Privacy Policy

1. Purposes of Processing Personal Information

In connection with the HSK 3 (an HSK Level 3 study mobile app)) and website (hereinafter referred to as the "Service"), the Company processes personal information for the following purposes. The personal information processed will not be used for purposes other than those listed below, and if the purposes of use change, the Company will take necessary measures, such as obtaining separate consent, pursuant to Article 18 of the Personal Information Protection Act (PIPA).

• Service provision and operation: Providing learning features such as quizzes, mock exams, and review
• Service usage statistics analysis and improvement: Google Analytics 4(GA4)·Microsoft Clarity (web), PostHog (app) are used to analyze service usage and improve the user experience.
• Advertising: Displaying ads and providing personalized ads through Google AdMob (including regional ads based on approximate location inferred from IP address)
• Error monitoring and service stability: Detecting app errors and crashes and analyzing causes through Sentry
• Payment processing: Processing in-app purchases (subscriptions/one-time purchases) and managing subscription status through RevenueCat
• Customer inquiry handling: Receiving·handling inquiries through email and in-app 1:1 inquiries, and providing responses (including attached images)
• Sending notifications: Responses to 1:1 inquiries,Sending push notifications for learning reminders and announcements
• Account authentication and learning data synchronization: Through Supabaselogin (Google·Apple·email)andcloud storage·restoration of learning records across devices (optional feature)
• Prevention of fraudulent use: Detecting abnormal sharing of paid access across multiple devices and protecting access rights

2. Categories of Personal Information Processed

A. Items automatically collected in the mobile app

• Microsoft Clarity (app analytics): App usage patterns, tap/scroll heatmaps, session replay data
• Google AdMob (advertising): IP address and approximate location information inferred from it (country/city level), user product interaction information, diagnostic information, device and account identifiers (GAID/IDFA) — the Company does not collect precise location information such as GPS, and the app does not request location permission.
• Sentry (error monitoring): Error and crash information (stack traces, error messages), device information (OS version, device model, app version), IP address, and user actions immediately before an error (breadcrumbs)
• RevenueCat (payment processing): Anonymous user ID, purchase history (product ID, transaction ID, subscription status, expiration date), device platform information
• PostHog (app usage analytics): Anonymous user ID (distinct ID), event data (11 types of events including app launch, screen entry, quiz solving/completion, mock exam taking, subscription screen view, and payment completion), device information (OS, app version, language settings), app installation source information (UTM source/medium/campaign — Google Play install referrer on Android)

B. Items automatically collected on the website (cookies)

• Google Analytics 4: User distinction and session status information through cookies (_ga, _ga_<id>)
• Microsoft Clarity (web analytics): Heatmaps, session replays, and usage pattern data (_clck, _clsk, CLID, MUID etc.)

C. Learning data (device storage + cloud synchronization based on anonymous identifiers)

The following learning data is stored in the SQLite database on the user's device and, through an anonymous identifier (anonymous session) automatically generated when the app is launched, is synchronized and retained in Supabase (Seoul region) regardless of whether the user is logged in. When the user logs in, the data is linked to the user's account. (User settings are stored only on the device.)

• Quiz-solving history and results
• Learning behavior data (interaction patterns such as time spent solving questions and answer changes — for improving learning recommendations)
• FSRS review card status
• Mock exam results
• Daily learning statistics
• User settings (exam date, notification time, etc.)

D. Items collected when linking an account (optional)

Account login is optional, and all learning features are available as a guest. When linking an account through social login (Google·Apple) or email, the following items are collected.

• Login information: Email address, login method (Google·Apple·email), provider account identifier (including Apple's private email relay address)
• Account identifier: Unique account ID (UUID), authentication session token
• Device information (prevention of fraudulent use): Device type (phone·tablet, etc.), device model name — for detecting abnormal sharing of paid access across multiple devices

E. Items collected when using push notifications

App notifications (Responses to 1:1 inquiries,When users allow notifications to receive learning reminders and announcements, the following items are collected. No information is collected if notifications are not allowed.

• Push notification token: Device-specific push token (Apple Push Notification service(APNs) · Google Firebase Cloud Messaging(FCM)) — an identifier for delivering notifications to the device
• Device identifier: Unique identifier for each app installation (device_id), platform (iOS·Android), language settings, app version

F. Items collected when using 1:1 inquiries

When using in-app 1:1 inquiries, the following items are stored in Supabase (Seoul region).

• Inquiry information: Inquiry type (bug·suggestion·question error·general), inquiry content, screen information where the issue occurred
• Attached images: Photos directly attached by users (up to 3) — for reviewing inquiries

G. Device motion sensor (shake to report)

Only when the "Shake to Report a Bug" feature is enabled, the device's motion sensor (accelerometer) detects only shake gestures. Motion data is processed only on the device and is not transmitted to or stored on the Company's servers. This feature is turned off by default and can be enabled in Settings.

3. Processing Personal Information of Children Under 14

The Company does not collect personal information from children under the age of 14. If it is confirmed that a user under the age of 14 has provided personal information, the Company will destroy that personal information without delay.

4. Processing and Retention Periods of Personal Information

After the purposes of collecting and using personal information have been achieved, the Company destroys the relevant information without delay. The retention periods for each service are as follows.

5. Destruction Procedures and Methods for Personal Information

When the purpose of processing personal information has been achieved or the retention period has elapsed, the Company destroys the relevant personal information without delay.

However, anonymized learning statistics that cannot identify an individual may be retained without being destroyed for statistical compilation and improvement of the Service·learning recommendation models. This information does not constitute personal information because it cannot identify a specific individual.

• Electronic files: Securely deleted using technical methods so that recovery and reproduction are impossible.
• Local data on the device: When the app is deleted (uninstalled), all learning data stored on the device is automatically deleted.
• Account data: You can delete it directly in the app under "Settings > Account Management". App membership withdrawal deletes only the learning records of the relevant app (HSK 3) and retains the login account, while Full deletion of the DayPrep account immediately destroys the learning records and login accounts of all DayPrep apps. However, payment·transaction records are retained for 5 years and then destroyed pursuant to the Act on Consumer Protection in Electronic Commerce.

6. Security Measures

The Company takes the following measures to ensure the security of personal information.

• Encryption in transit: All data transmissions use HTTPS (TLS) encryption.
• Data minimization principle: Only the minimum information necessary to operate the Service is collected.
• Local storage and encrypted synchronization: Learning data is stored on the device and synchronized to the cloud (Supabase) based on anonymous identifiers (anonymous sessions). Some user settings (such as exam dates and notifications) are stored only on the device.
• Row-level access control (RLS): Data synchronized to the cloud upon account login is controlled through Supabase Row Level Security so that only the user may access it.
• Domestic storage and least privilege: Account·synchronization data is stored domestically (AWS Seoul Region), and authentication tokens and access permissions are managed according to the principle of least privilege.

7. Rights and Obligations of Data Subjects and How to Exercise Them

Data subjects (users) may exercise the following rights against the Company at any time.

• Request access to personal information
• Request correction where there are errors, etc.
• Request deletion
• Request suspension of processing
• Request withdrawal of consent

How to exercise: If you make a request by email (contact@daylab.dev) to the Privacy Officer below, the Company will take action without delay.

When deleting the app: Deleting the app immediately deletes all learning data stored on the device (quiz history, review status, mock exam results, statistics, and settings).

Deletion of account·learning data: You can delete it directly in the app under "Settings > Account Management" (app membership withdrawal / full deletion of the DayPrep account). If you wish to delete it outside the app, please make a request by email above (contact@daylab.dev), and it will be processed after identity verification. For detailed deletion methods and information on data that is deleted·retained, please refer to the Account and Data Deletion page. If you are logged in to your account, data synchronized to the cloud will remain even if you delete (uninstall) the app; therefore, please use the above procedure for complete deletion.

Note: The right to request personal information transmission under Article 35-2 of the Personal Information Protection Act (PIPA) took effect on March 13, 2025. The system is currently being implemented in stages for large-scale information transmitters, and its scope of application may expand in the future.

8. Privacy Officer

The Company designates the following Privacy Officer to take overall responsibility for personal information processing and to handle complaints and remedies for data subjects related to personal information processing.

• Name: Dasong Sim
• Position: Representative
• Affiliation: DAYLAB
• Email: contact@daylab.dev

9. Remedies for Infringement of Data Subjects' Rights

Data subjects may apply to the following organizations for dispute resolution or consultation to obtain remedies for personal information infringement.

• Personal Information Protection Commission (PIPC):
  Tel: 1833-6972 | Website: pipc.go.kr
• Personal Information Infringement Report Center (Korea Internet & Security Agency):
  Tel: 118 | Website: privacy.kisa.or.kr
• Personal Information Dispute Mediation Committee:
  Tel: 1833-6972 | Website: kopico.go.kr
• Supreme Prosecutors' Office Cybercrime Investigation Department:
  Tel: 1301 | Website: spo.go.kr
• National Police Agency Cyber Investigation Bureau:
  Tel: 182 | Website: ecrm.police.go.kr

10. Changes to This Policy

This Privacy Policy applies from its effective date. If additions, deletions, or corrections are made due to changes in laws or this Policy, the Company will announce the changes through the website from 7 days before the effective date. If there are material changes to the rights of data subjects, the Company will announce them 30 days before the effective date.

11. Provision of Personal Information to Third Parties

In principle, the Company does not provide data subjects' personal information to third parties. However, exceptions apply in the following cases.

• Where the data subject has given prior consent
• Where required by laws or where an investigative agency requests it according to procedures and methods prescribed by law for investigation purposes

12. Entrustment of Personal Information Processing

The Company entrusts personal information processing tasks as follows for smooth service provision.

Supabase account·learning data is stored domestically (AWS Seoul Region) and therefore does not constitute a cross-border transfer of personal information.

13. Cross-Border Transfer of Personal Information

The Company transfers personal information overseas as follows to provide the Service. Transfers occur automatically (by transmission) through the information and communications network when users use the Service.

Legal basis: All of the above cross-border transfers fall under cases where entrustment·storage of personal information is necessary for the conclusion and performance of a contract with data subjects. Pursuant to Article 28-8(1)(3) of the Personal Information Protection Act (PIPA), the Company relies on disclosure in this Privacy Policy of the matters set forth in each subparagraph of paragraph (2) of the same Article as the basis for the transfers. The Company does not obtain separate consent for cross-border transfers.

Contact information of recipients: Vercel privacy@vercel.com · Google policies.google.com · Microsoft privacy.microsoft.com · Sentry sentry.io/privacy · RevenueCat revenuecat.com/privacy · Apple apple.com/legal/privacy · PostHog posthog.com/privacy

How, procedures, and effects of refusing transfers: Data subjects may refuse the cross-border transfer of their personal information.On the web, users may refuse transfers for analytics purposes by blocking cookie storage in their browser settings.In the app, users may refuse transfers for personalized advertising purposes by resetting the advertising identifier or refusing tracking permission (ATT) in device settings.Users may refuse the transfer of push tokens by disabling notification receipt in device or app settings.Users may refuse the transfer of account-related information by withdrawing membership (deleting their account). To refuse all other transfers, users must stop using the Service, for example by deleting the app. If users refuse, the relevant features(personalized advertising · push notifications · cloud synchronization of learning data · in-app payment and subscription management, etc.)may be unavailable in whole or in part, but use of the remaining Service is not restricted.

14. Use of Cookies

The Company uses the following cookies on the website for service usage analysis.

A. Google Analytics 4 Cookies

b. Microsoft Clarity Cookies

c. How to Refuse Cookies

You may refuse the storage of cookies through your browser settings. Refusing cookies does not affect your use of the Service.

• Chrome: Settings > Privacy and security > Cookies and other site data > Block all cookies
• Safari: Preferences > Privacy > Block all cookies
• Edge: Settings > Cookies and site permissions > Manage and delete cookies and site data > Turn off Allow sites to save and read cookie data

15. Collection, Use, and Refusal of Third-Party Behavioral Information

The Company collects and uses the following behavioral information through the Google AdMob SDK in its mobile app to provide personalized advertising.

16. Automated Decisions and Processing of Sensitive Information

Automated decisions: The Company uses the FSRS (Free Spaced Repetition Scheduler) algorithm to recommend learning intervals. However, this is a learning support feature intended to improve learning efficiency and does not constitute an automated decision that affects users' rights or obligations under the Personal Information Protection Act (PIPA).

Sensitive information: The Company does not collect or process sensitive information under Article 23 of the Personal Information Protection Act (PIPA), such as ideology or beliefs, political opinions, health, medical, genetic, or biometric information, or criminal history.

17. Revision History

If you need a previous version, please submit a request to contact@daylab.dev. The Company will provide notice of changes to this Privacy Policy through notices on the website and in the app from 7 days before the effective date (30 days before the effective date in the case of material changes unfavorable to users).