Privacy at Koreloom

Last updated: October 9, 2026

Koreloom is operated by Hyukjae Choi. This policy describes the iPhone app, optional voice-sharing design, support email and these web pages. Contact inverselab.support+koreloom@gmail.com with privacy questions.

Current AI availability: AI feedback is optional and subject to service limits. It may be temporarily unavailable when service limits are reached or the service is paused. The sections below explain optional voice sharing when feedback is available.

Learning data on your iPhone

The app stores phrase history, recall progress, practice dates, streaks, Hangul completion and preferences on your iPhone. If you complete an AI-assisted practice when the service is available, recognized words, feedback and a transcript-match score can also be saved with your local learning record.

No app account is required. Koreloom does not implement its own iCloud progress synchronization, location collection, advertising, analytics SDK or tracking. Apple device backups are separate from app synchronization and depend on your device settings.

Recordings and local playback

Microphone permission is requested when you choose to record. A temporary M4A file is used for playback on your iPhone. Local playback does not upload it, and the audio file is not saved in your phrase history.

The app attempts to remove the current temporary recording when you record again or finish/leave a practice session. File-removal failures or an interrupted session can leave a temporary file until later cleanup by the app or iOS. This is not a guarantee of immediate or secure deletion. Korean lesson audio is generated using Apple's speech synthesis.

Optional AI sharing

If AI feedback is enabled, you must first allow voice sharing and then request feedback. Your current recording is sent through a Cloudflare relay to OpenAI for Korean speech recognition. The recognized text returns to your iPhone; that text and the target phrase are then sent through the relay to OpenAI to produce English feedback and suggested alternatives.

The purpose is to compare recognized words with the target phrase, not to measure accent or individual sounds. The app does not upload your full learning history for this request. You can complete daily practice without recording or AI.

Device verification and relay records

When the AI service is available, Apple's App Attest is used to verify the app/device. The app keeps an App Attest key identifier locally. The relay retains the key identifier, public key, assertion counter and last-seen timestamp, together with per-key request counts for service limits and abuse prevention. It also holds short-lived challenge/upload records, request paths, payload hashes and lengths. These are pseudonymous device-linked records; an app account is not required for them to be linked to a device key.

The relay does not write audio or transcripts to its persistent gate storage. Challenges and upload grants become unusable after two minutes. Device-verification keys become eligible for removal after 90 days without activity. Expired challenge/grant rows, inactive keys and prior-day usage are cleaned up when a subsequent enabled request is processed. This is request-driven cleanup, not a guaranteed deletion deadline.

Cloudflare and OpenAI processing

Cloudflare processes the relay traffic and may process IP addresses, routing and other connection information under its privacy policy. The relay's own database does not store IP addresses. Cloudflare's retention varies by the processing purpose and applicable obligations; no fixed platform retention or zero-log promise is made here.

OpenAI's current API data-control documentation distinguishes endpoints: its audio-transcription endpoint lists no abuse-monitoring or application-state retention; its chat-completions endpoint lists default abuse-monitoring retention of up to 30 days, with longer retention possible for legal requirements or protection from harm. Feedback requests use chat completions with store:false, which does not remove default abuse-monitoring retention. Prompt-caching and other documented exceptions may apply.

These are the provider's published defaults, not a claim about a provisioned Koreloom account. No account-specific Zero Data Retention or Modified Abuse Monitoring arrangement is claimed. This page will be updated if provider policies or configured data handling change. Processing may take place outside your country; no country-specific processing location is promised.

Purchases and reminders

Apple handles subscription purchases, payments and management. Koreloom checks verified StoreKit transactions on your iPhone to determine Premium access; it does not receive payment-card details or send transaction history to its relay. Subscription terms, prices and any eligible introductory offer are shown before purchase. See support for trial, renewal, restore and cancellation information.

Optional daily reminders use local notifications after permission is granted. Reminder preferences are stored on your iPhone.

Your choices and deletion limits

In Settings, change romanization, turn off reminders or withdraw AI voice-sharing consent. You can also revoke microphone or notification permission in iPhone Settings.
Reset learning progress deletes local phrase history, saved recognized words/feedback, recall progress, Hangul completion and milestones. It does not cancel a subscription, reset consent/reminder preferences, remove the App Attest key identifier or delete separate relay/provider records.
Withdrawing consent prevents new permitted requests and cancels current analysis. It cannot undo a payload already transmitted, provider processing already completed or a service-limit reservation.

You may email the operator to ask about your information or request correction/deletion. Details may be needed to identify relevant records. The app has no automated server-record deletion feature, and resetting local progress should not be treated as deletion of previously shared information. This policy does not promise deletion outside the operator's control or a fixed response/deletion time.

Support email and this website

If you email support, your sender address, message and any attachments are used to respond to and investigate the request. Correspondence is held in the support mailbox; no automatic deletion schedule is specified. Avoid including private recordings or sensitive information unless necessary. Opening the email link uses your email app; Koreloom does not automatically attach logs, recordings or learning history.

These pages are static and contain no analytics script, form, tracking pixel or third-party font. When hosted on GitHub Pages, GitHub may process connection and website-usage information under its privacy statement. Following external links is subject to the linked service's policies.

Changes and contact

Changes to this policy will appear here with an updated date. For support or privacy questions, contact Hyukjae Choi at inverselab.support+koreloom@gmail.com.