Privacy Policy

Effective: July 12, 2026

Data Controller

• Business name: Funston (펀스턴)
• Representative / Privacy Officer: Junsung Park (박준성)
• Business registration number: 774-17-02956
• Mail-order business registration: 제2026-서울구로-0893호
• Address: Opus 1, B36-S77, B1F, 207 Gurojungang-ro, Guro-gu, Seoul 08216, Republic of Korea
• Hosting provider: Cloudflare, Inc. (website) · Supabase Inc. and Amazon Web Services (backend)
• Phone: +82-10-9966-3457
• Email: support@moavoca.com

The data controller for this service is Funston (Junsung Park), who also serves as the Privacy Officer. MoaVoca ("the App") is operated by Funston, a sole proprietorship registered in the Republic of Korea. This Privacy Policy explains what information we collect, how we use it, and the rights you have over it, in line with Korean PIPA, EU/UK GDPR, and the California CCPA.

Privacy inquiries: support@moavoca.com

1. Information We Collect

MoaVoca ("the App") collects the following information to provide its services.

• Email address: collected when you register and sign in. Sign-in is required to use the service (choose one of email, Google, or Apple), and the email tied to your chosen sign-in method is collected.
• Password: collected for email account authentication and stored only as a one-way salted hash on Supabase Auth — we cannot view the plaintext password
• Google profile information: if you choose Google sign-in, your email address and name are passed to us via Google.
• Apple account information: if you choose Apple sign-in, the email address and name linked to your Apple ID are passed to us. If you choose "Hide My Email", only an Apple-generated anonymous relay address is passed to us — we cannot see your real email address.
• Display name (nickname) and username (@handle): the name and handle shown to other users in friend and sharing features. The username is searchable by other users to add you as a friend. Both are set by you.
• Avatar selection: an avatar chosen from a Provider-supplied predefined set or auto-generated initials. Custom photo upload is not supported.
• Language settings: native language, source language, target language
• Wordlist data: list names, saved words, and AI-generated definitions
• Shared wordlists: wordlists you share so other users can view them (name, description, word selection)
• Friend relationships: list of other users you have added, accepted, or blocked
• Device language: checked once for initial UI language (not sent to servers)
• Camera/Photos: When using the image word extraction feature, text is by default extracted on-device (ML Kit) and the image never leaves your device. Only when on-device extraction is not possible is the captured or selected image sent to our server for AI processing (OpenAI, United States); it is deleted immediately after processing and is not stored on our servers.
• Pasted-text extraction: When using the extract-words-from-text feature, the passage you paste (up to 200 characters) is sent to OpenAI (United States) to extract headwords. The passage is not stored on our servers after extraction.
• Microphone/Voice: When using voice search, microphone input is forwarded to your operating system's speech recognition service (Apple/Google) for conversion to text. Only the transcribed text is used for word lookup; the audio itself is not transmitted to or stored on our servers.
• Notifications: Notification permission is used for learning reminders (daily reminders, weekly recap, per-wordlist reminders with day-of-week and time selection, and re-engagement/streak-recovery reminders when you have been inactive). All notifications are scheduled locally on your device — no notification data is sent to external servers. Per-wordlist notification settings are also stored on the server for cloud sync.
• Country/Timezone: The country and matching timezone you select during onboarding are stored. They are used for monthly usage limit calculations, notification timing, and similar features. You can change your region once per month from Settings.
• Learning progress: Per-wordlist review counts, next-review dates, and consecutive learning days (streak) are stored on your device and on the server.
• API usage logs: per-call counts, response times, costs, and error categories, keyed by your user id, for service operations and abuse prevention
• Usage analytics: to improve the service and understand feature usage, we collect screen views, key feature-usage events, a per-launch session identifier, daily in-app usage time (seconds), the app version, and the operating-system type on our own server (Supabase). This never includes word text, search terms, email, or any directly identifying / user-entered content, and is never shared with ad networks or other third parties. The legal basis is legitimate interest (GDPR Art. 6(1)(f)); you can opt out at any time from Settings.
• Age range (optional): a coarse age band you may optionally select during onboarding (e.g., 18–24, 25–34) is collected for statistics and product improvement. We do not collect your date of birth or exact age, and you can skip this. The legal basis is legitimate interest (GDPR Art. 6(1)(f)).
• Connection IP address: processed transiently per request for rate limiting to prevent abuse and excessive requests. Some external services (§4), such as advertising and web hosting, may also process your IP as part of standard access logs.
• Device push token: a device push token is collected and stored on the server to deliver push notifications such as friend requests and learning reminders (see APNs/FCM in §4).
• Login device info: to enforce the per-plan limit on concurrent signed-in devices and prevent abuse, we collect and store a random per-device identifier (generated by the app), device type/model (e.g., iPhone 15 Pro), and access timestamps. We do not collect user-assigned device names. This information is deleted when you sign out of that device.
• Error & diagnostic data: when an error occurs, device information, error logs, and a pseudonymous identifier are sent to Sentry to improve app stability. Directly identifying data such as email is removed before transmission (see §4).
• Subscription status: premium subscription state and related transaction information
• Customer inquiry data: when you contact us through the in-app inquiry form, we collect your contact email address, the inquiry content, and any attached screenshot image (optional), used to handle and respond to your inquiry.

2. Information We Do Not Collect

• Additional personal identifiers such as phone number
• GPS or precise location data
• Contacts, calendar, or health data
• Payment card information (payments are processed through Apple/Google)

3. Where Data Is Stored

Wordlists and vocabulary data are stored locally on your device (SQLite). Language settings are kept in on-device storage (AsyncStorage).

Wordlist data is securely transmitted to and stored on our server (Supabase) for cloud backup and cross-device sync.

When you look up a word, the request is processed through our server (Supabase) for AI processing. Results may be stored in an anonymous cache to improve service quality.

4. Third-Party Services and Processing Entrustment

The App uses the following external services to provide its functionality. These providers act as processors (수탁자) under Korean PIPA Article 26: under a data-processing agreement with the Provider, they process personal data only within the scope of the entrusted work and do not use it for their own purposes.

• OpenAI: The searched word and language pair are sent. When using image word extraction, an image is also transmitted only when on-device extraction is not possible. When using text word extraction, the passage you paste (up to 200 characters) is sent to extract headwords and is not stored after processing. In addition, when you publish a community/shared wordlist, its title, description, and wordlist body (words, definitions, and example sentences) are sent to OpenAI for content moderation. No user identification is transmitted.
• Anthropic (United States): When you submit a customer inquiry, the inquiry body text is sent to generate a draft reply. It is not used for any purpose other than drafting the reply.
• Microsoft Azure (Cognitive Services - Speech): For all languages except Chinese (zh-CN), the word or example sentence text is sent to Azure Neural TTS for speech synthesis. No user identification is transmitted; the synthesized audio is stored in an anonymous cache.
• Google Cloud Text-to-Speech: Chinese (zh-CN) pronunciation is synthesized via Google Cloud TTS instead of Azure. Only the word/sentence text is sent; no user identification is included.
• Supabase: Provides authentication, database, cloud sync, TTS audio caching, and API hosting
• RevenueCat: Manages in-app (iOS/Android) subscription state. Only a pseudonymous user ID and subscription information are shared; no card data.
• Paddle.com Market Limited: Payment processing as Merchant of Record and the subscription management portal, should web (moavoca.com) subscription billing be introduced in the future. Web billing is not currently offered, so no data is shared today; if introduced, the checkout email, transaction amount, country (for VAT), and pseudonymous customer/subscription IDs would be shared, and no card data reaches the operator.
• Free Dictionary API: Fallback dictionary for English lookups (only the word is sent)
• National Institute of Korean Language – Korean Basic Dictionary API (krdict.korean.go.kr, in Korea): when you look up a Korean word, only the searched word is sent. No user identification is included.
• Google Cloud Translation: To cross-check lookup quality, the looked-up word and a candidate definition are sent to Google Cloud Translation. No user identification is included.
• Google AdMob / AdSense: Displays in-app ads (AdMob) and moavoca.com web ads (AdSense) to free-tier users. Per Google's privacy policy, advertising identifiers (IDFA/GAID) or web cookies / pseudonymous identifiers and ad-interaction data may be collected, subject to your tracking/cookie consent. Premium users do not see ads.
• Apple (Sign in with Apple): When you sign in with Apple, Apple handles authentication and only the information you consent to share (email, name) is passed to the App. If you select "Hide My Email", Apple generates an anonymous relay address that is shared with us instead of your real email.
• Google (Google Sign-In): When you sign in with Google, Google handles authentication and your email and profile information are passed to the App.
• Apple Push Notification service (APNs): Delivers iOS push notifications (friend requests, learning reminders, etc.). The device push token and the notification payload (title/body) are transmitted.
• Firebase Cloud Messaging (FCM, Google): Delivers Android push notifications. The device push token and the notification payload are transmitted.
• Amazon Web Services (AWS SES): Delivers transactional email (account deletion confirmation, subscription notices, etc.). The recipient email address and the message body are transmitted.
• Sentry: Error monitoring service. Device information, error logs, and a pseudonymous identifier (your Supabase user ID) may be transmitted when errors occur; directly identifying data such as email is redacted client-side before transmission.
• Cloudflare: Hosting for the moavoca.com website (Cloudflare Pages), CDN, and DDoS protection. Standard HTTP access logs (visitor IP, User-Agent, request path) are processed.
• ImprovMX: Inbound email alias forwarding (support@, admin@). The sender address, subject, and body of incoming mail are forwarded to the operator's inbox.
• jsDelivr: CDN for the Pretendard web font used on legal and web pages. Visitor IP, User-Agent, and Referer are processed.

Beyond the above, we do not share data with third-party analytics tools, social media platforms, or data brokers. Our usage analytics (§1) use no third-party tools and are processed only on our own server (Supabase).

Transfer of personal data on business succession (Korean PIPA Article 27): If personal data is transferred due to a merger, business transfer, or conversion of the Provider from a sole proprietorship to a corporation, the Provider will, before the transfer, notify you through in-app notice and email of (i) the fact of transfer, (ii) the name and contact details of the party receiving the data, and (iii) how to withdraw consent or object if you do not want your data transferred. The receiving party will use the personal data only within the scope of the purposes existing at the time of transfer.

Where the receiving party is located outside Korea (for example, the establishment of an overseas corporation or an acquisition by a foreign operator), the Provider will, in addition to the above notice, comply with the cross-border transfer requirements of PIPA Article 28-8 (disclosing the receiving country, the time and method of transfer, and the categories of data, and obtaining consent or another lawful transfer basis where required). For EU/UK data subjects, transfers outside the European Economic Area (EEA) are protected by appropriate safeguards required under the GDPR, such as Standard Contractual Clauses (SCCs).

5. Text-to-Speech (TTS)

The pronunciation feature uses Microsoft Azure Neural TTS for all languages except Chinese (zh-CN), and Google Cloud Text-to-Speech for Chinese. The word or example sentence text is routed through our Supabase server to the relevant synthesis service, and the synthesized audio file is stored in an anonymous cache on Supabase storage so that subsequent requests for the same text reuse the cached audio. No user identification is included in TTS synthesis requests.

6. Speech Recognition

The microphone button on the word lookup screen lets you dictate a word instead of typing. Audio is processed by your operating system's speech recognition service (iOS Speech, Google Speech) and the corresponding privacy policies of Apple/Google may apply. Our app receives only the transcribed text and uses it for lookup; raw audio is not stored or transmitted by us.

7. Push Notifications

Daily learning reminders, weekly recaps, per-wordlist notifications, and — when you have been inactive for a while — re-engagement and streak-recovery reminders are all scheduled locally on your device. These notifications are scheduled based on your on-device learning state (last study date, streak status, days inactive); that state is not sent to or tracked by external servers. For per-wordlist notifications, you can pick the days of the week and time. All notifications can be disabled at any time from Settings.

8. Wordlist Export

All users can export wordlists as CSV files for free (no premium subscription required). Files are generated on-device and shared via your operating system's share sheet (email, messaging, cloud drives, etc.) to a destination you choose. No additional data is sent to our servers during export. A printable PDF study-sheet export format is additionally offered as a premium feature.

9. Public Content and Wordlist Sharing

When you share a wordlist publicly, the wordlist's name, description, word selection, and the posting user's display name and avatar become visible to all other users. Shared wordlists are treated as public information and are subject to discovery, viewing, and download by other users.

You may unshare or delete content at any time. However, copies that other users have already downloaded or copied into their own wordlists may not be automatically deleted from those copies.

The Provider may, without prior notice, hide or remove inappropriate public content. Users can flag inappropriate content through the in-app reporting system, and we act on credible reports promptly (EU DSA Art. 16). See the Terms of Service for the full content policy.

10. Friend System

Users you have added as friends may see your display name, avatar, learning statistics (study days, total words, etc.), and shared wordlists. The exact scope of visibility is shown and adjustable in the in-app settings.

Friend relationships are formed by mutual consent and may be removed or blocked at any time. After blocking, the blocked user can no longer see your content.

Friend relationship data is stored encrypted on the server and is not disclosed to third parties other than the friends themselves.

11. Profile and Avatar

Profile avatars may only be set from a Provider-supplied predefined set or as auto-generated initials. Custom photo or image upload is not supported (to prevent the risk of inappropriate content).

Display names and avatars are public information visible to other users in friend, sharing, and community feature areas.

12. Advertising Identifiers (iOS ATT / Android GAID)

On iOS, the system may show a tracking permission prompt (IDFA) the first time you launch the App. On Android, the Google Advertising ID (GAID) is used; you can limit ad personalization or reset the GAID in your device settings. Your decision affects only ad personalization — declining does not restrict the app's core functionality. Users in the EU (GDPR) and California (CCPA) will see a separate ad consent screen.

Joint controllership with Google (GDPR Art. 26): For the limited purposes of (i) collecting and presenting end-user consent for ad personalization and (ii) the joint processing carried out by AdMob/AdSense for personalized ad delivery, Funston and Google Ireland Ltd. (or its applicable Google entity) act as joint controllers within the meaning of GDPR Art. 26. Allocation of responsibilities: (a) Funston presents the consent prompt, surfaces this Privacy Policy, and forwards tracking/consent signals; (b) Google handles ad serving, measurement, security, and aggregate reporting back to Funston; (c) the parties cooperate on data-subject requests, but data subjects may exercise their GDPR rights against either Funston or Google directly. The full Google-side terms are at privacy.google.com/businesses/jointcontroller. For matters outside the joint-controllership scope (e.g., Google's own service improvement), Google acts as an independent controller under its own privacy policy.

13. Retention by Processing Purpose

We process personal data only for the purposes and retention periods set out below (Korean PIPA Article 15; GDPR Article 13(2)(a)). Our legal bases under GDPR Article 6 are, by purpose: performance of a contract (Art. 6(1)(b)) for learning, account, and subscription features, including the overseas processing by our subprocessors that is necessary to provide those online features; consent (Art. 6(1)(a)) for marketing and ad personalization; legitimate interests (Art. 6(1)(f)) for abuse prevention, security, and product-improvement usage analytics; and legal obligation (Art. 6(1)(c)) for tax and billing records.

• Provide learning features (wordlists, study progress, language settings): until account deletion
• Account authentication (email, password hash, OAuth identifiers): until account deletion
• Friend & community features (display name, friend graph, public wordlists): until you remove the content or delete the account
• Abuse prevention and API usage logs: 90 days
• Usage analytics: 12 months (legal basis: legitimate interest)
• Age band: until account deletion (legal basis: legitimate interest)
• Subscription billing records: 5 years, per Korean VAT, income-tax, and e-commerce-consumer-protection law; personal identifiers in those records are pseudonymized or de-identified
• Personalized advertising identifiers (IDFA/GAID): per the ad network's policy, up to 2 years from consent
• Crash and diagnostic logs (Sentry): 90 days
• Daily in-app usage time (learning statistics): until account deletion (collection stops if you opt out of usage analytics in Settings; legal basis: legitimate interest)
• Customer inquiry records (contact email, inquiry content, attachments): retained to handle inquiries and respond to consumer disputes, and deleted on account withdrawal; where a record constitutes a consumer complaint/dispute record under the e-Commerce Act, it is retained for 3 years and then destroyed
• One-way email hash for free-trial abuse prevention: retained for 2 years from last use even after account deletion, then destroyed; the original email cannot be recovered from this value
• Administrator access/audit logs: retained to meet security-safeguard (access-log) obligations and may include an email snapshot of the affected member; kept for up to 3 years, then destroyed

14. Data Storage and Deletion

Locally stored wordlist data is deleted when you uninstall the app. You can also delete all on-device data at any time using the "Reset" option in Settings.

If you have registered an account, you can request account deletion from the Settings screen or by email. After verifying your identity, we will permanently delete all server-stored data (email, OAuth identifiers, wordlist data, learning progress, display name, friend graph, shared wordlists, push tokens, notification settings) within 30 days. In most cases the deletion completes immediately or within minutes; technical reasons such as backup-rotation cycles may take up to 30 days.

However, to prevent repeated use of the free trial, a one-way hash of the email used at signup is retained for 2 years from the last use even after account deletion, and is then destroyed (see §13). The original email cannot be recovered from this hash. In addition, administrator access/audit logs kept as a security safeguard may be retained for the separate period described in §13.

Server data is retained after subscription cancellation until you request account deletion. Payment- and settlement-related transaction records are retained separately under §13.

If the Provider permanently discontinues the Service, we will give notice at least 30 days before the planned termination date through in-app notice and email, during which you may export your wordlists as CSV or JSON to keep your data. After termination, personal data stored on our servers is securely destroyed in accordance with applicable law; transaction records whose retention is legally mandated are pseudonymized or de-identified and retained for the required period before destruction.

Method of destruction: electronic personal data is permanently erased by technical means that prevent recovery; any personal data printed on paper is shredded or incinerated.

15. International Data Transfers

Some processors listed in §4 process personal data outside the Republic of Korea (Korean PIPA Article 28-8 disclosure).

• Recipients: the processors listed in §4 (Supabase, OpenAI, Anthropic, Microsoft Azure, Google (Cloud TTS, Cloud Translation, AdMob/AdSense, Sign-In), Apple, RevenueCat, Paddle.com Market Limited, Sentry, AWS, Cloudflare, ImprovMX, jsDelivr, freedictionaryapi.com)
• Recipient country: primarily the United States; Azure uses the United States (East US); Paddle in Ireland/UK (US fallback); ImprovMX in Czech Republic/EU; Cloudflare and jsDelivr at the nearest global edge
• Time and method of transfer: continuously, via encrypted HTTPS/TLS, at the time the relevant feature is used
• Categories of data: as detailed per processor in §4
• Purpose: as detailed per processor in §4
• Retention by recipients: per each processor's own policy; we instruct them to delete on request

The Service (web, iOS, and Android) requires sign-in to use, and the overseas transfers to the external services listed in §4 are necessary to provide the Service. If you do not want your data transferred overseas, you may choose not to sign up for or use the Service; if you have already created an account, you can request account deletion or withdraw consent through the process described in §16.

Note: the Republic of Korea is the subject of a 2021 EU Commission adequacy decision, so transfers between Korea and the EU are recognized as providing an adequate level of protection. Transfers to other countries (e.g., the United States) rely on lawful transfer mechanisms such as data-processing agreements and Standard Contractual Clauses (SCCs).

16. Your Rights

Regardless of where you live, you have the following rights over your personal data (Korean PIPA Articles 35–37; GDPR Articles 15–22; CCPA §§1798.100 et seq.).

• Right of access — request a copy of the personal data we hold about you
• Right to correction / deletion — correct inaccurate data or request erasure. In-app: Settings → Account → Delete Account. By email: a request from your registered address
• Right to restriction of processing
• Right to data portability — receive your data in a machine-readable format. All users can export wordlists as CSV in-app for free; the main account data can be exported instantly as JSON in-app (Settings → Account → Export data). Any remaining items not included in the in-app export (for example, device-session and usage-time records) are provided within 30 days on email request
• Right to withdraw consent at any time, without affecting prior processing
• No solely automated decision-making — we do not make decisions producing legal effects on you based solely on automated processing
• Right to opt out of sale/sharing (California CCPA/CPRA) — we do not "sell" personal information for monetary consideration. Any "sharing" for cross-context behavioral advertising is limited to the consent-based ads described in §12; you may exercise your "Do Not Sell or Share My Personal Information" right by declining ad consent or using your device's ad-tracking limit setting. On our website (moavoca.com) we also honor the Global Privacy Control (GPC) browser signal as a valid opt-out of sharing. You may also request limitation of the use of sensitive personal information by email; additional requests may be sent by email.

How to exercise: where available, use the in-app controls; otherwise email support@moavoca.com with sufficient information to verify your identity. We respond within 30 days. If we decline, we will explain why and how to appeal.

You may also lodge a complaint with your data-protection authority: the Personal Information Protection Commission of Korea (privacy.go.kr) and KISA (privacy.kisa.or.kr, ☎ 118) for Korea; your national supervisory authority for the EU; the ICO for the UK; or exercise CCPA rights as a California resident.

17. Security Measures and Breach Notification

We implement the following technical and organizational safeguards.

• All server connections use TLS 1.2 or higher
• Authentication tokens are stored in iOS Keychain or Android EncryptedSharedPreferences — never plaintext AsyncStorage
• Service-role keys never leave the server
• Periodic security audits and prompt hardening updates (latest audit: June 2026)

In the event of a personal-data breach, we will notify affected users and the relevant supervisory authority without undue delay, and within 72 hours where required by applicable law (Korean PIPA Article 34; GDPR Articles 33–34; CCPA §1798.82).

18. Accounts and Authentication

Using the App requires signing in with email + password, Apple Sign In, or Google Sign-In (on web, iOS, and Android alike). After signing in, you can use cloud sync, friends/community, and premium features.

Email verification is required during email registration. Passwords are stored only as one-way salted hashes on Supabase Auth and cannot be viewed by the Provider.

When signing in with Google, your Google account email address and profile information (name) are collected. Your Google password is not processed by the App.

When signing in with Apple, the email address and name linked to your Apple ID are collected. If you choose "Hide My Email", Apple generates an anonymous relay address that is provided to us instead of your real email — we cannot see your real email address. Apple handles password and authentication.

19. EU / UK Representative

The Provider has not currently designated a GDPR Article 27 representative in the EU or UK and will consider appointing one if and when required. EU and UK data subjects may exercise their GDPR rights by contacting us directly at the email below.

20. Children's Privacy

The App is rated 12+ on the App Store and Teen on Google Play and is not directed at children. The Service is not available to children under 14 (per Korean PIPA / 정보통신망법), under 13 (per US COPPA), or under the higher minimum age of digital consent required by the user's country of residence (for example, 16 in Germany and the Netherlands, 20 in Thailand). If we become aware of personal information collected from a child below the applicable age, we will delete it promptly. Please contact us at support@moavoca.com if you believe a child has provided personal data.

21. Changes to This Policy

If this Privacy Policy is updated, we will notify you through an in-app notice prior to the changes taking effect.

This policy was last updated on July 12, 2026.

22. Contact Us

For privacy-related inquiries, please reach out by email.

Email: support@moavoca.com