Privacy Policy and Terms of Service are provided in English only.
1. Scope and controller
This Privacy Policy explains how Orvoca processes personal information for the Orvoca web console, Chrome extension, mobile app, APIs, optional rewarded ads, customer support, email, and notification services. Applicable rights and duties under the Personal Information Protection Act of Korea and other mandatory privacy laws remain in force.
Service operator (controller): 티엠세오.
Personal Information Protection Officer: 서예은 (Representative).
Privacy requests, complaints, and general support: tmseo4800@gmail.com.
2. Personal information we process
Orvoca processes the following information only as needed to provide the Service.
- Account information — email address, display name or nickname, authentication provider, Firebase authentication identifier, email verification status, and session tokens stored on your device.
- Signup consent record — the accepted Terms and Privacy Policy versions, confirmation that you meet the stated minimum age, authentication provider, signup surface, and consent timestamp. Orvoca does not collect a date of birth through this confirmation.
- Subscription and purchase disclosure data — where Pro is offered, a billing UUID linked to your Orvoca account, store and product identifiers, purchase and entitlement status, transaction references, subscription periods, prices, currency, trial eligibility, and purchase-condition acknowledgement with the policy version, displayed offer, age or guardian-consent confirmation and timestamp. The store handles payment-card details. A billing UUID is linked account data, not anonymous data.
- Vocabulary and capture data — words, phrases, normalized forms, language guesses, optional surrounding sentence context, the source page URL for a word encountered again, review state, review results, deletion state, and timestamps.
- Extension data — allowed host settings, capture trigger settings, selected text or phrase, optional sentence context, local retry queue metadata, and the active page URL or hostname needed to verify the site you enabled.
- Device and notification data — push subscription endpoint, p256dh key, push auth key, FCM token, device type, app-generated device id, notification settings, timezone, quiet hours, and notification open events.
- Email and marketing preference data — email address, email delivery logs, unsubscribe status, lifecycle email settings, and marketing email or push preference.
- Service usage and attribution data — product events such as first capture or first review, last active timestamp, UTM source, UTM medium, UTM campaign, referral code, referring user id if applicable, analytics identifiers, browser or device metadata, IP address, app version, surface, and aggregated marketing events.
- Support and error report data — error code, endpoint, product view, optional memo submitted by you, diagnostic metadata, and related email records.
- Advertising data (mobile app) — where you choose to watch a rewarded ad, Google AdMob may process a device advertising identifier where the platform and your consent settings make it available, plus device and network information, coarse location derived from IP address, and ad interaction events. Orvoca additionally stores an account-scoped claim identifier, claim status, KST date, and reward counters to grant each reward once and enforce the daily limit.
3. Information we do not intentionally collect
- Full browsing history or full page content.
- Keystrokes or clipboard contents beyond a word, phrase, or short context that you explicitly capture or allow through enabled capture triggers.
- Precise location data, payment card numbers, bank account details, or government IDs.
- Orvoca does not directly read or store IDFA, and the current iOS app does not request App Tracking Transparency permission. AdMob may process an advertising identifier where available under the platform and consent settings, as described in Sections 2 and 6.
- Data from websites where you have not granted extension host permission.
4. Purposes of processing
- Creating, verifying, securing, and maintaining your account.
- Saving, syncing, reviewing, restoring, and deleting vocabulary records.
- Detecting language, normalizing words, and enriching approved vocabulary.
- Operating extension capture, local retry, and allowed-site controls.
- Sending transactional emails, service notices, review reminders, and opt-in updates.
- Providing push notifications only where permission and settings allow it.
- Handling support requests, error reports, abuse prevention, and service reliability.
- Measuring product usage, acquisition, activation, funnel performance, and retention where separate optional analytics consent permits it. Declining analytics does not prevent account use or a subscription purchase.
- Delivering optional rewarded ads that you choose to watch, granting the resulting allowance, preventing reward abuse, and honoring your advertising consent choices.
- Verifying purchases, providing and restoring Pro access, handling cancellations, refunds and disputes, and retaining legally required transaction records.
- Complying with legal obligations and enforcing the Terms of Service.
Orvoca does not sell personal information. Rewarded ads served through Google AdMob are the only advertising in the Service; where required, Orvoca asks for your consent through Google's User Messaging Platform before an ad request is permitted, and you can reopen the available advertising privacy options from the Inbox reward card in the app.
5. Chrome extension permissions
The Orvoca Chrome extension requests these permissions:
- contextMenus — to add a capture option to the right-click menu.
- storage — to store your token, settings, allowed hosts, and pending capture queue locally.
- alarms — to retry pending captures when network or login state recovers.
- activeTab — to identify the current tab when you allow capture on a site.
- scripting — to register bundled content scripts on allowed sites and show a small success or error toast.
- Optional capture-site access — requested only for websites you explicitly enable.
- Required service hosts — limited to the Orvoca API and web app for account pairing and sync, plus the PostHog endpoint when production analytics is enabled.
The extension does not load remotely hosted code. It sends only the selected word or phrase, optional sentence context, the active page URL for source history, and limited sync metadata to the Orvoca API.
6. Service providers and international transfer
The list below identifies recipients, their service locations and the data used for each purpose. Transfers take place over encrypted network connections when the relevant feature is used; infrastructure storage continues while its records are retained. Contract-required processing or storage may rely on Article 28-8(1)3 of the Korean Personal Information Protection Act only where its requirements are met. Optional analytics and advertising require their own applicable legal basis and choices; accepting a subscription is not blanket consent to those purposes. A provider’s corporate address and the actual storage country are distinct. To request information, object to a transfer or withdraw optional consent, contact tmseo4800@gmail.com. Refusing essential account or subscription processing can prevent the corresponding feature; refusing optional analytics or ads does not prevent basic learning or Pro access. Statutory records cannot be erased before their required retention period ends.
- Neon (a Databricks service) (United States provider; primary database storage in Singapore, AWS ap-southeast-1) — the production database. Data transferred: account id, vocabulary and capture records, review history, settings, sync events, push subscription records, email logs, error reports, billing identifiers, subscription status and purchase-condition records. Retention follows Section 7. The production point-in-time recovery history is configured for six hours. Separately retained data branches do not automatically expire with that history window; other backup or support copies follow the applicable infrastructure contract and controls. Delegated purpose: primary database storage for the Service. Privacy policy: neon.com/privacy-policy. Recipient privacy contact: privacy@databricks.com.
- RevenueCat, Inc. — subscription verification and management when Pro is available. Recipient contact: compliance@revenuecat.com. Its published DPA lists US infrastructure subprocessors and AB180 Co., Ltd. in Korea for Korean customers. Data includes the account-linked billing UUID, store purchase history and references, product, entitlement, trial, expiry and device/app metadata. Processing occurs at billing SDK connection, purchase, restore and entitlement sync; purposes include subscription functionality and RevenueCat purchase analytics. Orvoca does not send your email or Firebase UID as a PostHog subscriber attribute. RevenueCat’s published DPA retains customer personal data until termination or expiry of its service agreement; a return or destruction request at agreement termination must be made within 30 days and is subject to its backup and archive exceptions. Individual customer deletion and Orvoca’s statutory record periods are separate, as described in Section 7. The applicable subprocessor scope depends on the services used under that contract. RevenueCat DPA and subprocessor list.
- Cloudflare, Inc. (United States; traffic is processed across Cloudflare's global network, and the legacy D1 database is hosted in Cloudflare's Asia-Pacific region) — API and web hosting, security, traffic delivery, and the legacy D1 database retained as a rollback snapshot during the database migration. Data transferred: the same categories listed above for the database, plus request metadata. Delegated purpose: infrastructure hosting, database storage, and security/traffic delivery. Privacy policy: cloudflare.com/privacypolicy.
- Google LLC — Firebase Authentication (United States). Data transferred: email address, authentication identifier, session tokens, and sign-in provider metadata (Google sign-in, Apple sign-in). Delegated purpose: authentication, session issuance, password reset, and email verification. Privacy policy: policies.google.com/privacy.
- Resend (United States) — transactional and opt-in lifecycle email delivery and, where used, incoming support email processing. Data transferred: email address, message content and headers, delivery identifiers, bounce or complaint data, and unsubscribe headers. Customer data is stored in the United States; the configured Tokyo sending region controls email routing, not the storage country. Resend publishes 30-day email and log retention for Free, Pro and Scale plans, configurable retention for Enterprise, seven-day backup retention, and deletion of remaining customer data within 90 days after termination of the Resend service account. These termination periods do not mean that an individual Orvoca account deletion closes the Resend account. Earlier individual message deletion requires a provider request. Delegated purpose: sending, receiving and tracking delivery of account, support and opt-in marketing emails. Resend storage and deletion conditions. Privacy policy: resend.com/legal/privacy-policy. Recipient contact: support@resend.com.
- PostHog, Inc. (United States — US cloud region, us.i.posthog.com) — production product analytics. Data transferred: account analytics identifier, email address used for product analytics identification, product events, event properties, browser or device metadata, IP address, app version, and surface. Delegated purpose: attribution, funnel, and retention measurement. Orvoca disables PostHog session recording and automatic interaction autocapture, and does not intentionally send vocabulary content or captured text to PostHog. PostHog publishes product-event query windows of one year on free plans and seven years on paid plans; a query window is not an assurance of data deletion. Earlier erasure requires explicit deletion of the relevant person and events, rather than only removing the Orvoca account. These product-event conditions are separate from session-recording retention. PostHog event retention. Privacy policy: posthog.com/privacy. Recipient privacy contact: privacy@posthog.com.
- Functional Software, Inc. dba Sentry (United States provider; storage country depends on the organization region) — application error monitoring. Data transferred: error stack traces and diagnostic metadata, limited where practical. Delegated purpose: error monitoring and service reliability. Sentry's published plan guidance lists error-event retention of 30 days on Free plans, 90 days on Team and Business plans, and custom periods on Enterprise plans. Backup retention is 30 or 90 days depending on the data type. Individual deletion and provider backups are separate. Privacy policy: sentry.io/privacy. Recipient privacy contact: compliance@sentry.io.
- Push platform providers — Google LLC (Firebase Cloud Messaging), Apple Inc. (Apple Push Notification service), and Mozilla (push service), all United States. Data transferred: push subscription endpoint, p256dh and auth keys, and device tokens. Delegated purpose: delivering push notifications. Privacy policies: policies.google.com/privacy, apple.com/legal/privacy, mozilla.org/privacy.
- AI definition providers — Google LLC, Gemini API (United States). Data transferred: the word, phrase, or sentence you look up, the source and target definition language, and, where provided, the surrounding sentence context or other vocabulary text needed to generate suggestions. Delegated purpose: generating AI-assisted definitions and lexical enrichment. Orvoca does not send your account id to this provider. Privacy policy: policies.google.com/privacy.
- Google LLC — Google AdMob and the User Messaging Platform (United States), used only in the mobile app and only for optional rewarded ads you choose to watch. Depending on platform availability and your consent settings, data processed by Google may include a device advertising identifier, device and network information, IP address and the coarse location derived from it, ad requests, impressions, rewards, and your consent choice. Purpose: serving and measuring rewarded ads, and recording advertising consent under Google’s applicable terms and your consent choices. For server-verified rewards, Orvoca sends a random proof identifier that its server can link to your account and reward claim. It does not send vocabulary content, captured text or your email to AdMob. Privacy policy: policies.google.com/technologies/ads.
- Dictionary and translation providers — FreeDictionary, Wiktionary, Jisho, and MyMemory may receive the word or phrase and language pair required for definition lookup. Orvoca does not send your account id to these providers for lookup.
7. Retention and deletion
- Account, signup consent, vocabulary, capture, review, settings, sync, push, attribution, and email preference records are retained while your account is active.
- Email logs, security logs, support records, and error reports are retained only as long as needed for delivery evidence, abuse prevention, dispute handling, and service reliability, unless a longer period is required by law.
- Local extension queue data remains on your device until synced, deleted, or the extension storage is cleared.
- Deleting the Orvoca account does not automatically erase all provider-held copies. PostHog analytics identifiers, Resend email records and Sentry diagnostic identifiers may remain identifiable until the provider deletes or de-identifies them. Retention depends on the applicable settings and contract, including limited backup exceptions. You may request earlier deletion of these provider-held records by emailing tmseo4800@gmail.com.
- Account deletion removes the account-linked records from Orvoca’s live database, subject to records that must be retained by law. Separately retained recovery copies, including database backups and migration rollback snapshots, are not immediately erased by this live-database deletion. Orvoca’s encrypted logical-backup artifacts are configured to expire after 14 days. Neon point-in-time recovery history is configured for six hours; separately retained data branches and legacy rollback snapshots do not automatically expire with that history window and require separate removal. Other provider recovery copies follow the applicable infrastructure retention settings. These copies are restricted to recovery purposes. Contact Orvoca for the scope and applicable expiry of a retained copy. Any additional legally justified dispute or security hold is limited to necessary records for a documented duration.
- Where Korean electronic-commerce record duties apply: contract and withdrawal records, and payment and supply records, are retained for five years; consumer complaints and dispute records for three years; and advertising representations for six months. General product feedback is not automatically classified as a consumer dispute. The relevant record date or documented contract end determines the retention period. Purchase attempts that have not been linked to a verified subscription are retained for up to 30 days and removed on account deletion. Linked purchase acknowledgements are retained with contract records for five years from the recorded contract end; later verified extensions update that end date.
- Records that must be retained by law are moved to separate, access-controlled storage, used only for the applicable statutory purpose, and destroyed when the retention period ends.
- Account deletion does not cancel your store subscription. Cancel through Apple or Google separately. RevenueCat customer deletion does not prove immediate destruction of every provider backup or legally required store transaction record.
You can delete your account from Settings or request deletion by emailing tmseo4800@gmail.com.
8. Your rights
You may request access, correction, deletion, suspension of processing, withdrawal of consent, and explanation of processing by contacting Orvoca. You may also update or delete many records directly in the Service. Orvoca may verify your identity before processing a request. If retention is legally required, we will explain the record category, legal basis and period rather than promise immediate deletion. You may request access to or a copy of your retained transaction and dispute records through this same contact.
You can also request deletion of specific vocabulary, support or analytics records without closing your account. Delete individual vocabulary records in the Service, or email the contact above with the account email and the record category you want deleted. Do not send your password or full payment-card details. We will verify account ownership and explain any legally required retention or remaining recovery copies.
9. Marketing communications
Orvoca sends marketing email or marketing push notifications only where you have opted in or where applicable law allows the message. You may opt out at any time through settings, an unsubscribe link, or by contacting Orvoca. Transactional messages such as verification, password reset, security, and account deletion notices may still be sent where necessary.
10. Security measures
Orvoca uses HTTPS in transit, provider-managed access control, database access restrictions, authentication checks, input validation, rate limiting, push endpoint allowlists, and operational monitoring. No online service can guarantee perfect security.
12. Children
Orvoca is not directed to children under 14 in Korea or under 13 in other jurisdictions. Orvoca does not knowingly collect personal information from children in those age groups.
13. Changes to this Policy
Orvoca may update this Policy as the Service, law, or providers change. Material changes will be announced through the Service, website, or email where appropriate. An updated policy is not consent to a new optional processing purpose. Where required, that consent is requested separately before the processing starts.
14. Contact
Questions, privacy requests, or complaints may be sent to tmseo4800@gmail.com.