Privacy Policy

Kroot collects only what's needed to run your account and track your learning progress:

• Account info — the email address and password you sign up with (Kroot never sees your password itself; it's handled by our auth provider, Supabase), plus a display name and, if you choose to add one, a profile photo.
• Learning data — your level, streak, XP, which words and lessons you've studied, quiz answers, spaced-repetition history, and any writing you submit for correction.
• Usage events — which pages and features you use, so we know what's actually helping people learn. These are tied to your account (or an anonymous ID before you sign up), never sold, and never shared with advertisers.
• Support messages — anything you send through the in-app feedback form, along with the page you sent it from.
• Push notification token — only if you turn on streak reminders. You can turn this off at any time in Settings.
• Payment status — if you subscribe to Kroot Plus, we know that you're subscribed and until when. Kroot never sees or stores your card number; that's handled entirely by Stripe.

Kroot doesn't knowingly collect precise location, contacts, or any data beyond what's listed above, and doesn't run third-party ad tracking.

• To run your account: log you in, save your progress, and show you the right lessons at the right level.
• To send you the emails you'd expect — sign-up confirmation, password reset, and (only if you opt in) streak reminders.
• To read out Korean words and sentences using text-to-speech.
• To fix bugs and improve the app, using aggregated usage patterns rather than reading individual accounts.
• To respond when you contact us for support.

Kroot doesn't sell your data or share it with advertisers. Running the app does mean a few specialized services process it on Kroot's behalf, each only for the job named below:

• Supabase — hosts the database and handles login (stores your account, progress, and password securely).
• Vercel — hosts the app and provides privacy-focused, cookie-free traffic analytics.
• Stripe — processes Kroot Plus payments. Your card details go directly to Stripe; Kroot never receives them.
• Brevo — sends transactional emails (sign-up confirmation, password reset, reminders).
• Microsoft — converts Korean text to speech audio for pronunciation playback. Only the text being read is sent, not your identity.

Each of these providers is contractually restricted to using your data only to provide their service to Kroot — not for their own purposes.

Kroot uses one essential cookie to keep you signed in — that's it. There are no advertising or cross-site tracking cookies.

Your data is kept for as long as your account is active. To delete your account and all associated data, email killpig2000@gmail.com from the address you signed up with — it's handled within 30 days. Anonymized, aggregated usage statistics that can no longer be tied to you may be kept for product improvement.

Kroot isn't directed at children under 13, and knowingly collecting personal information from a child under 13 isn't something we do. If you believe a child has created an account, email us and it will be removed.

Wherever you are, you can ask for a copy of your data, a correction, or deletion at any time by emailing killpig2000@gmail.com. If you're in the EU/UK or California, this covers your rights under GDPR and the CCPA respectively — there's no separate process, just email and it gets done.

Your data is encrypted in transit (HTTPS) and at rest by our infrastructure providers. Access to production data is limited to the developer running Kroot.

If this policy changes in a way that affects how your data is handled, the date at the top of this page will change and, for significant changes, you'll be notified by email.

Questions, requests, or concerns about your data: killpig2000@gmail.com.