwarded to the Company's inquiry email address)
  • Automatically collected information: service usage records, AI feature usage records (number of uses and processing volume), access logs, device and browser information, a randomly generated analytics identifier (stored in cookies and browser storage on the web, and generated for each installation and stored in device storage in the app; it is not an advertising identifier), approximate location estimated from the IP address (country/city level), and usage analytics data (collected via Firebase Analytics)
  • Payment information (for paid purchases): payment method, transaction history, subscription status, remaining Extra 30 Pack uses (actual card numbers and other sensitive payment data are processed by Paddle for web purchases and by the Apple App Store/Google Play for app purchases, and are not stored by the Company; receipts for in-app purchases are validated by RevenueCat)
  • Optional information: marketing consent status

3. Purposes of Collection and Use

  • Member identification (including anonymous accounts) and account/login management
  • Email address: used for member identification, sign-in, important account notices (security, policy changes, etc.), and replies to inquiries. Promotional messages are sent only with separate consent.
  • Providing the learning service, progress tracking, achievements, and personalized learning
  • Typing correction and difficulty adjustment
  • Providing the AI Sentence Maker and managing usage limits
  • Service improvement, usage analysis, and error diagnosis
  • Billing, settlement, and subscription management for paid services
  • Responding to customer inquiries and delivering notices
  • (Where separately consented) Providing marketing information such as events and promotions

4. Retention and Use Period

In principle, personal information is destroyed without delay upon account withdrawal. However, it is retained for the following periods where required by law.

  • Records of contracts or withdrawal of subscription: 5 years (Act on Consumer Protection in Electronic Commerce)
  • Records of payment and supply of goods/services: 5 years (Act on Consumer Protection in Electronic Commerce)
  • Records of consumer complaints or dispute resolution: 3 years (Act on Consumer Protection in Electronic Commerce)
  • Website visit (access) logs: 3 months (Protection of Communications Secrets Act)

Users can delete their account (withdraw membership) themselves in the app under Settings > Delete account, and anonymous accounts can be deleted in the same way. When an account is deleted, the account information, learning records (including learning courses created by the user and their audio cache), usage records (such as the number of AI uses), remaining Extra 30 Pack uses, Hall of Fame (leaderboard) records, feedback submitted in the Service, and error diagnostic logs are deleted immediately, and the Company also requests deletion of the app payment identification information stored with RevenueCat. When an account linked with Sign in with Apple is deleted in the iOS app, the Company has the user re-authenticate with Apple and requests that Apple revoke that account's Sign in with Apple connection (tokens); if the revocation is not completed, the user can remove the connection directly in their Apple Account settings. However, payment records (payment history, app purchase grant records, and order records) are retained for the period required under the Act on Consumer Protection in Electronic Commerce noted above (5 years). Matters concerning subscription cancellation upon account deletion are governed by Article 12 of the Terms of Service.

Data of anonymous accounts used without signing in may be destroyed once 1 year has passed since the last date of use. Even in this case, payment records are retained for the statutory retention periods above.

5. Provision of Personal Information to Third Parties

The Company does not provide users' personal information to third parties beyond the scope specified in this Policy, except where the user has given prior consent or where required by law.

6. Outsourcing of Personal Information Processing

The Company outsources the following personal information processing tasks to ensure smooth service delivery.

  • Google LLC (Firebase): authentication (including anonymous authentication), database, hosting, usage analytics
  • Google LLC (Gemini API): AI processing for the AI Sentence Maker (sentence generation, translation, and explanations)
  • Google LLC (Cloud Text-to-Speech): generating audio for learning courses created by users
  • Paddle.com: payment processing for web purchases (as Merchant of Record, handling payments and taxes)
  • RevenueCat, Inc.: receipt validation and subscription status management for in-app purchases (Apple App Store and Google Play)

The Company specifies and manages/supervises relevant matters in outsourcing agreements to ensure personal information is handled securely.

7. International Transfer of Personal Information

Because the Company uses Google's cloud infrastructure (Firebase, Gemini API, Cloud Text-to-Speech), processes web payments through Paddle.com, and validates in-app purchase receipts through RevenueCat, personal information may be processed outside Korea as described below.

  • Recipient: Google LLC
  • Countries of transfer: the United States and other countries where Google data centers are located
  • Items transferred: information under "Personal Information Collected" above that is necessary to provide the Service
  • Timing and method of transfer: transmitted over the network at the time of Service use
  • Purpose of use and retention period: same as the purposes and periods stated in this Policy
  • Recipient: Paddle.com Market Limited (web payment processing) / Country of transfer: United Kingdom / Items transferred: information necessary for web payments (email address, country, payment method, transaction history, etc.) / Timing and method of transfer: transmitted over the network when paying on the web / Purpose of use: processing payments, taxes, and refunds as Merchant of Record / Retention period: as required by payment and tax laws and as set out in Paddle's privacy policy
  • Recipient: RevenueCat, Inc. (receipt validation and subscription status management for in-app purchases) / Country of transfer: United States / Items transferred: app user identifier (Firebase UID), purchase and subscription transaction information (store transaction ID, product, amount and currency, period), device platform, etc. / Timing and method of transfer: transmitted over the network when using the app (purchases, restoring purchases, checking subscription status, etc.) / Purpose of use: receipt validation and subscription status management for in-app purchases / Retention period: deletion is requested when the account is deleted (in the app under Settings > Delete account); otherwise as set out in RevenueCat's privacy policy (https://www.revenuecat.com/privacy)

Users may refuse the international transfer of their personal information, but doing so may limit their ability to use the Service.

8. AI Processing and Voice Data (Service-Specific Notice)

When you use the AI Sentence Maker (including both generating sentences with AI and creating a learning course from sentences you type or paste yourself), the topics and sentences you enter are sent via the Company's servers to the Google Gemini API and processed to generate, translate, and explain sentences and to produce pronunciation notation. The Company uses the Gemini API under Google's paid-service terms, under which Google does not use this request content to improve its products (including training AI models). However, Google may retain request content for a limited period for purposes such as detecting policy violations (abuse).

The learning courses created in this way (title, sentences, translations, pronunciation notation, explanations, and audio files) are saved to the user's account (including anonymous accounts). To create course audio, the course's Korean sentences are sent to Google Cloud Text-to-Speech, and the generated audio files are stored for each account in the Company's cloud storage (Firebase). Users can delete saved courses themselves, and course audio files are deleted when the account is deleted.

To operate the Service, including enforcing usage limits, managing costs, and diagnosing errors, the Company records AI usage logs for each account (date/time and number of uses, processing volume (number of tokens), input length, etc.).

Voice input features such as the pronunciation tutor are not currently offered, and the Company does not currently collect users' voices. Learning results stored from past use of those features (derived indicators such as pass/fail status and scores) are retained and destroyed under the same criteria as other learning records. If voice features are offered again, raw audio will still not be stored on the server, and this Policy will be amended and announced accordingly.

9. Cookies and Other Automatic Collection Tools; Behavioral Information

The Company uses Firebase Analytics (Google Analytics) to analyze and improve Service usage, and for this purpose stores a randomly generated analytics identifier in cookies and browser storage on the web and in device storage in the app. This identifier is not an advertising identifier, and the Company does not use analytics data for advertising. Users can refuse cookie storage or delete cookies and site data in their browser settings, and the app's identifier is deleted when the app is deleted. However, refusing cookie storage may limit certain Service features.

Advertisements are currently not provided in either the app or on the web. If advertising is introduced in the future, the Company will amend this Policy before introducing it, specifying the ad providers and the information processed, and will announce the amendment.

10. Rights of Data Subjects and How to Exercise Them

Users may at any time request access to, correction of, deletion of, suspension of processing of, and withdrawal of consent to their personal information. Requests may be made via hbpjjang2@gmail.com or through in-service settings, and the Company will act without delay.

11. Destruction of Personal Information

Personal information for which the retention period has expired or the processing purpose has been achieved is destroyed without delay. Electronic files are deleted using methods that prevent recovery, and printed materials are shredded or incinerated.

12. Measures to Ensure the Security of Personal Information

The Company implements technical, administrative, and physical safeguards for personal information protection, including access authority management, access control, encryption, and security vulnerability inspections.

13. Personal Information of Children Under 14

The Service is not directed to children under 14 years of age. If the Company becomes aware that personal information of a child under 14 has been collected without the consent of a legal guardian, it will destroy that personal information without delay. However, payment records that must be retained by law are retained in accordance with Section 4. A legal guardian may request access to, correction of, deletion of, or suspension of processing of the child's personal information at hbpjjang2@gmail.com, and the Company will act without delay.

14. Data Protection Officer and Requests for Access

Data Protection Officer: Hong Beompyo / Representative

Contact: hbpjjang2@gmail.com

Users may direct inquiries, complaints, and requests for relief regarding personal information to the Data Protection Officer, and the Company will respond promptly and in good faith.

15. Remedies for Infringement of Rights

If consultation or remedy is needed due to a personal information infringement, users may contact the following agencies.

  • Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
  • Personal Information Infringement Report Center: 118 (privacy.kisa.or.kr)
  • Supreme Prosecutors' Office Cyber Investigation Division: 1301 (www.spo.go.kr)
  • National Police Agency Cyber Bureau: 182 (ecrm.police.go.kr)

16. Changes to This Policy

This Policy may be amended in response to changes in law or the Service, and any changes will be announced through in-service notices.

Effective date: 2026-11-04