LangPal Privacy Policy

Effective 3 November 2026

LangPal helps you keep the Korean words and grammar you have learned. This page explains what data LangPal uses, where it goes and what you can do about it. Your saved learning library and progress are stored on your iPhone and, if enabled, in your own iCloud. AI features send relevant content to service providers as described below. With a plan, we also keep account, purchase and usage records.

Who we are and privacy contact

LangPal is operated by TSOI KONSTANTIN (Konstantin Tsoi), a sole proprietor trading as 쿨 개발 (Cool development) (“we”, “us”). He is the personal information controller and the person responsible for personal information protection (개인정보 보호책임자). Contact him about privacy questions, complaints and requests to exercise your rights:

• Business name: 쿨 개발 (Cool development).
• Business registration number: 626-20-02360.
• Name and role: TSOI KONSTANTIN (Konstantin Tsoi), sole proprietor and personal information protection officer.
• Email: support@applangpal.com.
• Telephone: +82 10-5089-0115.
• Address: Room 601, 60 Namhyeon-gil, Gwanak-gu, Seoul, Republic of Korea.

Your words, progress and conversations

• Words, meanings, examples, review history, grammar notes and Talk conversations are saved on your iPhone.
• If iCloud is on, they sync through your own private iCloud database (Apple CloudKit). We do not have access to that private database.
• The built-in Korean–English dictionary (KRDict), Apple Translation, reading text from a photo, voice input (speech recognition) and the voices that read words aloud all work on your iPhone. Your voice and photos are not sent to us.

Using LangPal for free

Offline study does not require a LangPal account and does not send your saved learning content to our server. Connecting your own AI service sends relevant content to that service as described below.

Using your own AI key

If you connect your own OpenRouter or OpenAI key, your iPhone sends AI requests straight to that service under your account. Requests contain what the AI needs for the task: the words you add, your answers in reviews, your Talk messages, and words and grammar from your library that LangPal uses to personalise practice. We never see these requests. Your key is stored in the iOS Keychain and, if iCloud Keychain is on, synced to your other devices by Apple. That service’s own privacy policy applies to what it receives.

Plans (Basic and Plus)

A plan includes LangPal’s own AI. To make this work we use these services:

• Account (Supabase). A plan needs an account. If you don’t sign in, LangPal creates an anonymous account right before you buy or restore a purchase. If you sign in, the account holds your sign-in method: an email address (Continue with email, or the email Apple or Google shares, which may be an Apple private relay address) and, for Google, the name and profile picture link Google provides. The account does not hold your words or progress. If you sign in with email, Resend sends the one-time sign-in code to your address.
• Purchases (Apple and RevenueCat). Payment is handled by Apple. RevenueCat receives your account ID and your App Store purchase records so we can tell which plan you have. We store your subscription and extra-usage purchases (product, dates, status and App Store transaction IDs) and the purchase notices RevenueCat sends us.
• AI requests (our server, OpenRouter and AI model providers). With a plan, AI requests go through our server to OpenRouter, which passes them to the company that runs the model: OpenAI for grammar checks and DeepInfra for everything else. We do not select any other inference provider; if the permitted provider is unavailable, the request fails. Requests contain the same kind of content as above (words, answers, Talk messages and words from your library) and your account ID, which is a random code rather than your name. Our server tells OpenRouter to use only these two and never a host that may keep requests for training. We do not store request or reply text.
• Usage records. For each AI request we save your account ID, the kind of task (for example “judge answer” or “dialogue”), the model, the number of tokens and the cost. We use this to show how much of your monthly usage is left and to keep costs under control.
• Server logs. Our server functions log errors and purchase notice IDs so we can fix failures. They never log request or reply text. If deleting an account fails, the log holds that account’s ID. Our hosting provider’s sign-in, API and function logs also record the IP address and device or app information (user agent) of each request, and sign-in logs record the email address used.

Service providers

These companies process data on our behalf, only to provide LangPal, under their terms with us:

• Supabase: hosts our server, database and sign-in (accounts, purchase and usage records, logs).
• RevenueCat: checks App Store purchases and tells our server about renewals and refunds.
• OpenRouter, and through it OpenAI and DeepInfra: answer AI requests.
• Resend: sends sign-in code emails.

These companies act on their own account, under their own privacy policies: Apple (App Store payments, Sign in with Apple, iCloud and iCloud Keychain), Google (Sign in with Google), and the AI service you connect with your own key.

Transfers outside Korea

To run the plans, personal information is transferred to the providers below over encrypted connections (HTTPS) when you use the feature concerned. We rely on Article 28-8(1)(3) of Korea’s Personal Information Protection Act: the transfer is needed to provide the service you signed up for and is disclosed in this policy. Where GDPR or UK GDPR transfer rules apply, we must use an applicable transfer mechanism, such as an adequacy decision or properly executed standard contractual clauses with any necessary UK addendum. The fact that a provider offers such terms does not by itself establish that a transfer is covered. You can contact us for information about the safeguards applicable to your data.

• Supabase (Supabase Pte. Ltd., privacy@supabase.com). Stored in France (Paris data centre). Data: account ID, sign-in email, Google name and profile picture link, purchase and usage records, server logs (including IP address and device or app information). When: when you create an account, sign in, buy, restore or use AI. Kept: as in “How long we keep it”.
• RevenueCat (RevenueCat, Inc., compliance@revenuecat.com). United States. Data: account ID and App Store purchase records. When: when you buy or restore and at each renewal. Kept: while our RevenueCat project exists, so that restoring on a new account keeps your plan and usage packs; we delete it within 10 days if you ask.
• OpenRouter (OpenRouter, Inc., privacy@openrouter.ai). United States. Data: request content and account ID. When: at each AI request. Kept: OpenRouter does not use requests for training. Its privacy policy does not give a fixed period: it keeps data as long as reasonably necessary for its business and legal obligations, and keeps request metadata (model, tokens, cost) in our account’s activity history.
• OpenAI (OpenAI, privacy@openai.com). United States. Data: request content for grammar checks. When: at each grammar check. Kept: up to 30 days in OpenAI’s abuse-monitoring logs, then deleted; not used for training.
• DeepInfra (DeepInfra, Inc., dpo@deepinfra.com). United States. Data: request content for all other AI tasks. When: at each AI request. Kept: only in memory while the answer is produced, then deleted; DeepInfra logs request metadata but not content and does not train on it.
• Resend (Plus Five Five, Inc., support@resend.com). United States. Data: email address and the sign-in code email. When: when you ask for a code. Kept: emails and delivery logs for 30 days.

You can refuse these transfers by not buying a plan: study offline or use your own AI key. Without them, LangPal’s own AI and the plans are not available.

What we don’t do

• No ads, no tracking across apps or websites, no analytics, no crash-reporting services and no cookies.
• We don’t sell your data or share it for advertising.

Why we use your data

Only to provide the features you ask for: your account, your plan, LangPal’s AI and your usage limit. Under the GDPR, the legal basis is performing our contract with you (providing the app and your plan) and our legitimate interest in preventing abuse and controlling costs.

How long we keep it

• Account and sign-in details: until you delete the account. They are removed from active account storage when deletion succeeds; copies in backups expire on the backup schedule below.
• Subscription, purchase and usage records and purchase notices: A daily cleanup deletes each purchase notice 5 years after we receive it, each usage record 5 years after it was created, and each subscription record 5 years after its last period ended and it last changed. Usage packs never expire, so a pack and the usage records that spent from it are kept together until the balance is used up and nothing has changed for 5 years; then they are deleted together. A pack bought under an ID we could not link to a LangPal account is kept until it can be linked, because it may still be restored. We keep them this long so a restore can’t reset your monthly usage and to answer refund and payment questions. Deleting your account removes its sign-in profile. Retained records still contain the former account’s random ID, transaction IDs and purchase-notification data, and can be linked to purchases for restoration. They are not anonymous data.
• Server logs: 7 days, then deleted automatically.
• Backups: our database host keeps daily backups for 7 days, so deleted data can remain in a backup for up to 7 days.
• Deletion method: records are deleted from active database tables. This does not immediately erase backup copies; those expire on the backup schedule. We do not keep personal information on paper.
• Data on your iPhone and in your iCloud is under your control. Deleting the app does not necessarily delete data in iCloud or credentials stored in Keychain; manage those in the app and in Apple’s settings.

Deleting your account

Go to Settings › Account › Delete account. This deletes your account and its sign-in methods, and attempts to revoke Sign in with Apple if you used it. You can also manage the Apple sign-in connection in your Apple Account settings. Purchase and usage records, and RevenueCat’s record of your purchases under the account’s random ID, stay for the periods above, so restoring your purchases on a new account brings back your plan and unspent packs. If you want RevenueCat’s record deleted too, email us; after that a restore can’t bring back unspent packs. Deleting the account does not cancel your App Store subscription; cancel it in Settings › Account › Manage subscription in LangPal, or in your Apple Account settings. Your words stay in your iCloud.

How we protect your data

• All traffic between the app, our server and our providers is encrypted (HTTPS).
• Our database is encrypted at rest by our host. Its tables can be read only by our server functions, not by the app or other users.
• Server keys are kept as server secrets and never ship in the app. Your own AI key stays in the iOS Keychain on your devices.
• Only the operator can access the provider dashboards, with two-factor sign-in.
• We keep as little as possible: no request text, no words or progress on our server.

Your rights

You can ask for a copy of your data, ask us to correct or delete it, ask us to stop processing it, or withdraw your consent. You can delete your account yourself in the app, and you can stop sending further content to LangPal AI by not submitting AI requests or by selecting your own connected AI provider. Cancelling a plan stops renewal; it does not immediately end access or delete data already processed. For anything else, email support@applangpal.com from your account’s email address, or tell us your account’s sign-in method so we can confirm the account is yours. A representative may ask on your behalf with your written authorisation. We answer within 10 days, and tell you the reason if we cannot do what you asked.

You can also complain to a data protection authority. In Korea: Personal Information Infringement Report Center (privacy.kisa.or.kr, call 118), Personal Information Dispute Mediation Committee (kopico.go.kr, 1833-6972), Supreme Prosecutors’ Office cybercrime (spo.go.kr, 1301), Korean National Police Agency cyber bureau (ecrm.police.go.kr, 182).

Children

LangPal is for users aged 13 and over, or 14 and over in the Republic of Korea. We do not knowingly collect personal information from children below the applicable minimum age. If you believe such a child has created an account, contact the privacy contact above so we can investigate and delete the account and associated personal information as required by law. Where required by law, users below the age of legal majority must obtain their parent or legal guardian's consent. AI providers may impose additional age requirements.

Changes

If we change this policy, we will update this page and its date. For important changes, we will also tell you in the app.