Tadak Privacy Policy

At a glance

Tadak processes account data, nicknames, typing practice records, text you write, reports and feedback, and purchase- and ad-related information to the extent needed to operate the service.
Your real name and profile photo from social sign-in (Google, Apple, Kakao) are not stored in your service profile; the app only uses the nickname you choose. However, the name and photo URL that Google or Kakao send at sign-in may be kept in the login record of our authentication system (Supabase Auth) (see 1-1).
When you use AI Writing, the topic and situation description you select or enter are sent to OpenAI to generate practice text. Under OpenAI's API data policy, API data is not used to train models unless data sharing is explicitly opted into.
Public community posts are checked for harmful content through OpenAI, and we process information needed for push notifications and restoring friend challenge invites after installation.
We use Supabase (servers and data storage), Firebase Analytics, Crashlytics and Cloud Messaging (usage analytics, crash reporting and push notifications), Google AdMob (ads), Apple App Store and Google Play (payments), and OpenAI (AI text generation and community content safety checks).
When you delete your account, data tied to your account such as your profile, records, and posts is deleted. Some operational and payment logs may remain with identifiers removed.

1. Personal Information We Process

Tadak does not use a separate sign-up form. The information below is collected through social sign-in, through your use of the app, and from what you enter directly.

1-1. Account and login information

Internal user identifier (UUID), guest status, login status
Social sign-in provider information: provider name (Google, Apple, Kakao), provider user identifier, email address (if provided)
List of linked sign-in methods and the most recent sign-in provider

Information not stored in your service profile: Your real name and profile photo, which a provider may send during social sign-in, are not stored in Tadak's service data (your profile). Sign in with Apple on iOS does not request your name. However, when Google or Kakao include your name and photo URL in the authentication token, this information (name, profile photo URL) is kept in the login record of our authentication system (Supabase Auth). It is not used for any service feature such as app screens, rankings, or the community, and it is deleted when you delete your account.

1-2. Profile and app settings

Nickname, nickname tag, preferred theme, font, font size, language setting

1-3. Typing practice and learning records

Practice records (typing speed, accuracy, practice time, keyboard type, content practiced), ranking scores, practice streaks, mission and achievement history, transcription (e.g., Bible) progress
Weak-spot summary (frequently missed letter, final consonant, and spacing patterns and their error rates). Weak-spot analysis is calculated on your device, and only summary figures are sent to our server.

1-4. User content

Title, body, author name, language, and visibility of text you write
Text created with AI Writing (title, body) and whether it was saved
Posts published to the shared space ("Everyone's Space"), public/hidden status, quality score, report count, moderation notes, AI safety verdict (OK, review or block), category scores, and check time
Likes, imports, sharing history, and your list of hidden/blocked authors

1-5. AI Writing input

A topic chosen from suggestions or a topic you enter yourself
"My real-life text" input: your relationship with the recipient, tone, length, situation description, (messenger) how you address the other person or their name (optional), (email) recipient's name and title (optional), purpose
"Weak-spot practice text" input: the weak-spot summary calculated on your device (type, error rate, sample size, example words). The sentences you actually typed are not sent.
We do not store the original input on our server. We only store a hash (a value transformed so the original cannot be recovered) to detect duplicate requests.
Input in contact-information formats, such as phone numbers, email addresses, and links, is not accepted. Please do not include real personal information (real names, contact details, addresses, etc.) in situation descriptions.

1-6. Reports and feedback

Post reports: reporter identifier, reported post identifier, reason, time of report
User reports: reporter and reported user identifiers, related post identifier, reason, time of report, snapshot of the reported content
In-app feedback and bug reports: content, category, submission path, platform, app version, submission time, user identifier (if signed in)

1-7. Purchases and passes

Product IDs for Remove Ads, Tadak Plus (subscription), and AI generation passes; transaction identifiers; purchase/restore/renewal/refund status; store error codes
History of generation passes (tickets) granted, used, and expired, including passes granted for watching rewarded ads
Payment methods (such as card numbers) are handled by Apple and Google; Tadak does not receive them.

1-8. Ads and advertising identifiers

Ad impression, click, and reward events; ad placement information
Rewarded ad verification (SSV): only a single-use token issued by our server is included in the ad network's callback; your user ID and posts are not included.
Whether the iOS App Tracking Transparency (ATT) explainer was shown and whether you allowed or denied tracking
Advertising identifiers: on iOS, the IDFA is used by Google AdMob for personalized ads and ad measurement only if you allow it in ATT. On Android, the Advertising ID is used by Google AdMob to serve and measure ads, subject to your device's ad settings (deleting or resetting the Advertising ID).
Google AdMob may process approximate location inferred from your IP address and device and performance information to serve ads.

1-9. Usage analytics and crash information

Firebase Analytics and Supabase event records: app launches, sessions, practice start/finish, feature use, experiment exposure, ad and purchase events
Per-install anonymous ID (anonymous_id), user ID, session ID, platform, app version
Firebase Crashlytics crash reports: error details, device model, OS version, app state information, and a hash of your user ID (a value transformed so the original cannot be recovered)

1-10. Push notifications

Device push token (a Firebase Cloud Messaging token used to deliver notifications through FCM/APNs), user identifier, platform (iOS/Android), app version, app language (locale), notification enabled state, and token registration/update time
Your "Reactions to my writing" preference, summaries of practices, likes and imports on public posts, and notification dispatch records (date, dispatch processing and completion times)

1-11. Friend challenge invite restoration

If you open a friend challenge link before installing the app, we temporarily store an invite record identifier, challenge code, creation and claim times, a salted hash of your IP address, screen width and height, device pixel ratio, time zone, language, platform (iOS/Android), and OS major version (when available) to restore the challenge after installation. This invite record does not store your raw IP address, raw user agent, or a unique device identifier.

2. Purposes of Use

Identifying members, keeping you signed in, converting guest/social accounts, and linking accounts
Saving typing practice records and providing rankings, missions, achievements, and transcription records
Keeping your personal posts and handling public/private status in the shared space
AI Writing: generating the practice text you request and checking inputs and outputs for harmful content
AI safety checks on public community posts, automatically hiding clearly harmful posts, queuing borderline cases for human review, weighting reports based on account creation time, previous report outcomes and reporting activity, hiding/blocking, reviewing enforcement, and preventing policy violations
Sending push notifications: at 20:00 Korea Standard Time (KST) each day, eligible users receive at most one "Reactions to my writing" digest of practices, likes and imports on their public posts over the previous 24 hours. You can turn this digest off in Settings under "Reactions to my writing" or turn app notifications off in your OS notification settings.
Restoring friend challenge links after app installation and preventing duplicate restoration and misuse of invites.
Reviewing feedback, responding to errors, and providing customer support
Serving ads, granting rewarded-ad rewards, and processing purchases, subscriptions, restores, and refunds
Analyzing service usage and improving quality (Firebase Analytics data is not linked to Google Ads and is used only to improve the app)
Security, fraud prevention, legal compliance, and dispute resolution

3. Retention and Destruction

3-1. Retention periods

Account, profile, practice records, posts, AI-created text, public posts, likes/imports, and hide/block data are kept while your account exists and deleted when you delete your account.
Community safety results (verdict, category scores and check time) are kept with the post and deleted when that post is deleted.
Push tokens and notification dispatch records are deleted when you delete your account. When app notifications are disabled, the token is retained in a disabled state and is not used for delivery. Turning off only "Reactions to my writing" stops only that digest.
A friend challenge invite can be restored once within 60 minutes of creation. Invite records older than 24 hours are deleted when a new invite record or restoration request is processed.
We do not store the original AI Writing input on our server. See Section 4 for OpenAI's retention.
Post reports are deleted when you delete your account. User reports may remain with reporter and reported-user identifiers removed, to preserve moderation history.
Feedback and analytics, ad, and payment event logs are kept with account identifiers removed or partially masked, for service improvement, fraud prevention, and payment support, for 1 year from collection and then destroyed. Payment-related records that must be kept by law follow the periods below.
Purchase, subscription, and refund records are kept under the Korean Act on the Consumer Protection in Electronic Commerce for the following periods: records of contracts or withdrawal of offers, 5 years; records of payment and supply of goods, 5 years; records of consumer complaints or dispute resolution, 3 years.
Text you enter in feedback or report reasons may be kept exactly as submitted, so please do not include sensitive information.

3-2. Destruction procedure and method

Personal information whose retention period has ended or whose purpose has been fulfilled is destroyed without delay. Information that must be kept under applicable laws is stored separately from other data for the required period and then destroyed.
Information in electronic form is deleted in a way that cannot be recovered. We do not process personal information in paper form.

4. Outsourcing and International Transfers

Tadak does not provide personal information to third parties except where permitted by law or with your consent. To operate the service, we entrust the processing of personal information to the companies below, and in this process your information may be processed outside the Republic of Korea (mainly in the United States). This international transfer is based on Article 28-8(1)(3) of the Korean Personal Information Protection Act (outsourcing or storage necessary to perform our service contract with you, disclosed in this policy). Information is transmitted over an encrypted channel (HTTPS) at the time you use the service.

We review each recipient's data processing terms and privacy policies so that your personal information receives protection equal to or greater than that described in this policy.

Supabase, Inc.

Entrusted tasks: authentication, database and server operations
Information transferred: account, profile, records, content, purchase, and log information described in Section 1, community safety results, push notification information, and friend challenge invite restoration information
Country of processing: Republic of Korea (data stored in the Asia Pacific (Seoul) region)
Retention: per Section 3
Contact: privacy@supabase.com

OpenAI, L.L.C.

Entrusted tasks: generating AI practice text; checking inputs, outputs and public community posts for harmful content (moderation and classification)
Information transferred: AI Writing input (Section 1-5), generated text, and the title, body, author name and posting nickname of public community posts. User ID and email are not sent as separate fields.
Country of processing: United States
Retention: see "About our use of OpenAI" below
Contact: privacy@openai.com

Google LLC (Firebase Analytics, Firebase Crashlytics, Firebase Cloud Messaging)

Entrusted tasks: usage analytics, crash reporting, push notification delivery
Information transferred: information in Section 1-9, device push tokens and notification content (including public post titles and reaction summaries)
Country of processing: United States
Retention: Firebase Analytics data is kept for 14 months from collection and then deleted; Crashlytics crash reports and Cloud Messaging retention follow Google's policy.
Contact: Google privacy inquiries

Google LLC (AdMob)

Entrusted tasks: serving and measuring ads, verifying rewarded ads
Information transferred: advertising identifier (if allowed in ATT), device information, approximate IP-based location, ad events
Country of processing: United States
Retention: per Google's policy
Contact: Google privacy inquiries

Google LLC, Apple Inc., Kakao Corp. (social sign-in)

Entrusted tasks: social sign-in authentication
Information transferred: sign-in request information
Country of processing: United States (Google, Apple), Republic of Korea (Kakao)
Retention: per each company's policy
Contact: Google privacy inquiries, Apple privacy inquiries, Kakao Privacy

Apple Inc., Google LLC (App Store, Google Play)

Entrusted tasks: payments, subscriptions, refunds
Information transferred: purchase and transaction information
Country of processing: United States
Retention: per each company's policy
Contact: Apple privacy inquiries, Google privacy inquiries

If you do not want your information transferred abroad, you can choose not to use the relevant features (AI Writing, public community sharing, push notifications, social sign-in, in-app purchases, etc.) or request account deletion. In that case, those features will not be available. Transfers related to usage analytics, crash reporting, and ads happen by default while you use the app, so if you do not want them, please stop using and delete the app. You can refuse personalized ads through ATT on iOS or your Advertising ID settings on Android; non-personalized ads may still be shown.

About our use of OpenAI

The topic you choose in AI Writing or the situation description you enter (including relationship, tone, length, and any optional form of address or recipient name) and your weak-spot summary are sent to the OpenAI API to create practice text.
AI Writing inputs and generated text are checked for harmful content with the OpenAI Moderation API. If a threshold is exceeded, the text is not generated or not shown.
The title, body, author name and posting nickname of public community posts are sent to the OpenAI Moderation API and classification API for safety checks. Clearly harmful posts are automatically hidden, and borderline cases are queued for human review. Verdicts and category scores are stored with the post.
AI Writing requests do not send user ID, email or nickname as separate fields. Community checks include the public post information described above.
Under OpenAI's API data policy, data sent through the API is not used to train OpenAI models unless data sharing is explicitly opted into.
AI text generation requests turn response storage off (store: false). Under OpenAI's policy, the Moderation API does not retain inputs or outputs; abuse monitoring logs for text generation and classification APIs may be retained for up to 30 days by default. Longer retention may apply where legally required or necessary to protect services or third parties from harm.
The daily "Today's Text" and shared suggested topics are shared content that our server creates with OpenAI without any user information.

5. Advertising Identifiers and ATT

The Tadak app does not use web cookies. Instead, app identifiers such as the advertising identifier and per-install anonymous ID described above may be used for ads and analytics.
On iOS, we may show an explainer screen before requesting App Tracking Transparency (ATT) permission, and we record whether it was shown and whether you allowed or denied tracking.
If you allow ATT, Google AdMob uses the advertising identifier (IDFA) for personalized ads and ad performance measurement. This counts as "tracking" under Apple's definition.
If you deny ATT, ads may still be shown, but without the advertising identifier. You can change this at any time in iOS Settings > Privacy & Security > Tracking. On Android, you can delete or reset your advertising ID in your device's Settings > Privacy (or Google) > Ads.
Firebase Analytics data is not linked to Google Ads and is not used for advertising.
If you purchase Remove Ads or use Tadak Plus, ads in the app may be limited.

6. Account Deletion and Exceptions

In-app path: Profile > Account Management > Delete
Deleted data: data directly tied to your account, including profile, practice records, posts, AI-created text, public posts in the shared space and their safety results, likes, imports, post report history, hide/block data, push tokens, writing reaction digest preferences and dispatch records, and login records in the authentication system
After deletion, analytics, feedback, ad, and payment operational logs, ATT/review events, user report moderation records, and app store purchase history may remain in anonymized form or separated from your account for the retention periods in Section 3 (operational logs: 1 year from collection; payment records: statutory periods) and are then destroyed.
Closing or unlinking your account with an external sign-in provider (Google, Apple, Kakao) must be done separately in that provider's settings.

7. Your Rights and How to Exercise Them

You may request access to, correction, deletion, or suspension of processing of your personal information, and withdraw your consent, at any time.
You can change your nickname and delete your account directly in the app.
For other requests, contact us at the email below and we will handle them without delay. Requests may also be made through a legal representative or an authorized agent.
See the Account Deletion page for what is deleted and the Community Policy for moderation standards.

8. Security Measures

We apply access control (row-level access policies), authentication management, encryption in transit (HTTPS), and review of operational logs.
Operational tasks such as reports and sanctions, feedback handling, and account deletion are accessed only to the extent necessary.
AI Writing input goes through contact-format blocking and harmful content checks, and the original input is not kept on our server.

9. Children's Personal Information

Tadak does not separately collect personal information targeting children under 14.
If we learn that personal information of a child under 14 was collected without the consent of a legal guardian, we will delete it without delay. A legal guardian may request access or deletion at the email below.

10. Policy Changes

If service features, collected items, processors, external integrations, or retention rules change, we will announce the changes in the app or on this page at least 7 days before they take effect.
This policy was announced on October 18, 2026 and takes effect on October 25, 2026.
Previous policy effective dates: October 6, 2026 and March 6, 2026. See the revision history below.

11. Privacy Officer and Contact

Chief Privacy Officer: Jeong Dongcheon (Representative, OMILSOFT)
Email: omilsoft@gmail.com
Email inquiries are reviewed and answered in the order received on business days.

For reports or consultation about privacy violations, you may contact the following Korean authorities.

Personal Information Infringement Report Center: privacy.kisa.or.kr, 118 (no area code)
Personal Information Dispute Mediation Committee: kopico.go.kr, 1833-6972
Supreme Prosecutors' Office: spo.go.kr, 1301 (no area code)
Korean National Police Agency: ecrm.police.go.kr, 182 (no area code)

If the Korean and English versions differ, the Korean version prevails.

12. Revision history

2026-10-25: Clarified community AI safety transfers, stored verdicts, automatic hiding, human review, weighted reports and OpenAI data policy.
2026-10-25: Added push token and writing reaction digest data, delivery time, opt-out, retention and deletion rules, and Firebase Cloud Messaging processing.
2026-10-25: Added friend challenge restoration fields, the 60-minute claim window and cleanup of invite records older than 24 hours.

Previous version: 2026-10-06 effective