Privacy, in plain language.

Who to contact

BEAUTYKANG (뷰티강), a sole trader (개인사업자), operates Haru Korean.

Legal representative: 강범희
Business registration number: 525-08-01159
Business address: Room 318, 755 Taejang-ro, Gimpo-si, Republic of Korea
김포시 태장로 755 318호

For privacy questions or requests to access, correct, export, or delete your account information, email kbhjjan100@gmail.com from your account email where possible. We may ask for proportionate verification before acting on an account request. Do not email your password, full card number, or a microphone recording.

Learning without an account

You can read the free lessons without creating an account. When you complete a guest quiz, Haru saves lesson scores, earned XP, completion dates, and the questions to review in your browser’s local storage, under the key haru.learning.v1. This supports the progress and review features on that device. It is not advertising storage, and it is not automatically uploaded as an account history.

You can remove this device history in your browser’s site-data settings. Blocking or clearing storage may prevent progress from being remembered; the free reading lessons remain available.

Accounts and saved progress

When accounts are connected, Supabase provides authentication and database storage. Account information includes your email, account identifier, display name, authentication records, and the information needed to sign you in. Learning records include scores, completion dates, XP, quiz attempts, review schedules, saved words and grammar, card ratings, learning preferences, and checkpoint results. These records provide account access, cross-device progress, and personalized review.

Guest card collections, learning preferences, and checkpoint history are stored separately in your browser when storage is available. They are not automatically imported into an account when you sign in. Conversation comprehension results are shown for the current session and are not saved as account history.

Authentication uses session cookies. A password you submit is sent to the authentication service; Haru does not display passwords to administrators. Account and learning information is available only to the user and authorized service administration, subject to the service’s access controls.

Daily camp and reminders

For signed-in learners, daily camp stores attendance dates, your first chosen reward time zone, camp coins, season milestones and badges, and daily quiz attempts and results. Your saved quest progress determines the word pool. These records support personal practice, prevent duplicate rewards, and keep your collection across devices. A missed day preserves earned collections. Guest daily quizzes are graded without creating an account reward history.

In the Android app, reminders are optional. Your chosen time and reminder preference stay in the app on that device. Android permission and notification settings control delivery; reminders do not require sending a push token or microphone recording to Haru. A reminder click opens daily camp and does not itself claim a reward. The website can export a 180-day calendar reminder only when you choose Download; you must import it and enable alerts in your calendar. Your calendar provider controls any processing and delivery of those reminders.

Camp decoration choices last in the current tab. Account deletion removes associated attendance, coin, badge, and daily quiz records through the same account deletion process described below.

Optional Google sign-in

If you choose Continue with Google, Google and Supabase process the sign-in. Haru requests only your basic identity through the openid, email, and profile permissions, including your Google account identifier, verified email address, display name, and basic profile information. Haru does not request access to Gmail messages, Drive files, contacts, or your Google password.

Supabase handles identity verification and its normal verified-email account-linking rules. An existing account with the same verified email can remain the same Haru account. Google sign-in does not grant administrator or paid access. In the Android app, Google sign-in opens a system browser and returns a short-lived, single-use authorization code to the app; Haru session tokens are not placed in the return link.

Account emails

When account email delivery is enabled, Supabase Auth sends sign-up confirmation and password-recovery messages through Resend. The recipient email address, message content including authentication links, and delivery records such as sending times, delivery status, and errors are processed to deliver these messages and troubleshoot delivery.

These messages use no-reply@auth.fline.kr as the sender. This is a sending address, not a support inbox. For help or privacy requests, contact kbhjjan100@gmail.com.

The selected email sending region is Tokyo (ap-northeast-1). This setting does not mean all email-related processing or storage takes place only in Tokyo. Resend and its service providers may process information in other countries as described in the Resend Privacy Policy.

Payments are handled by Paddle

When paid checkout is available, Paddle acts as merchant of record and processes payment, billing, and tax information under its own Privacy Notice. Haru stores identifiers linking a purchase to your account, the plan, subscription status, and the current access period so it can provide Pro access. Haru does not store your full payment-card number.

Use the support or subscription-management link in your Paddle receipt, or Paddle buyer support, for payment questions. Requests about payment information held by Paddle are separate from deleting your Haru account.

Device features and operational data

Speaker buttons first request a pre-generated F1 AI Korean recording from Haru. Availability follows the learning material and your account access. If a recording is unavailable, a labeled device speech-synthesis fallback may be used. Device voice processing depends on your browser and operating system.

Conversation speaking practice can record your microphone only after you choose Record and permit microphone access in your browser. A recording is limited to 30 seconds and 8 MB. It stays in the current tab’s memory for playback and is not uploaded to Haru, Supabase, Paddle, or an audio-analysis service. Replacing a recording, changing roles, leaving the conversation, or reloading discards it. You can stop recording at any time; Haru releases the microphone when recording ends or you leave. No automatic pronunciation score is calculated.

This version does not install advertising trackers or a separate behavior-tracking service. Its typefaces are hosted with the website and do not require requests to an external font service. The hosting, authentication, and payment providers may process connection details and security logs, such as IP addresses, request times, and error information, to deliver and protect their services. The application also uses limited request counters to reduce abuse.

Haru’s hosting provider, Vercel, may derive an approximate city and country from your IP address. Hosting providers also process basic performance diagnostics, such as response times, memory use, and errors. Haru does not request GPS or other precise device-location access.

호스팅 제공자는 IP 주소로 대략적인 도시·국가를 추정하고 응답 시간·메모리 사용량·오류 같은 기본 성능 진단 정보를 처리할 수 있습니다. Haru는 GPS나 그 밖의 정밀한 기기 위치 접근을 요청하지 않습니다.

Service providers and data locations

Account and learning data is processed through the configured Supabase project, and account email delivery uses Resend when enabled. Payment data is processed by Paddle and its payment partners. Website delivery also uses the operator’s hosting provider. Depending on deployment and your location, these providers may process information in other countries. Their contractual protections and retention practices apply to the information they process.

Providers may also handle service-generated usage metadata, including connection records and email source and destination details, under their own privacy policies for service operation, security, and improvement.

일부 제공자는 접속 기록과 이메일 송수신 정보 등의 서비스 이용 메타데이터를 자체 개인정보 처리방침에 따라 서비스 운영·보안·개선 목적으로 별도로 처리할 수 있습니다.

Haru uses account, learning, and subscription information to provide the service, manage access, and prevent misuse. This version has no feature for selling personal information or using your learning history for third-party advertising.

Your choices and deletion

In Account settings, you can change your display name, reset your password, manage billing, and request account deletion. Email/password users confirm their current password. Google users can confirm the same Google account again and then explicitly confirm permanent deletion; this confirmation expires after five minutes. Deleting Haru does not delete your Google account. If a subscription is still active, paused, or awaiting payment, first cancel it through billing settings and wait until it ends; deleting an account is not a way to cancel a subscription.

When deletion succeeds, the account and its associated application learning records are removed. Local guest history is separate and can be cleared through browser settings. Paddle may retain transaction information under its own obligations. Provider backups, security records, and records required by law may persist under the relevant provider’s retention rules.

Retention and changes

Account information and learning history are kept while the account remains available, unless you delete it. Guest progress remains on your device until you clear it or your browser removes it. Payment records are managed separately by Paddle. No automatic account-inactivity deletion schedule is implemented in this version.

If the service adds a new use of information or changes these practices, this notice should be updated before the change takes effect, with any further notice or choice required by applicable law. See the Terms of use for subscription and service details.