Privacy Policy

Section 1 (Introduction and scope)

MENKONI LLC. (the "Company", "we", "us") is a company established under the laws of the Republic of Korea. We handle personal information in accordance with the Personal Information Protection Act of Korea and with the data protection law of the countries in which our users live.

This policy applies to the MomSpeaking mobile application for iOS and Android and to our website at momspeaking.com and its subdomains (such as en.momspeaking.com).

Section 2 (Personal information we collect)

1. Information you give us

• Email address (required) — used to identify your account and to sign you in. If you sign in with an Apple or Google account, we receive it from that provider; if you sign in with an emailed code, you enter it yourself. If you choose "Hide My Email" when signing in with Apple, we receive the private relay address that Apple provides.

2. Information generated or collected while you use the Service

• Account identifier — a pseudonymous identifier (a Firebase UID) that we assign in order to identify you, and the time your account was created
• Learning records — how you rated each learning card, the review schedule derived from those ratings, and how much you studied on each day
• Service settings — display language, whether audio plays automatically and which voice is used, whether introductory tips have been shown, and your chosen study range
• Device time zone — used so that daily study figures are calculated in your local time
• Subscription information — the type of subscription and its expiry, whether it is set to renew, the expiry of any free trial period, and which Redemption Codes have been registered
• Connection information — IP address, request time, and application version

3. Information used for email sign-in

• A hash of the one-time code (we do not store the code itself), the time it was sent, and the number of attempts made

4. Diagnostic and usage information

To keep the application working and to improve it, the following is collected automatically.

• Error information when the application terminates unexpectedly, together with the device model and the operating system and application versions
• A record of which screen was opened and when
• A random identifier that the analytics tools create each time the application is installed (an installation identifier — not an advertising identifier; a new one is created if you reinstall the application)
• The account identifier described above is recorded alongside this information.

Section 3 (Information we do not collect)

So that there is no doubt, we also state what we do not collect.

• Payment details — we never collect or store card or account numbers. Payment is handled by the store from which you obtained the application (the Apple App Store or Google Play).
• Passwords — we only offer sign-in methods that do not use a password, so there is no password for us to hold or to lose.
• Advertising identifiers (the IDFA on iOS, the advertising ID on Android) — we do not collect them, we do not serve targeted advertising, and we do not track you for advertising purposes.
• Location data.
• Contacts, photos, microphone or camera data — the application does not ask for these permissions.
• Name, date of birth, gender or telephone number.
• The diagnostic and usage information in Section 2(4) does not include your email address, what you studied, or any Redemption Code.

We do not collect any special category data, and we do not collect "sensitive personal information" as that term is defined by the California Consumer Privacy Act.

Section 4 (Why we use your information)

We use your information only for the purposes below. If we ever want to use it for something else, we will ask you first. The final column states the legal basis on which we rely where the UK General Data Protection Regulation applies to our processing.

Where we rely on a legitimate interest, you have the right to object; see Section 8.

Section 5 (How long we keep your information)

1. We keep your personal information for as long as your account exists. When you delete your account we destroy it without undue delay, as described in Section 9.
2. The hash of an email sign-in code is deleted once the code expires (10 minutes after it is sent) or once it has been used.
3. We use your IP address only while handling a request and do not store it in our database. It may appear in server operating logs, which are deleted automatically after about 7 days.
4. Some information remains after your account is deleted. Section 9 explains what and why.
   1. Deletion record — a hash of your email address, your account identifier, and the time of deletion. This exists to stop the 30-day free trial period being claimed repeatedly by creating a new account, and we keep it until the Service closes.
   2. Whether a Redemption Code has been used — kept to stop a code being used twice, with the part that identifies who used it removed.
   3. Diagnostic and usage information already sent — deleted automatically when the retention period in Section 7 ends.
5. Where the law requires a record to be kept for a set period and such a record exists, we keep it for that period. Because we do not process payments ourselves, records of payment are held by the Store operator; we do not keep records that we never create.

   Record	Requirement	Period
   Contracts and withdrawal of offers	Act on Consumer Protection in Electronic Commerce (Korea)	5 years
   Payment and supply of goods or services		5 years
   Consumer complaints and dispute handling		3 years
   Service use records and connection data	Protection of Communications Secrets Act (Korea)	3 months

Section 6 (Disclosure to others)

We do not sell your personal information, and we do not share it for cross-context behavioural advertising — including as those terms are defined by the California Consumer Privacy Act. We have not done either in the preceding 12 months, and we do not disclose personal information to third parties for their own purposes.

We disclose personal information only in these cases.

1. Where you have asked us to, or agreed in advance.
2. Where the law requires it, or where a law enforcement authority requests it following the procedure set out in law.

Engaging service providers to process information on our behalf is not disclosure of this kind; it is described in Section 7.

Section 7 (Service providers and international transfers)

We use the service providers below to operate the Service. They act on our instructions, and they may not use the information for their own purposes. Because the Company is established in Korea and these providers are outside it, personal information is transferred internationally, and we set out the details as required by Article 28-8 of the Korean Personal Information Protection Act.

Transfer safeguards. The data processing terms that apply to our use of these providers incorporate the standard contractual clauses approved for international transfers and, where the UK General Data Protection Regulation applies, the UK International Data Transfer Addendum. If you are in Australia, we take reasonable steps under Australian Privacy Principle 8 before disclosing information to an overseas recipient; if you are in New Zealand, we rely on Information Privacy Principle 12 on the basis that these providers are subject to comparable safeguards.

You may object to the international transfer of your personal information. The transfers above are, however, essential to providing the Service, so if you object we cannot continue to provide it and your account will be deleted instead.

Section 8 (Your rights)

1. You may at any time ask us to give you access to your personal information, to correct it, to delete it, or to stop processing it.
2. You can do the following yourself, in the application.
   1. Change your settings, such as display language and audio
   2. Reset your learning records
   3. Delete your account (if you cannot use the application, you can ask by email as described on the account deletion page)
3. For anything else, write to us at the address in Section 12. We will act without undue delay — and in any event within one month, or within 10 days of receipt where the Korean Personal Information Protection Act applies to a request to correct or delete — and will tell you what we have done. We do not charge for this and we will not treat you differently for exercising a right.
4. We will check that a person making a request is the individual concerned or an authorised representative before we act on it.
5. If the UK General Data Protection Regulation applies to our processing of your information, you also have the right to receive your information in a portable form, the right to restrict processing, and the right to object to processing that we carry out on the basis of a legitimate interest — including the diagnostic and usage information in Section 2(4). Where we rely on your consent, you may withdraw it at any time without affecting processing carried out beforehand.
6. If you are a California resident, you have the right to know what personal information we collect and why, the right to have it deleted, the right to correct it, and the right not to be discriminated against for exercising those rights. The categories we collect are identifiers, commercial information (subscription status), and internet or other electronic network activity information; the sources, purposes and recipients for each are in Sections 2, 4 and 7. As stated in Section 6, we do not sell or share personal information, so there is no opt-out for you to exercise, and we do not collect sensitive personal information, so there is nothing for you to limit.
7. If you are in Canada, you may ask about our handling of your personal information under the Personal Information Protection and Electronic Documents Act and may challenge our compliance with it.
8. If you are in Australia or New Zealand, you may request access to and correction of your personal information under the Australian Privacy Principles or the Privacy Act 2020 respectively.

Section 9 (Deleting your information)

1. When the retention period ends, or the purpose is achieved, or the information is otherwise no longer needed, we destroy it without undue delay.
2. All personal information is held in electronic form and is deleted in a way that prevents it being recovered.
3. When you delete your account, the following are destroyed.
   1. The account information in our database — email address, settings and subscription information
   2. All of your learning records
   3. The sign-in account used for authentication (Firebase Authentication)
   4. The customer record held for subscription management (RevenueCat)
   5. The copy of usage analytics data held on your device
4. Some information remains after deletion. We say so plainly.
   1. Deletion record — a hash of your email address, your account identifier, and the time of deletion. This exists so that the 30-day free trial period cannot be claimed again and again by deleting an account and creating a new one. A hash is a one-way transformation: your email address cannot be recovered from it, and it can answer only the question "has this address been seen before?"
   2. Whether a Redemption Code has been used, and when — kept so that a code cannot be used twice. The part identifying who used it is deleted.
   3. Diagnostic and usage information already sent — this is not erased when your account is deleted; it is deleted automatically when the retention period in Section 7 ends (90 days from collection for error information, up to 14 months for usage analysis).
5. A window in which deleted data can still be restored. The cloud databases we use provide, as a platform feature, the ability to roll back to a point up to 30 days earlier for disaster recovery. Deleted data may therefore remain in the backup system for up to 30 days after deletion, after which it disappears automatically. We do not access those backups for any purpose other than recovering from a failure.

Section 10 (Security)

1. Encryption in transit — all traffic between the application and our servers, and between your browser and our website, is encrypted (HTTPS/TLS).
2. A design with no passwords — we do not collect passwords, so there is no password that can be exposed.
3. One-way hashing — email sign-in codes are stored only as hashes, and the email address in a deletion record is stored only as a hash.
4. Least privilege — access to systems that hold personal information is limited to the smallest number of people who need it.
5. Abuse prevention — the number and frequency of sign-in code requests, verifications and code registrations are limited.

Section 11 (Cookies, advertising identifiers and tracking)

1. Our website (momspeaking.com and its subdomains) does not use cookies and does not store anything in your browser.
2. The application does not collect advertising identifiers, does not build profiles for advertising, and does not track you across other companies' applications or websites. We do not respond to browser "Do Not Track" signals because we do not carry out the tracking they refer to.
3. If you do not want the diagnostic and usage information in Section 2(4) to be collected, you may object or ask us to stop processing it under Section 8.

Section 12 (Contact)

The person responsible for personal information at the Company — the privacy officer designated under Article 31 of the Korean Personal Information Protection Act — and the point of contact for any question, complaint or request under this policy, is as follows.

Section 13 (Complaints)

Please contact us first — we would rather put something right than have you go elsewhere. You also have the right to complain to a supervisory authority.

• United Kingdom — Information Commissioner's Office, 0303 123 1113 (ico.org.uk)
• Australia — Office of the Australian Information Commissioner, 1300 363 992 (oaic.gov.au)
• Canada — Office of the Privacy Commissioner of Canada, 1-800-282-1376 (priv.gc.ca)
• New Zealand — Office of the Privacy Commissioner, 0800 803 909 (privacy.org.nz)
• California — Office of the Attorney General (oag.ca.gov/privacy)
• Republic of Korea — Personal Information Dispute Mediation Committee, 1833-6972 (www.kopico.go.kr); Personal Information Infringement Report Centre, 118 (privacy.kisa.or.kr)

Section 14 (Changes to this policy)

1. This policy applies from the effective date given in the addendum.
2. If we change it because the law or the Service changes, we will publish the change and its effective date at least 7 days beforehand. Where a change materially affects your rights, we will publish it at least 30 days beforehand and notify you individually.
3. Earlier versions and a summary of what changed are available in the revision history.

Addendum

This Privacy Policy takes effect on October 24, 2026.