KeepUp Privacy Policy
Updated
This policy explains what happens to your data in the KeepUp app (iOS and Android) and on the keepupkorean.com website. It is written under the Personal Information Protection Act of the Republic of Korea (개인정보 보호법, "PIPA" below).
Who processes your data
- Operator: sole proprietor 킵업랩 (KeepUp Lab), business registration number 447-37-01577, Incheon, Republic of Korea.
- Chief privacy officer (개인정보 보호책임자): Andrei Iu, [email protected].
Where this text says "we", it means KeepUp Lab.
What data we collect
| What | Details | Where it comes from |
|---|---|---|
| Account | email address, password (stored only as a hash), internal ID, dates of creation and sign-in. For a guest without an account, only the ID | you enter it when you sign up; a guest account is created automatically on first launch |
| "About me" questionnaire | name (any name you want to be called), gender, age range, country, and for those living in Korea, how many years you have lived in Korea and your city, your goal (visa, permanent residence, citizenship, everyday life), the language you study in, whether you read Korean | you fill it in in the app and can change it in your profile |
| Learning | lesson progress, answers in exercises and tasks, your conversations with Minji, the AI teacher (in lessons and in "Ask Minji"), mock exam results, words you have learned and their review dates, reminder settings | created as you study |
| Voice recordings | the audio file when you answer into the microphone, and the text recognized from it | you record it in the app |
| Counters and protection | daily spending on AI and voice-over, warnings and temporary blocks for abuse and spam | counted automatically |
| Problem reports | what you write in "Report a problem", and complaints that Minji passes on from the chat | you write them in the app |
| Subscription | once payments launch: plan, status, dates, purchase ID. We do not receive your card details: the App Store or Google Play handles them | the app store, via RevenueCat |
| Technical data | app errors (error text, device model, OS and app versions, user ID); usage events (lesson started, step completed, screen opened); IP address of requests | collected automatically |
| Support emails | email address and the content of the email | you write to us |
We do not collect your location, contacts, photos or your device's advertising ID, and we do not show ads. We do not sell data.
Why
- To run the course: show lessons, save your progress, schedule reviews.
- So that the AI teacher can reply to you, check your written and spoken answers, and address you by name and with the right grammatical gender; to recognize speech.
- To create your account, sign you in, and send you codes by email.
- To protect the service: daily spending limits, protection against abuse and spam.
- To find and fix bugs, and to understand which parts of the course work (in aggregate).
- To answer your requests and manage your subscription.
The legal basis is performing our contract with you (the Terms of Use, PIPA Art. 15(1)(iv)) and our legitimate interest in running the service safely and correctly (PIPA Art. 15(1)(vi)). We use voice recordings and the questionnaire only for the purposes listed.
In the "About me" questionnaire, only your name and gender are required. The other answers (age, country, city, years in Korea, goal) are optional: the course works without them, Minji will just know less about you. By filling them in, you consent to them being used in the same way as the required ones (PIPA Art. 15(1)(i)), including being transferred to the AI teacher.
We do not provide your data to third parties for their own purposes. The exception is cases expressly provided for by law (for example, a court request).
How long we keep data
| Data | Period |
|---|---|
| Account, questionnaire, learning data, counters, problem reports | as long as you have an account; deleted immediately when you delete the account |
| Voice recordings | 30 days from recording, then deleted automatically (earlier if you delete your account) |
| Guest account in which no lesson has been started | deleted automatically once more than 90 days have passed since both its creation and its last sign-in |
| AI cost records | after your account is deleted, kept with no link to you: only amounts and models, which cannot identify you |
| App errors (Sentry) | up to 90 days |
| Usage events (PostHog) | up to 12 months |
| Server logs | up to 7 days |
| Database backups | up to 7 days: deleted data disappears from them when this period ends |
| Support emails | as long as needed to reply, and no longer than 1 year after the last email |
If the law requires us to keep something longer (for example, purchase records under the Act on Consumer Protection in Electronic Commerce), we keep it as long as the law requires, separately and only for that purpose.
Who else processes your data
We entrust part of the work to the services below (위탁). Each one receives only what it needs for its task and works under its own data processing agreement.
| Service | What it does |
|---|---|
| Supabase (servers in Seoul, Republic of Korea) | database, sign-in, storage of voice recordings |
| OpenAI | AI teacher replies, answer checking, speech recognition |
| ElevenLabs | voice-over of ready-made Korean phrases; receives no data about you |
| Resend | emails with sign-in codes |
| Sentry | app error reports |
| PostHog (servers in the EU) | usage statistics |
| RevenueCat | subscription status (once payments launch) |
| Expo | delivery of app updates |
| Cloudflare | hosting of this website |
Transfers of data abroad
Some data leaves the Republic of Korea. The legal basis is PIPA Art. 28-8(1)(iii): the transfer is needed to perform our contract with you and is disclosed in this policy. Before your first lesson with AI, the app shows the "What the AI teacher receives" screen.
| Recipient and contact | Country | What data | Why | When and how | How long it is kept |
|---|---|---|---|---|---|
| OpenAI OpCo, LLC — [email protected] | USA | messages and answers in lessons, recordings of spoken answers, answers from the "About me" questionnaire (name, gender, age, country, city, years in Korea, goal); your email and password are not transferred | AI teacher replies, answer checking, speech recognition | every time the AI is used, over an encrypted connection (HTTPS) via the API | not used to train models; logs for abuse prevention are kept for no more than 30 days, voice recordings are not kept |
| Functional Software, Inc. (Sentry) — [email protected] | USA | user ID, error text, device model, OS and app versions; no email or name | finding and fixing bugs | when an error occurs, HTTPS | up to 90 days |
| Plus Five Five, Inc. (Resend) — [email protected] | USA | email address and the text of the email with the code | emails with codes for signing in and changing your password | when an email is sent, HTTPS | up to 30 days |
| PostHog Inc. — [email protected] | data is stored in the EU (Frankfurt, Germany); the company is in the USA | user ID, IP address, usage events (some include the goal from the "About me" questionnaire), device model and app version; no email or name | usage statistics | while the app is in use, HTTPS | up to 12 months |
| Supabase Pte. Ltd. — [email protected] | data is stored in the Republic of Korea (Seoul); the company is in Singapore | all app data | hosting of the database, sign-in and files | continuously, HTTPS | as long as you have an account (see "How long we keep data") |
| RevenueCat, Inc. — [email protected] | USA | user ID, purchase data from the store (plan, dates, status) | managing the subscription | once payments launch: at purchase and renewal, HTTPS | as long as the subscription exists and as the law requires |
| 650 Industries, Inc. (Expo) — expo.dev/contact | USA | IP address and device information when an update is downloaded | delivery of app updates | when the app starts, HTTPS | under Expo's own rules |
| Cloudflare, Inc. — [email protected] | USA | IP address and browser information of visitors to the keepupkorean.com website | serving the website | when the website is opened, HTTPS | under Cloudflare's own rules |
How to opt out, and what happens.
- OpenAI: without this transfer, the AI teacher cannot reply or check your answers, so lessons with Minji are not possible without it; the "Hangul" level works without AI. You can leave the optional questionnaire answers blank, and then they are not transferred.
- Sentry, PostHog, Resend, Supabase, RevenueCat, Expo: without them, the app does not work (sign-in, saving progress, updates, subscription) or we do not find out about failures. They cannot be turned off separately.
- Cloudflare: the website can only be opened through it.
To stop the transfers completely, delete your account in the app or email us: we will delete your data, and nothing more is transferred. What recipients keep after deletion, and for how long, is in the "How long it is kept" column.
How data is deleted
- In the app: "Profile" → "Delete account". Your voice recordings, account, questionnaire, progress, conversations and results are deleted immediately and completely. They cannot be restored. Details: How to delete your account.
- By email: write from your account's email address to [email protected]. We will delete the data within 10 days and reply. You can ask us to delete only part of it, for example voice recordings or conversations.
- Deletion erases data from the database and file storage permanently. It disappears from backups when they expire (up to 7 days).
- Error reports (Sentry, up to 90 days) and statistics events (PostHog, up to 12 months) keep the account ID with no name or email (PostHog also keeps the IP address and the events, as in the table above). After your account is deleted, they cannot be linked to you, and they disappear when their period ends. Support emails are deleted on the schedule in "How long we keep data".
- Deleting your account does not cancel your subscription: you cancel it in the App Store or Google Play.
Your rights
Under PIPA (Arts. 35–37), you can:
- find out what data about you we keep, and get a copy of it;
- correct it (you can edit the questionnaire yourself in "Profile" → "About me");
- ask us to delete it;
- ask us to stop processing it;
- withdraw your consent to the optional questionnaire answers: change them in your profile or ask us to delete them.
Write to [email protected] from your account's email address, or tell us how to find your account. We will reply within 10 days. A representative with a power of attorney can contact us on your behalf. If the law requires us to keep some data, we will explain which data and why.
We use AI answer checking only for learning: scores in exercises and mock exams do not affect your rights. You can ask us how it works.
How we protect your data
- All connections are encrypted (HTTPS).
- Each student sees only their own data: the database itself enforces this (row-level security rules).
- Passwords are stored only as hashes; the services' secret keys exist only on the server, not in the app.
- Only the operator has access to student data, and only to run the service and provide support.
- Voice recordings are kept in private storage.
Automatic collection
The app does not use cookies. For statistics, it stores a random PostHog ID on your device; the ID is reset when you sign out. The keepupkorean.com website sets no cookies and collects no statistics.
Age
KeepUp is for people aged 14 and over. If we learn that an account is used by someone under 14, we will delete the account and its data.
Changes to this policy
We will announce a new version in the app or on the website at least 7 days before it takes effect, or 30 days before if the changes make your position worse. Previous versions are available on request.
Where else you can complain
If you believe your rights have been violated, besides us you can contact:
- Personal Information Dispute Mediation Committee (개인정보분쟁조정위원회): 1833-6972, kopico.go.kr
- Personal Information Infringement Report Center (개인정보침해신고센터, KISA): 118, privacy.kisa.or.kr
- Police, cybercrime reporting system (경찰청 사이버범죄 신고시스템, ECRM): 182, ecrm.police.go.kr
Version of 27 October 2026, in effect from 27 October 2026. The Russian, English and Korean texts have the same meaning; if they differ, the Korean version prevails.