DangoLoop Privacy Policy

Effective Date: October 22, 2026

CodeSand Co., Ltd. (the "Company") handles the personal information of users of DangoLoop (the "Service") with care and complies with the Personal Information Protection Act of Korea and other applicable laws. This policy is written so that users can see what information the Company collects, when, where it is sent, what it is used for, and when it is deleted.

Summary. This app has no accounts, and the Company does not operate servers that receive your study records. The Company operates two servers: one (outsourced to Cloudflare) that delivers pronunciation audio for the paid portion and checks the validity of Paid Products with the App Store, and the Company website server (Republic of Korea) that serves notices shown in the app; neither receives study records, and the audio and verification server does not store request contents. The original per-word study records and your exam date are stored only on your device. What leaves the device is ① usage statistics about how you use the app (study range, judgments, session totals, etc. — you can turn all of it off in Settings), ② information needed to show ads (if you launch the app while holding a Paid Product, the advertising SDK is not started), ③ diagnostic information when an error or crash occurs, ④ inquiries you send yourself by email, ⑤ request information sent to the audio server when a user holding a Paid Product plays the pronunciation of a word in the paid portion (which word's audio, an installation identifier generated by the app, and the connecting IP), and ⑥ information sent to verify the validity of a Paid Product — the purchase proof issued by the App Store, relayed through the Company's verification server to that App Store, and ⑦ request information sent to the Company website to check for in-app notices when you open or return to the app (connecting IP, app version and operating-system type — no installation identifier or token); each is itemized in Section 1.B. Usage statistics never include the words themselves (headword, reading, meaning) or your exam date.

1. Personal Information Collected

General: the Company does not collect your name, email address (except when you send an inquiry email yourself), phone number, precise location (GPS), contacts, photos, microphone input, call or message logs, health information, payment information such as credit card numbers, or unique identifiers such as national ID numbers. The only permission the app requests is notifications (requested on the guide screen after your first study round) (On Android, the app also receives the "run at startup" permission at install time so that scheduled notifications survive a device restart; no information is collected through this permission.); it does not request location, contacts, photo, microphone, camera, or storage permissions. Because the Service has no accounts, it does not collect names, passwords, or social account information.

A. Information that stays on your device and is not collected by the Company

Study records — per-word known/unknown counts and status, last-seen time, next review date, favorites, and miss counts
Study sessions — the level, chapter, range, and round number of each study or review session, start time, duration, known/unknown counts, completion status, and review result records
App settings — app language, target level, exam date, new words per day, chapter size, cumulative/per-chapter mode, voice, theme, whether the study reminder is on and its time, whether exam D-day reminders are on (the no-notification window from 11 p.m. to 8 a.m. is fixed and not a setting), the result of the notification permission request, whether to send usage statistics, onboarding completion, and whether hint messages were dismissed
Purchase status — the product ID of the Paid Product, the App Store used, the purchase token issued by the App Store (used only to confirm the purchase; it contains no payment information. To verify validity it is looked up with the App Store through the Company's verification server, as described under "Purchase history" in B below), the entitlement status, expiry time, and last-verified time returned by that check, and the audio-access entitlement token issued by the verification server together with its expiry time
Installation identifier for the audio server — a random 32-character string the app generates on the device to send along with paid-portion audio and purchase-verification requests ("Device or other IDs" ④ in B below). It is not generated until you purchase or restore a Paid Product.
Downloaded pronunciation audio — audio files for words in the paid portion are downloaded from the audio server when played and kept in the device's cache storage (about 80 MB at most, oldest files deleted automatically, excluded from the operating system's device backup). The operating system may clear them when freeing storage, and these files contain no user information.
Scheduled notifications and widget values — study and exam D-day notifications scheduled on the device and the numbers shown on the home-screen widget (where provided)
Today's study progress — the internal IDs of the words planned for the day, completion status, how many extra rounds were run that day, the first-run date, the date an interstitial ad was last shown, and review-schedule adjustment records
In-app notice display state — the last notice content received and when it was received, and the IDs of notices you dismissed (up to 50). Not sent to servers.

The originals of the information above are recorded only in the device's internal storage and have no path to the Company's servers. However, the purchase token, installation identifier, and entitlement token are sent — only for verifying Paid Product validity and for paid-portion audio requests — to the server the Company operates through a processor, as described in B below, and that server does not store them. In addition, aggregate and category values of some of these items (study range, judgment results, session figures, fixed option values of settings, Paid Product status) are sent as the "App interactions" item in B below while usage statistics are on. Deleting the app deletes the information on the device. If the operating system's device backup (Android Auto Backup, iCloud Backup, etc.) is enabled, app data may be included in that backup; the backup belongs to your Google or Apple account and the Company cannot access it.

Sharing statistics. You can share your study statistics as text from the statistics screen. This text is generated on the device and handed to the app you choose in the operating system's share sheet; it does not pass through the Company's servers. Handling after that is the responsibility of the app you chose and the recipient.

B. Information the Company collects — by store declaration type

The information below is sent over the network (HTTPS) directly to each external company's systems, not to the Company, at the time the relevant feature runs, and the Company views aggregate results and individual error records through that company's console. The Company does not separately aggregate this information on its own servers. However, requests for paid-portion audio and for Paid Product validity checks are sent to a server the Company operates through Cloudflare, Inc. as a processor; that server does not store request contents and keeps only the processing-result records described under "Diagnostics" below. In-app notice check requests are sent to the website server the Company operates (Republic of Korea), and its access log is kept only within the scope described under "In-app notice check" below. Processors and the outsourced work are set out in Section 5, and the details of cross-border transfers in Section 6.

App interactionsApp activity · ①②③ can be turned off in Settings

Items: ① Usage events defined by the Company — onboarding step progress and skips, level recommendation result and the level chosen, the time elapsed from starting onboarding until the first card was shown and whether the level quiz was taken, progress through the card-gesture coach steps, start and end of per-chapter study/review sessions (level, chapter, mode, round number, word count, duration, known/unknown counts, completion), start and end of Today sessions (whether it was the first session, today's session, or an extra round; planned review and new-word counts; whether it resumed the same day; and at the end, the phase, card position, card count, known/unknown counts, duration, and completion), card judgment result, input method (swipe/button) and card position, and in Today sessions which phase the card belonged to (review, new, or again), which screen the "Remind me tomorrow" button was pressed on and its result (scheduled or off), bottom-tab selection and which section of the Wordbook screen was opened (search, level, favorites, missed words, chapters, quiz — search terms are not sent), what triggered the paywall screen and days since install, the product you attempted to buy and the originating screen, entitlement state change (when an App Store re-check or the Company's verification server finds it expired or refunded — the state value only), interstitial ad placement, display and handling of in-app notices (the notice ID and action type — dismiss or open link), the result type of a paid-portion audio download (fixed values such as cached, downloaded, offline, refused, not found, rate-limited, failed) and how long it took (the word ID and voice are not sent), settings changes (the setting name and fixed option values only, such as app language, chapter size, new words per day, theme, notification time, and notification on/off), and the fact that an exam date was set (the date and days remaining are not sent) ② user property — Paid Product status (lifetime, subscription, or none) ③ default events collected automatically by the analytics tool (first open, session start, app update, completion of an App Store in-app purchase, etc.) and the basic information attached to them (device model, OS version, app version, device language and country settings) ④ The request sent to the audio server when you play the pronunciation of a paid-portion word while holding a Paid Product — the word's internal ID and the voice (male or female). The word text is not sent. This request goes to the audio server the Company operates through a processor, not to the analytics tool, and occurs only when you press the play button, regardless of the usage-statistics setting.
When: ①②③ When you open the app or perform the action ④ when you play the pronunciation of a paid-portion word
Sent to / stored by: ①②③ Google LLC (Firebase Analytics, Google data centers in the United States and elsewhere) ④ Cloudflare, Inc. (the Company's audio server operated through a processor, edge data centers in the United States and elsewhere — not stored)
Purpose: ①②③ Improving the Service, analyzing usage statistics, analyzing study flow and paid conversion ④ delivering paid audio

Events do not include the words themselves (headword, reading, meaning) or the exam date or days remaining. They do include category and aggregate values such as which level, chapter, or range you studied and how you judged the card at a given position. Turning off Settings → Send usage statistics immediately asks the analytics tool to disable collection, stopping all of ①②③, and the setting persists across launches. Deletion of data already sent before you turned it off follows the procedure in Section 8. Because ④ is a request to receive audio rather than a statistic, it still occurs when you play paid audio even with usage statistics turned off. The audio server does not store request contents and keeps only a request-count tally for abuse prevention, for at most 60 seconds.

Purchase historyWhen you buy a Paid Product · when its validity is checked

Items: ① The product ID purchased and Paid Product status (lifetime or subscription), the fact that an App Store in-app purchase was completed, and the transaction amount and currency recorded automatically by the analytics tool ② Paid Product validity check — on Android the purchase token issued by Google Play, on iOS the signed transaction issued by the App Store (transaction ID, product ID, purchase date, environment, app identifier — no name, email, or payment information), the product ID, the platform (Android or iOS), and the app version. The installation identifier under "Device or other IDs" ④ below is sent with this request.
When: ① When payment for a Paid Product is completed (only while usage statistics are on) ② immediately after you purchase or restore a Paid Product; thereafter at app launch if more than 24 hours have passed since the last check or the entitlement token expires within 7 days; just before playing paid-portion audio if there is no entitlement token or it expires within 1 hour; and when the audio server rejects the entitlement token (regardless of the usage-statistics setting)
Sent to / stored by: ① Google LLC (Firebase Analytics) ② the Company's verification server operated through a processor (Cloudflare, Inc.) → the relevant App Store (Google LLC · Apple Inc.)
Purpose: ① Analyzing paid conversion, usage statistics by Paid Product status ② verifying whether the purchase is valid, expired, or refunded and applying paid benefits; issuing the audio-access entitlement token

The payment itself is processed by the Apple App Store and Google Play, and the Company does not receive payment information or App Store account information. The purchase token and signed transaction are not sent to the analytics tool. To verify validity they are looked up only with the relevant App Store through the Company's verification server; the verification server neither stores nor logs them and keeps only the processing result (platform, product, result code, App Store response status, processing time, the server location that handled it, and app version — no identifier that distinguishes a user) in its operating logs for 7 days. If the verification server does not respond, the app leaves your paid status unchanged. Turning off usage statistics stops ①, but ② continues while you hold a Paid Product because it is needed to apply the benefits.

Device or other IDsAnalytics · ads · error diagnostics · paid audio and purchase verification

Items: ① An app instance ID randomly issued by the analytics tool for each installation, and the Android Advertising ID / iOS vendor identifier (IDFV) that the analytics tool may read by default ② the Android Advertising ID, Android App Set ID, iOS app- and developer-scoped identifiers (such as the IDFV — the app does not request App Tracking Transparency consent and therefore does not collect the IDFA), and device/OS information used by the advertising SDK ③ an installation identifier randomly issued by the error-collection tool for each installation ④ The installation identifier sent to the audio server and the verification server — a random 32-character string the app generates on the device when a Paid Product is first verified; it is unrelated to the Advertising ID, hardware serial numbers, or App Store accounts and is not sent to the analytics or error-collection tools. Once a Paid Product is verified, the verification server issues an audio-access entitlement token containing this installation identifier, an expiry time, and the product type (lifetime or subscription); the app stores it on the device and sends it with subsequent audio requests. The entitlement token cannot be used on another device and expires after at most 30 days, after which the check is repeated. Deleting and reinstalling the app generates a new installation identifier.
When: ① When you open the app (while usage statistics are on) ② when an ad is requested or shown (if you hold no Paid Product) ③ when an error occurs ④ when a Paid Product's validity is checked, and when you play the pronunciation of a paid-portion word
Sent to / stored by: ① ② Google LLC (United States and elsewhere) ③ Functional Software, Inc. (Sentry, Germany) ④ Cloudflare, Inc. (the Company's server operated through a processor, edge data centers in the United States and elsewhere — not stored)
Purpose: ① distinguishing installations in statistics, ② serving and personalizing ads, frequency capping, preventing invalid traffic, ③ de-duplicating error reports, ④ per-installation request-rate limiting (preventing server abuse), and confirming that paid audio opens only on the installation to which the entitlement token was issued

These identifiers are not linked to your identity (account, name, contact details) and are not hardware serial numbers. The app instance ID and the Sentry installation identifier are generally issued anew if you delete and reinstall the app (a previous value may be revived by an operating-system backup restore). On Android you can reset the Advertising ID or opt out of personalized ads in device settings. Your choices are detailed in Section 7. The installation identifier and entitlement token are not shown in the app; the server does not store them and uses them only for the request-count tally, for at most 60 seconds.

Advertising dataWhen ads are requested, shown, or consent is processed · see below for what applies after a paid upgrade

Items: Ad interaction records such as requests, impressions, and clicks; device/OS information and the connecting IP that the advertising SDK collects itself for ad serving and measurement; the ad consent choice you made in the European Economic Area, the United Kingdom, or Switzerland; and performance diagnostics of the advertising SDK such as app launch and ad loading time and errors
When: When an ad is requested or shown, when you interact with an ad, when the ad consent flow runs
Sent to / stored by: Google LLC (AdMob · User Messaging Platform)
Purpose: Serving, personalizing, and measuring ads, analyzing ad statistics, preventing invalid traffic (click fraud), managing ad consent

If you launch the app while holding a Paid Product, the advertising SDK is not started and this item is not collected. If you purchase during use, the banner is removed, any pending interstitial ad is discarded, and new ad requests stop immediately, but an advertising SDK that has already started remains in memory until you relaunch the app. Interstitial ads are pre-loaded, so ad requests occur before an ad is shown.

DiagnosticsApp info and performance

Items: ① The type, message, and stack trace (execution path in app code) of errors and crashes, time of occurrence, app version, build number and release identifier, device model and OS version, a marker indicating the action in which the error occurred (e.g. "paywall.purchase" — predefined fixed strings only), and whether the error was handled ② performance and error diagnostics of the advertising SDK (see "Advertising data" above) ③ Processing-result records of the verification server — platform (Android or iOS), product, result code, App Store response status, processing time, the code of the server location that handled it, and app version. The purchase token, transaction ID, installation identifier, entitlement token, and connecting IP are not recorded. Audio requests are not logged individually; only abnormalities of the server itself, such as configuration errors, are recorded.
When: ① Sent only when an error or crash occurs in a release build with the error-collection address (DSN) configured. Nothing is sent otherwise. ② when an ad is requested or shown ③ when a Paid Product's validity is checked
Sent to / stored by: ① Functional Software, Inc. (Sentry, Germany, EU region) ② Google LLC ③ Cloudflare, Inc. (operating logs of the Company's server operated through a processor)
Purpose: Analyzing the cause of errors and ensuring the stability of the Service; checking ad serving status; diagnosing failures of the verification server

Error reports are configured not to include screenshots, app session tracking, or action logs (breadcrumbs); the Company sets no account-based user identifier; and although the connecting IP address may be observed during receipt, reports are configured not to store it as a user IP. No performance data tracking app speed or session replays are collected. Errors reported from app code (Dart) have the user field removed before sending, and SQL statements and database arguments, and specific patterns of dates and purchase verification data, are sanitized from the exception and message strings (not every format is guaranteed). Native Android/iOS crashes are sent directly by the error-collection tool’s native SDK through a separate path; no code places user input into those messages, but they may include an installation identifier and device/app diagnostic information. The verification server's processing-result records are automatically deleted after 7 days.

Coarse locationCountry, region, or city level

Items: Country-, region-, or city-level location estimated from the connecting IP address, during ① processing of analytics events and ad requests ② receipt of error reports
When: ① When you open the app (while usage statistics are on) or an ad is requested or shown ② when an error occurs
Sent to / stored by: ① Google LLC ② Functional Software, Inc. (Sentry)
Purpose: Regional usage statistics, serving region-appropriate ads and determining consent regions, understanding the environment in which an error occurred

The app does not request location permission and does not collect precise location such as GPS. Error reports do not store the IP address itself; only the country, region, and city inferred from it are recorded. The Company's audio and verification server uses the connecting IP only to route you to the nearest server location and to count requests, and does not store it. Verification result records keep only the code of the server location that handled the request and no identifier that distinguishes a user.

In-app notice checkAll users · when the app opens or resumes · server access log

Items: The ordinary access-log entry left on the web server when the app reads the notice page on the Company website — connecting IP address, app name, version, build number, and operating-system type (User-Agent), the requested address, and the time of access. No installation identifier, entitlement token, or cookie is sent, and the response contains no user information.
When: When you open the app or bring it back to the foreground (at most once every 6 hours). Independent of the usage-statistics setting and of whether you hold a Paid Product
Sent to / stored by: The website server operated by the Company (Republic of Korea — hosted by The Constant Company, LLC (Vultr), Seoul data center; Section 5)
Purpose: Delivering in-app notices such as changes to this policy or the Terms, maintenance, and update announcements; diagnosing web-server failures and preventing abuse

The notice content and whether you dismissed it are stored only on the device and are not sent to servers (statistics on notice display and actions are sent as "App interactions" ① above only while usage statistics are on). The access log is used only as a server operating record and is automatically deleted after 90 days. There is no in-app setting to turn this request off; when offline, no request occurs and the app works as usual.

Inquiry content and email addressOnly when you send an email

Items: The inquiry text you wrote, the sender’s email address, and any information you added yourself (app version, device, an App Store receipt number in a refund inquiry, etc.)
When: When you send an email yourself to the address in Section 11. The app has no inquiry-sending feature and never sends anything on its own
Sent to / stored by: Received by Mailgun (United States) and relayed to the Company mailbox system (server in Seoul, Republic of Korea), where it is stored. Reply emails from the Company are also sent through Mailgun (Sections 5 and 6)
Purpose: Replying to and handling inquiries, reproducing and fixing reported problems, handling consumer complaints and disputes such as refunds

The app’s Settings → Contact · About screen only shows the email address; writing and sending the email happens in your mail app. Study records are never sent automatically with an inquiry — the app has no path to send them unless you type them in yourself. Retention is set out in Section 3.D. Your email reaches the Company mailbox through the servers of the receiving service the Company has designated (Mailgun, United States); that process is set out in Sections 5 and 6.

2. Purposes of Use

The Company uses the personal information it collects only for the following purposes, and if a purpose changes, it will notify you in advance and obtain any required consent.

Providing the Service — flash-card study, review scheduling, statistics and exam countdown, study and exam D-day notifications, widgets (only in versions that provide them) (processed only on the device)
Confirming whether a Paid Product is purchased, expired, or refunded and applying its benefits — the purchase proof issued by the App Store is looked up with that App Store through the Company's verification server, and an audio-access entitlement token is issued to the verified installation (if the verification server does not respond, on Android the app queries Google Play directly for the current subscription status)
Delivering paid-portion pronunciation audio and preventing abuse of the audio and verification server (request-rate limiting by installation identifier and connecting IP)
Delivering in-app notices — changes to this policy or the Terms, maintenance, update announcements, and the like (notice content is read from the Company website; whether you have read it stays on the device)
Improving the Service and analyzing usage statistics — understanding which features are used, where study drops off, and where paid conversion happens
Serving ads and measuring their performance, preventing invalid traffic — funding the free portion
Ensuring the stability of the Service and analyzing the causes of errors
Responding to customer inquiries and handling consumer complaints and disputes

The Company does not use your study records for advertising or marketing. The app’s notifications are study reminders; notifications containing commercial advertising are sent only with the separate opt-in consent required by applicable laws.

3. Retention Period and Destruction

A. Information stored on the device

The originals of study records, sessions, settings, and purchase status exist only on your device and are kept until you delete them. Because the Company does not hold them, there is no original for the Company to destroy and no destruction procedure on its side. Deleting the app removes the above from the device. The app currently does not offer a separate feature to erase only study records.

Because the Service has no accounts, there is no account withdrawal procedure. Copies included in the operating system’s device backup are managed by you in device settings (Android: Backup / iOS: iCloud Backup).

B. Items kept in external companies’ systems

Usage events, user properties, and purchase history (Firebase Analytics) — the retention period the Company has configured in Google Analytics is 2 months for event data and 2 months for user data, and it is set not to be extended by new activity. After that period, user- and event-level data is automatically deleted, while aggregated reports that cannot identify users are kept regardless of the retention period. The Company does not hold this data itself.
Error diagnostic information (Sentry) — automatically destroyed 30 days after collection (the retention period of the plan used by the Company; this policy will be updated if the period changes). The Company may delete individual error records earlier from the console when needed.
Paid audio and purchase-verification requests (Cloudflare, the Company's server operated through a processor) — the server does not store request contents (installation identifier, purchase token, signed transaction, entitlement token, connecting IP, requested word). The request-count tally for abuse prevention is kept for at most 60 seconds, and purchase-verification processing-result records (no user identifier) are automatically deleted after 7 days (the retention period of the Cloudflare plan used by the Company; this policy will be updated if the period changes).
Advertising data (AdMob) — retained by Google under its own policies and applicable laws. The Company sees only aggregated ad performance such as impressions and revenue and holds no individual records.
Access log of in-app notice checks (Company website server) — the connecting IP, User-Agent, requested address, and time of access remain in the web server's access log and are automatically deleted after 90 days. The Company does not combine this log with other information or use it to identify users.
Email inquiry relay records (Mailgun) — The message body is not stored with Mailgun but only in the Company's mailbox (server in Seoul, Republic of Korea). Processing records (sender and recipient addresses, subject, time, and processing result) may remain with Mailgun for up to 30 days under Mailgun's retention policy. Retention of the inquiry itself is set out in D.

C. Items kept by the App Stores

Payment and refund records for Paid Products are retained by the Apple App Store and Google Play, which process the payments, under their own policies and applicable laws. The Company can look up transactions in the App Store consoles but cannot access payment information.

D. Items retained under law

General inquiries (usage questions, feature suggestions, content error reports, and other inquiries that are not consumer complaints or disputes, with replies) — 1 year after handling is complete (Company internal standard)
Records on handling consumer complaints or disputes (inquiries about refunds, payment, or product defects and replies, including receipt numbers or transaction details received during the inquiry) — 3 years (Article 6 of the Enforcement Decree of the Act on the Consumer Protection in Electronic Commerce, etc. of Korea)
Records on contracts or withdrawal of offer, and on payment and supply of goods (only such records as the Company comes to hold within the scope of its statutory retention obligation) — 5 years (same Decree)
Other information that applicable laws require to be retained — the period set by that law

Records subject to these periods are stored separately from other information, are not used for any other purpose, and are destroyed when the period expires.

E. Method of destruction

Information whose retention period has expired or whose purpose has been achieved is permanently deleted from electronic files using methods that make it impossible to recover or reproduce.

4. Provision to Third Parties

The Company does not provide users’ personal information to third parties, except in the following cases.

Where the user has given prior consent
Where required by law, or where an investigative agency requests it for investigative purposes in accordance with the procedures and methods prescribed by law

When the study statistics text you share yourself becomes visible to the recipient, that is disclosure by your own choice, not provision to a third party by the Company. Transmission of information for usage statistics, ad serving, error diagnostics, paid audio delivery, purchase verification, in-app notice checks, and the relay of email inquiries to external companies or to Company servers hosted by external companies constitutes outsourced processing under Section 5, detailed in Sections 5 and 6. Payments for Paid Products are processed by the Apple App Store and Google Play, and the Company cannot access payment information.

5. Outsourcing of Processing

The Company outsources the processing of personal information to the following companies to provide the Service. If a processor or the outsourced work changes, the Company will disclose it through this policy.

Google LLCPrivacy Policy ↗

Outsourced work: Collection, aggregation, and analysis of Firebase Analytics usage statistics; serving and measuring AdMob ads; managing ad consent for users in the European Economic Area, the United Kingdom, and Switzerland (User Messaging Platform); processing Google Play in-app purchases; answering the Company's verification server's queries about Google Play purchase status
Processing location: United States and others

Apple Inc.Privacy Policy ↗

Outsourced work: Processing App Store in-app purchases; answering the Company's verification server's queries about App Store purchase status
Processing location: United States

Functional Software, Inc. (Sentry)Privacy Policy ↗

Outsourced work: Collection, storage, and analysis of error diagnostic information
Processing location: Germany (Sentry EU region)

Cloudflare, Inc.Privacy Policy ↗

Outsourced work: Running the Company's server and storing and delivering paid-portion pronunciation audio; relaying Paid Product purchase-proof lookups to the App Stores and issuing audio-access entitlement tokens (request contents not stored); request-rate limiting to prevent server abuse; keeping purchase-verification processing-result records (7 days)
Processing location: Cloudflare edge data centers worldwide, including the United States (processed at a location near the user)

The Constant Company, LLC (Vultr)Privacy Policy ↗

Outsourced work: operation of the Company's web service servers that receive inquiry emails (Seoul region, Republic of Korea) — these servers host the Service website, including the in-app notice page, and the Company mailbox system that stores email inquiries
Processing location: Republic of Korea (Seoul data center) — not a cross-border transfer

Mailgun Technologies, Inc. (United States)Privacy Policy ↗

Outsourced work: Receiving and relaying inquiry emails and sending reply emails
Processing location: United States (Mailgun US region data centers)

Payments for Paid Products are processed by the Apple App Store and Google Play under their own terms and privacy policies; the Company does not collect or store payment information and records the product ID and purchase token on the device and determines their validity by looking them up with the relevant App Store through the Company's verification server. Details of transfers to companies whose processing location is abroad are set out in Section 6. Email inquiries are received by Mailgun (United States) and relayed to the Company mailbox system (server in Seoul, Republic of Korea), where they are stored. Reply emails from the Company are also sent through Mailgun. Cross-border transfer details for the receiving service are set out in Section 6.

6. Cross-Border Transfer

In the course of providing the Service, the Company transfers personal information abroad as follows. These transfers constitute outsourced processing and storage for the conclusion and performance of a contract with the data subject under Article 28-8(1)(iii) of the Personal Information Protection Act of Korea, and disclosure of the following through this policy serves as the related notice. For each company we state the recipient and contact, country, timing and method, items, purpose, retention period, and how to refuse.

Google LLC — Firebase AnalyticsPrivacy Policy ↗

Recipient: Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, United States) · contact: Google privacy inquiry form
Destination: Countries hosting Google data centers, including the United States
Timing and method: When you open the app or perform the action while usage statistics are on, transmitted from time to time over the network (HTTPS)
Items: App instance ID; the usage events, user property, and purchase history in Section 1.B; device model, OS version, app version, device language and country settings; the Android Advertising ID / iOS vendor identifier read by default by the analytics tool; IP address and the country/region estimated from it
Purpose: Analyzing usage statistics and improving the Service
Retention: User- and event-level data for 2 months (not extended by new activity); destroyed when the outsourcing contract ends. Aggregated reports that cannot identify users are kept
How to refuse · effect: Turn off Settings → Send usage statistics (stops all collection). The app’s study features are unaffected

Functional Software, Inc. — SentryPrivacy Policy ↗

Recipient: Functional Software, Inc. (45 Fremont Street, San Francisco, CA 94105, a U.S. corporation) · contact: contact details in Sentry’s privacy policy
Destination: Germany (Sentry EU region data center)
Timing and method: When an error or crash occurs in a release build with the error-collection address configured, transmitted over the network (HTTPS)
Items: Error type, message, and stack trace; time of occurrence; app version, build number, and release identifier; device model and OS version; a fixed marker indicating where the error occurred; installation identifier; and the country/region/city inferred from the connecting IP (the IP itself is not stored)
Purpose: Analyzing the cause of errors and ensuring the stability of the Service
Retention: 30 days after collection (same as Section 3.B)
How to refuse · effect: There is no in-app setting to turn this off. If you do not want it transmitted, stop using the app and delete it (it cannot be refused while using the app). Deletion of records already transmitted can be requested as described in Section 8

Google LLC — AdMob advertising · ad consent managementPrivacy Policy ↗

Recipient: Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, United States) · contact: Google privacy inquiry form
Destination: Countries hosting Google data centers, including the United States
Timing and method: When an ad is requested or shown to a user who holds no Paid Product (in regions where consent is required, after the consent status is confirmed and within what it permits), transmitted over the network (HTTPS)
Items: Android Advertising ID and App Set ID, iOS app- and developer-scoped identifiers, device/OS information, IP address and the country/region estimated from it, ad interaction records such as requests, impressions, and clicks, ad consent status, and performance/error diagnostics of the advertising SDK
Purpose: Serving, personalizing, and measuring ads, analyzing ad statistics, preventing invalid traffic, managing ad consent
Retention: Until the outsourcing contract ends or the purpose of use is achieved. The Company does not hold this data itself; actual retention follows Google’s privacy policy
How to refuse · effect: Purchasing a Paid Product stops ad requests from that point and the advertising SDK is not started from the next launch. Resetting the Advertising ID or opting out of personalized ads in Android device settings limits personalization, but the transfer for serving ads itself remains. In the European Economic Area, the United Kingdom, and Switzerland you can decline consent or withdraw it in Settings → Ad privacy options; the free study features are unaffected if you decline (Section 7)

Cloudflare, Inc. — audio server · verification serverPrivacy Policy ↗

Recipient: Cloudflare, Inc. (101 Townsend St., San Francisco, CA 94107, United States) · contact: privacyquestions@cloudflare.com (rights requests: sar@cloudflare.com)
Destination: Countries hosting Cloudflare edge data centers, including the United States (a location near the requesting user)
Timing and method: When the validity of a Paid Product is checked after you purchase or restore it (the timing under "Purchase history" ② in Section 1.B), and when a user holding a Paid Product plays the pronunciation of a paid-portion word, transmitted over the network (HTTPS)
Items: Connecting IP address; the installation identifier generated by the app; app name, version, and operating-system type; the internal ID and voice of the requested word; the entitlement token; the purchase token or signed transaction issued by the App Store together with the product ID and platform (used by the verification server only to query the App Store and not stored)
Purpose: Delivering paid audio; relaying the check of whether a purchase is valid, expired, or refunded and issuing the entitlement token; preventing server abuse; diagnosing verification-server failures
Retention: Request contents are not stored. Request-count tally for at most 60 seconds. Purchase-verification processing-result records (no user identifier) for 7 days
How to refuse · effect: No transfer occurs unless you purchase a Paid Product, and every feature of the free portion can be used without contacting this server. After you purchase a Paid Product, this processing is needed to apply the paid benefits and cannot be turned off separately in the app. If you do not want it, cancel the subscription or use the refund procedure and then delete the app. No audio request occurs unless you press the play button on a paid-portion word

Apple Inc. · Google LLC — App Store paymentsPrivacy Policy ↗

Recipient: Apple Inc. (One Apple Park Way, Cupertino, CA 95014, United States · contact: Apple privacy inquiries) · Google LLC (as above)
Destination: Countries hosting each App Store’s data centers, including the United States
Timing and method: When you purchase or restore a Paid Product, when the Company's verification server queries purchase status (the timing under "Purchase history" ② in Section 1.B), and on Android when the app queries the current subscription status because the verification server did not respond, transmitted through the App Store's payment system and the lookup APIs the App Store provides
Items: App Store / Google Play in-app purchase transaction information (tied to your App Store account — the Company cannot access payment information), product ID, and purchase token (on iOS the lookup uses the transaction ID contained in the signed transaction)
Purpose: Processing payment, subscription renewal, and refunds for Paid Products; restoring purchases and confirming whether a purchase is valid, expired, or refunded
Retention: Until the outsourcing contract ends or the purpose of use is achieved. Actual retention follows each App Store’s policies and applicable laws
How to refuse · effect: No transfer occurs unless you purchase a Paid Product. Processing after payment follows each App Store’s privacy policy

Mailgun Technologies, Inc. — Email inquiry receivingPrivacy Policy ↗

Recipient: Mailgun Technologies, Inc. (United States, Data Protection Officer contact dpo@sinch.com)
Destination: United States
Timing and method: Over the network when you send an inquiry email or when the Company replies
Items: Email address, email subject and body, attachments
Purpose: Receiving and relaying inquiry emails and sending replies
Retention: The message body is not stored with Mailgun but only in the Company's mailbox (server in Seoul, Republic of Korea). Processing records (sender and recipient addresses, subject, time, and processing result) may remain with Mailgun for up to 30 days under Mailgun's retention policy. The email is kept in the Company mailbox (server in Seoul, Republic of Korea) for the inquiry retention period in Section 3.D
How to refuse · effect: If you do not want the transfer, you may choose not to send an email inquiry; every feature of the app can be used without one (DangoLoop has no in-app inquiry feature). Email inquiries cannot be handled without this transfer. Deletion of an inquiry you already sent can be requested as described in Section 8

If you do not want your personal information transferred abroad, you may express your objection to the privacy officer in Section 11. How to refuse and the effect differ by service — usage statistics stop when turned off in Settings without affecting study features; new ad requests stop from the moment you purchase a Paid Product, and in consent regions declining or withdrawing ad consent limits personalized ads according to your choice while ad requests within what is permitted and the related transmission may continue (whether ads can be requested is determined by the UMP status); paid audio and purchase verification are not transmitted unless you purchase a Paid Product and, once purchased, cannot be turned off in the app because they are needed to apply the benefits (stop them by cancelling or refunding and then deleting the app); the relay of email inquiries does not occur unless you send one; and there is currently no in-app setting to turn off the transmission of error diagnostic information, so if you do not want it transmitted, stop using the app and delete it.

7. Advertising Identifiers, Personalized Ads, and Ad Consent

The free portion of the Service is funded by advertising revenue. Users who do not hold a Paid Product are shown Google AdMob ads (banner and interstitial). The advertising SDK itself collects device information (model, OS version, etc.) and coarse location based on the IP address for ad serving and frequency control. Handling of the advertising identifier differs by operating system.

Android — AdMob may use the Advertising ID to personalize ads. You can reset the Advertising ID or opt out of personalized ads in device settings → Google → Ads.
iOS — The Company does not request App Tracking Transparency (ATT) consent and therefore does not collect or use the advertising identifier (IDFA). The advertising SDK operates without the IDFA and processes the advertising and diagnostic information described in Section 1. If ATT is introduced in the future, consent will be obtained in advance.
While you hold a Paid Product — if you launch the app while holding a Paid Product, the advertising SDK is not started, so no information is collected or transmitted for advertising purposes. If you purchase during use, the banner is removed, any pending interstitial ad is discarded, and new ad requests stop immediately, but an advertising SDK that has already started remains in memory until you relaunch the app.

Consent for users in the European Economic Area, the United Kingdom, and Switzerland

For users in the European Economic Area, the United Kingdom, Switzerland, and other regions where the law requires consent, the app checks and refreshes your consent status through Google’s User Messaging Platform (UMP) at every launch and, where needed, shows a consent dialog before starting the advertising SDK asking whether you consent to personalized ads and to the use of device information and storage for advertising. Ads are requested only within what the confirmed consent status permits. Your choices are kept on the device by UMP, and the Company does not store your consent choices separately. In other regions, including the Republic of Korea, no separate consent dialog is shown, and your choices regarding the advertising identifier follow the per-OS methods above.

You can use every feature of the app regardless of your consent choice. If you decline or withdraw consent, personalized ads are limited according to your choice, and within what UMP permits, non-personalized ad requests and the transmission needed for them may continue. You can reopen the dialog at any time in Settings → Ad privacy options to change or withdraw your choice; when you change it, ads pre-loaded under the previous choice are discarded and requested again under the new status. This item appears only in regions where consent is required.

For details, see the Google Privacy Policy and the advertising terms.

8. Your Rights and How to Exercise Them

You may at any time request access to, correction, deletion, or suspension of processing of your personal information and withdraw consent. You can exercise these rights as follows.

Directly in the app — turn off Settings → Send usage statistics to stop all analytics collection (the setting persists across launches); in consent regions, change or withdraw ad consent in Settings → Ad privacy options; deleting the app removes the information stored on the device.
In device settings — reset the advertising identifier, opt out of personalized ads (Section 7), revoke notification permission
By email — contact the privacy officer in Section 11 and we will process your request without delay and reply with the result.

Requesting deletion of records held by external companies. Because the Service has no accounts, usage statistics and error diagnostic information carry no user identifier set by the Company. When you request deletion, the Company ① checks whether the records can be identified from the information you provide (the time and circumstances of the error, device model and OS version, app version, and other information you can provide — the app instance ID is not shown in the app, so it is not required), ② deletes identified records using the processor’s deletion features or asks the processor to delete them, and ③ where records cannot be identified, explains why and tells you when they are automatically destroyed and how to stop collection. The scope of what can be done and the result are communicated within 10 days of receiving the request. If there is a legitimate reason to limit a request, the Company will explain the reason. The Company's audio and verification server stores no request contents, so there are no records to delete; purchase-verification processing-result records carry no identifier that distinguishes a user, are not subject to individual deletion requests, and are automatically deleted after 7 days. The web-server access log of in-app notice checks can be identified only by time of access and IP address; if you provide that information, the Company deletes the matching entries, and all other entries are automatically deleted after 90 days. If you request deletion of an email inquiry, the Company deletes the inquiry and its replies from the Company mailbox; the receiving service (Mailgun) does not store the contents, and its processing records are deleted automatically after the period in Section 3.B.

The legal guardian of a child under 14 may exercise the above rights on the child’s behalf.

9. Security Measures

The Company implements the following measures.

Originals are not collected — the originals of per-word study records, the exam date, and settings are not sent to the Company’s servers, and the app has no feature that intentionally sends these originals externally. To keep originals out of error messages, SQL statements, database arguments, and specific patterns of dates and purchase verification data are sanitized before sending.
Isolation on the device — study records are kept in a database in the app’s private storage that other apps cannot access.
Encryption in transit — all of the app’s external communication (analytics, ads, payments, error collection, paid audio downloads, purchase verification, in-app notice checks) is encrypted with HTTPS.
No accounts or passwords — because the Service creates no accounts, the Company does not collect or store login credentials or passwords.
No handling of payment information — payments are processed by the App Stores, and the Company’s systems do not handle payment information.
Minimized statistics — usage events contain neither the words themselves, the exam date, nor any text you entered; settings changes send fixed option values only; and you can turn off all collection in Settings.
Minimized error diagnostics — no account-based user identifier is set and reports are configured not to store IP addresses; screenshots, session tracking, action logs, performance tracing, and session replay are not used; and reports are sent only from release builds with the error-collection address configured. The point of failure is indicated only by predefined fixed strings, and error messages reported from app code are sanitized before sending for SQL, database arguments, and specific date and purchase-verification patterns.
Minimized processing on the audio and verification server — the server neither stores nor logs the purchase token, signed transaction, installation identifier, entitlement token, connecting IP, or request contents (only the processing result code is recorded) and processes only the App Store lookup result. The app does not place the installation identifier, entitlement token, or purchase token in error reports, statistics, or on screen, and does not link the installation identifier to the Advertising ID or hardware serial numbers. The server rejects requests without the app's access token and paid-audio requests without an entitlement token.
Minimized web-server access log — in-app notice check requests carry no installation identifier, token, or cookie, the notice page returns no user information, and the web server keeps only its ordinary access log for 90 days.
Restricted access — access to external consoles (analytics, errors, ads, App Stores, server hosting, email receiving service), to the Company web server, and to the Company mailbox is granted only to staff who need it for their work.

10. Personal Information of Children Under 14

The Service is not directed at children under 14 and does not knowingly collect their personal information. If the Company learns that personal information of a child under 14 has been collected, it will destroy that information without delay.

11. Privacy Officer and Remedies

The Company has designated a privacy officer, and users’ inquiries, complaints, requests for remedy, and access requests concerning the processing of personal information are handled by the department below.

Company: CodeSand Co., Ltd.
Representative: Eom SungYong
Department: Privacy Team, CodeSand Co., Ltd.
Address: 539-4, 5F, Daejeon Dunsan Building, 20 Daedeok-daero 241beon-gil, Seo-gu, Daejeon, Republic of Korea
Business Registration No.: 368-87-03020 · Mail-Order Business Report No.: 2024-Daejeon Seo-gu-0455
Phone: +82-10-5942-1002
Email: dangoloop@reply.codesand.co.kr
In the app: Settings → Contact · About
Hours: Weekdays 10:00–18:00 (KST, excluding public holidays)

To obtain relief from infringement of personal information, users may apply for dispute resolution or counseling to the following Korean bodies.

Personal Information Dispute Mediation Committee — +82-1833-6972 (kopico.go.kr)
Personal Information Infringement Report Center — 118 in Korea (privacy.kisa.or.kr)
Supreme Prosecutors’ Office — 1301 in Korea (spo.go.kr)
National Police Agency Cyber Bureau — 182 in Korea (ecrm.police.go.kr)

12. Changes to This Policy

Effective Date: October 22, 2026
The Company may add to, delete, or modify the contents of this policy in response to changes in law, policy, or the Service, and when it does so it will post the reason and the effective date on the Service website. Changes that are important to users, such as additional collected items, purposes, third-party provision, or cross-border transfers, are also announced by reasonable additional means such as an in-app notice or the App Store's update notes.