Privacy Policy
Last updated: October 24, 2026 (Effective: November 23, 2026)
The original of this policy was written in Korean. To the extent any translated version of this policy conflicts with the Korean version, the Korean version shall prevail.
1. Purposes of Collection and Use of Personal Information
LOING (hereinafter the "Company") collects and uses personal information for the following purposes:
- Member management: Identifying members, verifying identity, and responding to service usage inquiries
- Service provision: Providing customized learning content, managing learning progress, and managing Nogli character data
- Service improvement: Optimizing AI difficulty adjustment through analysis of learning patterns, and developing new services
- AI-based automation: Automatic adjustment of learning difficulty (ELO system), recommendation of customized questions, and generation of TTS audio
- Sending advertising information: Sending advertising information such as events and special offers (limited to users who have consented to receive it)
- Avatar and draw operations: managing current appearance and composing profile images; providing draws, processing costs, restricting paid sources by country, verifying published probabilities, handling inquiries and disputes, and retaining records under applicable law
- App performance and device diagnostics: Statistical analysis to check whether screens such as the 3D village run smoothly on the user's device, choose suitable graphics quality for the device, and reduce stuttering, overheating, and errors
- Avatar customization: Managing owned and worn clothes and accessories; processing shop purchases, seasonal outfit draws, accessory draws, selling, combining and the gift box; showing personality and learned-sentence bubbles; suggesting a home-screen mode
- Clubhouses and social features: Operating Clubhouses (shared spaces) and calculating their scores; guestbook notes, stationery and the Star wallet; matching study buddies; showing current status; visiting friends' villages and counting visitors; days studied together; bundling social notifications; the home-screen widget
- Management of posts: Automatic screening of nicknames, @usernames, bios, Clubhouse names and guestbook notes for inappropriate content, and handling reports
- Speaking practice: Speech recognition of speaking recordings, and automatic judging, grading and feedback on spoken answers
- AI tutor: Providing AI answers to questions sent by users, and triaging and handling problem reports
- Subscription payments: Processing subscription payments, managing access rights, and purchase statistics
2. Items of Personal Information Collected
| Category | Items Collected |
|---|---|
| Required items | Email address, password (encrypted), nickname, learning language settings, native language settings, whether the user is aged 14 or older (date and time of confirmation) |
| Optional items | Bio, phone number, nationality |
| Upon social login | Social account identifier (Google ID, Sign in with Apple user identifier), profile image (within the scope provided by the relevant platform) |
| Automatically collected | Device information, OS version, app version, access IP, access date and time, learning activity logs, FCM push token |
| Crash records (automatically collected) | App error (crash) records with the device information and app version at that time, and the member's internal identifier (_id) |
| Advertising ID | Advertising ID (collected by ad partners where the user has allowed it in device settings or a consent screen — see "Information Collected by Ad Partners" in Section 6) |
| When using speaking practice | Speaking recordings (used only for speech recognition, not stored on our servers and discarded after recognition), speech recognition results (transcripts), judging and feedback results |
| When using the AI tutor or reporting a problem | Questions sent to the tutor and the related problem, reasons and descriptions in problem reports |
| When subscribing | Subscription customer identifier (pseudonymous), subscription status and transaction information |
| Performance and device diagnostics (automatically collected) | GPU (graphics processor) maker and model name, memory (RAM) size, WebView version, support for graphics features (WebGL2, Vulkan), device thermal level, 3D screen frame rate, loading time, graphics quality step, display time and exit result, and a device performance tier estimated from these |
| Avatar settings | Selected appearance identifiers, including skin tone, face, hair style and color, and the current profile image |
| When using draws | Internal user identifier (_id), transaction identifier, pool and version, previous appearance and result/tier, free and paid Diamonds and tickets used and balances, probability and guarantee information, store-country code and decision information, and processing time |
| Store-country confirmation | Country code supplied by Apple StoreKit Storefront or Google Play Billing and reported by the app, platform/source, and observation time |
| Avatar customization | Clothes and accessories owned and worn (including whether hidden), personality, wardrobe capacity, gift box, records of shop purchases, seasonal outfit draws, accessory draws, sales and combinations (including free and paid Diamonds and tickets used, probability and guarantee information, and store-country decisions), the ticket chosen as a weekly reward, and full-body pose images |
| Learned-sentence bubble | One learning sentence per day chosen from those answered correctly in the last 7 days (shown according to the visibility setting), and the visibility setting |
| Home-mode records | Dates on which village, Clubhouse or social features were used (dates only, not what was done; up to the latest 14 village dates and 7 social dates) and the last date of use, dates and number of mode suggestions shown or dismissed, the date and time the mode was changed, and the current home mode |
| Current status | Whether online or studying, the type of study in progress, the type of screen being viewed (home, village, Clubhouse, shop, social), and the seat taken in a Clubhouse (refreshed about every 2 minutes while the app is in use), and the hide setting |
| Clubhouses | Clubhouses created or joined, member role, daily contribution points, goal completion, removal and block records, wake-up nudges, and furniture themes bought and applied |
| Guestbook notes | Note text, chosen stationery, sender and recipient, time sent, reactions, whether kept in the album, and whether reported |
| Stars | Star wallet balance and records of Stars earned and spent (including daily correct-answer counts and goal steps from daily study records) |
| Study buddies | Recent study activity, time zone and learning languages used for matching; pairing status and end reason; cheers; and the pair's study streak |
| Social activity records | Last active date (by day); days studied together (two members who studied in the same Clubhouse at the same time, the date and overlapping minutes); friend-village visitor counts; Nogli one-question prompts and answers; village furniture earned by studying; and social notification send and open records |
| Home-screen widget (stored only on the device) | Study streak, today's goal progress, your profile image, and the number of friends studying now (a number only) |
Email addresses, public usernames, and IP addresses are not copied into draw records. Only the internal identifier (_id) is used to link the user. General Service access logs are managed separately under the automatic-collection category above.
The store-country code is processed to determine whether paid sources may be used for draws and to record that decision. It is information read from the payment platform and reported by the app, and is not replaced by self-reported nationality, IP address, or app language.
Avatar profile images are composed on the server from pre-made layers corresponding to selected appearance identifiers. Photos of faces or hair from the device are not uploaded for this purpose. Collection of profile images supplied by social-login platforms follows the social-login category above.
Performance and device diagnostics are measured automatically by the app, sent to Google Analytics for Firebase, and processed as app usage statistics linked to the member's internal identifier (_id). No new device identifier is created for this purpose, and screen content, photos, and location are not collected. Information that the analytics tool collects by default, such as device model and OS version, falls under the automatic-collection category above.
Information visible to other members: Current status is visible only to members of the same Clubhouse, mutual followers and your study buddy, and the exact time is not shown. Learned-sentence bubbles are visible by default to members of the same Clubhouse and mutual followers, and can be changed to “Clubhouse only” or “Off” in settings. Clubhouse members, and members who mutually follow the host and visit that Clubhouse, can see your profile image, nickname, today's goal progress, studying indicator (including the type of study), night indicator, seat and contribution points; your study buddy can see your profile image, public nickname, learning languages and current status. Guestbook notes are visible to members who can view the recipient's board. Nothing is shown to members you have blocked or to suspended members.
You can hide your current status entirely or hide only your online status in settings, and you can turn off study-buddy matching at any time. Current status itself is not kept as a history; besides on-screen display, it is used only to calculate days studied together and the last active date (by day).
Friend-village visitor counts are shown to the host only as the number for that day. To count the same member once per day, visitors are kept only as hard-to-identify values (hashes) instead of names; visitor names or lists are not stored. Days studied together are shown to the two members within that Clubhouse as a count of days studied together.
Home-screen widget values are received from the server and stored only in the widget storage on the device (Android app storage; on iOS, the App Group from the app version that supports the widget), without friends' names or faces. They are deleted when you log out and are not fetched on devices without the widget.
Nicknames, @usernames, bios, Clubhouse names and guestbook notes are automatically screened (including AI-based judgment) when registered or sent, to filter out inappropriate content.
Some features for answering by voice on learning screens use the device's (iOS or Android) speech recognition; in that case, the voice may be processed by the operating system provider (Apple or Google) under its own policy.
3. Retention and Use Period of Personal Information
A user's personal information is destroyed without delay after the purposes of collection and use have been achieved. Records necessary under applicable law or the stated retention purposes below are kept only for the corresponding periods and purposes, and stored separately after account deletion:
| Retained Item | Retention Period | Legal Basis |
|---|---|---|
| Records concerning contracts or withdrawal of subscription, etc. | 5 years | Act on Consumer Protection in Electronic Commerce (Korea) |
| Records concerning payment of price and supply of goods, etc. | 5 years | Act on Consumer Protection in Electronic Commerce (Korea) |
| Records concerning consumer complaints or dispute resolution | 3 years | Act on Consumer Protection in Electronic Commerce (Korea) |
| Records concerning labeling and advertising | 6 months | Act on Consumer Protection in Electronic Commerce (Korea) |
| Access logs of the personal information processing system | 1 year or more | Standards for Measures to Ensure the Safety of Personal Information (PIPC notice) |
| Face and Hair Draw records | 5 years from creation of each draw record | Retention policy for verifying published probabilities and handling disputes, and transaction-record retention under applicable law |
| App usage and performance statistics (including performance and device diagnostics) | Up to 14 months from collection | Automatic deletion under the retention settings of the analytics tool (Google Analytics) |
| Avatar shop purchase, seasonal outfit draw, accessory draw, sale and combination records; Clubhouse furniture theme purchase records | 5 years from creation of each record | Retention of Diamond transaction records, verification of published probabilities and dispute handling (same basis as draw records) |
| Current status | 5 minutes after the last signal | Automatic deletion |
| Daily study records, daily Clubhouse scores and Nogli one-question records | 60 days | Automatic deletion (Clubhouse level is calculated from the last 28 days of points) |
| Home-mode dates | Date lists up to 14 village and 7 social dates (new dates overwrite the oldest); other values until account deletion | Deleted on account deletion |
| Wake-up nudge and buddy cheer records | 14 days | Automatic deletion |
| Friend-village visitor counts | 8 days | Automatic deletion |
| Daily social notification tallies | 3 days | Automatic deletion |
| Ended study-buddy pairs | 30 days (for pairs ended by blocking, only the two members' internal identifiers are kept so they are not matched again) | Automatic deletion / prevention of re-matching |
| Guestbook notes | 7 days from being hidden (album copies of sparkle notes are kept until the recipient deletes them; reported notes until the report is resolved) | Report window after deletion · report handling |
| Star wallet and Star records; days studied together | Until account deletion | Deleted on account deletion |
Draw records, including free and ticket draws, are retained for 5 years from creation. On account deletion, they are moved to a separate storage area with restricted access, accessible only to personnel authorized for the retention purposes. They are destroyed using the methods in Section 7 when the retention period expires. The most recent 90 days available in the app are a viewing window, not the retention period.
On account deletion, avatar wardrobe, accessories, personality and home-mode records, the Star wallet and Star records, study-buddy and daily study records, days studied together, and records of village furniture earned by studying are deleted. Notes written by the deleted member and notes on that member's board are hidden immediately and deleted after 7 days (reports are accepted in the meantime, and notes with open reports are kept until resolved). Clubhouses hosted by the deleted member are closed; the member leaves Clubhouses they joined, and points already earned remain part of that Clubhouse's score. Free Diamonds received through notes and records of shop purchases, draws, sales and combinations and of Clubhouse furniture theme purchases are stored separately under the 5-year basis above.
However, records kept by entrusted parties follow the periods stated in Sections 5 and 6.
4. Provision of Personal Information to Third Parties
As a general rule, the Company does not provide users' personal information to third parties. However, the following cases shall be exceptions:
- Where the user has consented in advance
- Where a request is made in accordance with statutes
- Where processing is entrusted within the scope necessary for the provision of services (see Article 5)
5. Entrustment of Personal Information Processing
To provide the Service, the Company entrusts personal information processing tasks as follows and supervises the entrusted parties through entrustment contracts and other means so that personal information is handled safely. If an entrusted party further entrusts part of the work to another company (sub-entrustment), that company is also listed below.
| Entrustee | Entrusted Task | Retention Period |
|---|---|---|
| Amazon Web Services, Inc. | Operating service servers; storing data and logs | Until account deletion or termination of the entrustment contract |
| MongoDB, Inc. | Operating and storing the database | Until account deletion or termination of the entrustment contract |
| Cloudflare, Inc. | Delivering and securing service traffic; storing files such as avatar profile and full-body images | Until the entrustment contract ends, or for the period under the processor's data retention policy |
| Google LLC | Push notifications (Firebase Cloud Messaging), app usage and performance analytics and purchase statistics (Google Analytics for Firebase), crash analysis (Firebase Crashlytics), email delivery (Google Workspace), ad consent management | Until the entrustment contract ends, or for the period under the processor's data retention policy |
| OpenAI, L.L.C. | Speech recognition of speaking recordings, AI tutor answers, problem-report triage, automatic screening of posts, assisting speaking grading | Until the entrustment contract ends, or for the period under the processor's data retention policy |
| Typesafe AI, Inc. | Automatic screening of posts, automatic judging of spoken answers | Until the entrustment contract ends, or for the period under the processor's data retention policy |
| OpenRouter, Inc. (sub-entrusted to DeepInfra, Inc., Together Computer, Inc., Fireworks AI, Inc.) | Writing feedback on spoken answers | Until the entrustment contract ends, or for the period under the processor's data retention policy |
| RevenueCat, Inc. | Processing and managing subscription payments | Until the entrustment contract ends, or for the period under the processor's data retention policy |
When entrusting, the Company sets out, in accordance with Article 26 of the Personal Information Protection Act (Korea), matters such as prohibiting processing beyond the entrusted purpose, safety measures, restrictions on sub-entrustment, management and supervision, and liability for damages. If an entrusted party or task changes, the Company will notify you through this Policy.
6. Transfer of Personal Information Abroad
To provide the Service (perform its contract with you), the Company transfers personal information abroad as follows. Transfers take place over encrypted network connections when you use the Service.
| Recipient (contact) | Country | Items Transferred | Purpose | Retention Period |
|---|---|---|---|---|
| Amazon Web Services, Inc. (aws.amazon.com/contact-us) | Singapore | All personal information processed in using the Service (account, learning and social records, access logs, etc.) | Server operation, data storage | Until account deletion or termination of the entrustment contract |
| MongoDB, Inc. (privacy@mongodb.com) | Singapore | Account, learning, social and payment records | Database storage | Until account deletion or termination of the entrustment contract |
| Cloudflare, Inc. (cloudflare.com/privacypolicy) | United States and other countries with Cloudflare data centers | Service traffic, access IP, avatar profile and full-body image files | Traffic delivery and security, file storage | Until the entrustment contract ends, or for the period under the processor's data retention policy |
| Google LLC (privacy contact) | United States | Internal member identifier, device information and app instance ID, FCM token, app usage, performance, diagnostics and crash records, purchase events, email address and nickname, notification text | Push notifications, usage/performance/crash analytics and purchase statistics, email delivery | Until the entrustment contract ends, or for the period under the processor's data retention policy |
| OpenAI, L.L.C. (dsar@openai.com) | United States | Speaking recordings, AI tutor questions with the related problem, problem-report text, nicknames, bios, @usernames, Clubhouse names and guestbook note text, speaking transcripts | Speech recognition, AI tutor answers, problem-report triage, automatic screening of posts, assisting speaking grading | Until the entrustment contract ends, or for the period under the processor's data retention policy |
| Typesafe AI, Inc. (typesafe.ai/privacy) | United States | Nicknames, bios, @usernames, Clubhouse names and guestbook note text, speaking transcripts | Automatic screening of posts, automatic judging of spoken answers | Until the entrustment contract ends, or for the period under the processor's data retention policy |
| OpenRouter, Inc. and sub-entrustees DeepInfra, Inc., Together Computer, Inc. and Fireworks AI, Inc. (openrouter.ai/privacy) | United States | Speaking transcripts and the related dialogue line | Writing feedback on spoken answers | Until the entrustment contract ends, or for the period under the processor's data retention policy |
| RevenueCat, Inc. (compliance@revenuecat.com) | United States | Subscription customer identifier (pseudonymous), subscription and transaction information, device information | Processing and managing subscription payments | Until the entrustment contract ends, or for the period under the processor's data retention policy |
How to refuse and what happens if you do: You may refuse the transfer by contacting support@loing.app. Because these transfers are necessary to provide the Service, if you refuse you cannot use the member service as a whole or the related features (speaking practice, AI tutor, guestbook notes, etc.).
The Company transfers personal information abroad under Article 28-8(1)(3) of the Personal Information Protection Act (Korea) (entrustment or storage necessary to conclude and perform a contract with you and disclosed in this Policy), and sets out protective measures with each recipient through entrustment contracts and other means.
Information Collected by Ad Partners
To show ads in the app, the app includes Google AdMob and the tools of the ad partners below that AdMob calls when choosing an ad. These partners collect the following information directly from the device and process it under their own privacy policies.
| Ad partner | Country | Items collected | Purpose | Privacy policy |
|---|---|---|---|---|
| Google LLC (AdMob) | United States | Advertising ID (if allowed), IP address, device information (model, OS, language), ad impressions and clicks | Ad delivery and measurement, personalized ads (if allowed) | |
| Unity Technologies | United States | Same as above | Same as above | Unity |
| Liftoff Mobile, Inc. (Vungle) | United States, Singapore | Same as above | Same as above | Liftoff |
| Bytedance Pte. Ltd. (Pangle) | Singapore | Same as above (IP used to estimate city-level location) | Same as above | Pangle |
| Mintegral International Ltd. | Hong Kong | Same as above | Same as above | Mintegral |
Consent and how to refuse: The advertising ID used for personalized ads is collected only to the extent you allow it in device settings or a consent screen (shown depending on your region). You can turn off personalized ads at any time by turning off "Allow Apps to Request to Track" on iOS, or by deleting your advertising ID or opting out of ads personalization on Android. Non-personalized ads may still appear.
7. Procedures and Methods for Destruction of Personal Information
Destruction Procedure
- Selection of items subject to destruction upon expiration of the retention period or achievement of the processing purpose
- Approval by the Chief Privacy Officer
- Execution of destruction and management of records
Destruction Method
- Electronic files: Permanently deleted by technical means that make recovery and reproduction impossible
- Paper documents: Shredded with a shredder or incinerated
8. Measures to Ensure the Safety of Personal Information
The Company takes the following measures to ensure the safety of personal information:
- Encryption: Passwords are stored using bcrypt one-way encryption, and transmission channels are encrypted with SSL/TLS.
- Access restriction: Access rights to personal information are minimized, and access records are managed.
- Access control: Access rights to the personal information processing system are managed on a role-based basis.
- Key management: Sensitive information such as encryption keys and API keys is managed separately as environment variables.
- Security inspection: Regular security inspections and remediation of vulnerabilities are conducted.
9. Users' Rights and How to Exercise Them
Users may exercise the following rights at any time:
- Request to access, correct, or delete personal information
- Request to suspend the processing of personal information
- Request for membership withdrawal
Procedure for Exercising Rights
- Receipt: Submit a request through the in-app settings or to support@loing.app
- Identity verification: Verification of whether the requester is the data subject (additional authentication if necessary)
- Processing: Processed within 10 days from the date of the request
- Notification: The result of processing is notified by email
Membership withdrawal can be made in-app via [Profile > Settings > Delete account] or on the website's Account Deletion Request Page.
10. Information on Automated Decision-Making
Based on a user's learning data and the text and recordings a user submits, the Company's AI algorithms automatically make the following decisions:
- Adjustment of learning difficulty: Using the ELO rating system, questions suited to the user's level are automatically selected.
- Recommendation of customized content: Personalized learning content is recommended through analysis of learning history.
- Study-buddy matching: Buddies are matched automatically (at random) based on recent study activity, time zone and learning languages. You can turn study buddies off in settings at any time.
- Home-mode suggestions: Based on recent study days and the dates on which village, Clubhouse or social features were used, the app asks whether to change the home-screen mode. You choose the mode yourself, and after two dismissals the app stops asking.
- Automatic judging of spoken answers: Based on the recognized speaking recording, the system automatically judges an answer as correct, partly correct, wrong or no answer, and writes feedback for some results.
- Automatic rejection of posts: If nicknames, @usernames, bios, Clubhouse names or guestbook notes are judged to contain inappropriate content, registration or sending is automatically blocked.
Users may request an explanation of automated decisions and, where a decision has a significant effect on their rights or obligations, may refuse it in accordance with the Personal Information Protection Act (Korea). For related requests, please contact support@loing.app.
11. Personal Information of Children
The Company allows only persons aged 14 or older to sign up for the Service and confirms at sign-up whether the user is aged 14 or older. The Company does not collect personal information of children under 14, and if it becomes aware that personal information of a child under 14 has been collected, it will destroy that information without delay.
Our service is not directed to children under 14, and we do not knowingly collect personal information from children under 14. If we learn that we have collected such information, we will delete it promptly.
12. Receipt of Advertising Information
- The Company sends advertising information by email, push notification, or other means only to users who have consented in advance to receive it.
- When a user consents to receive advertising information or refuses it (withdraws consent), the Company notifies the user of the date and result of the processing.
- The Company reconfirms each user's consent to receive advertising information every 2 years from the date of consent.
- Users may withdraw their consent to receipt at any time in the in-app settings.
- Even after withdrawal of consent to receipt, notifications essential to the operation of the service (security alerts, changes to the terms, etc.) may still be sent.
13. Chief Privacy Officer
Person in charge: Privacy Protection Officer
Email: privacy@loing.app
External Reporting and Counseling Agencies
- Privacy Infringement Report Center: privacy.kisa.or.kr / Tel. 118
- Personal Information Dispute Mediation Committee: www.kopico.go.kr / Tel. 1833-6972
- Supreme Prosecutors' Office Cyber Investigation Division: www.spo.go.kr / Tel. 1301
- National Police Agency Cyber Investigation Bureau: ecrm.police.go.kr / Tel. 182
14. Matters Concerning Changes to the Privacy Policy
This Privacy Policy may be amended in accordance with changes in statutes, policies, or security technologies, and in the event of any amendment, prior notice will be given through in-service announcements or by email.
This amendment (1. purposes, 2. items collected, 3. timing of destruction, 5. entrustment, 6. cross-border transfers and ad partners, 10. automated decisions, 11. age wording for children) was announced on October 24, 2026 and takes effect on November 23, 2026. Through November 22, 2026, the previous policy applies.
The previous amendments concerning avatar customization, Clubhouses and other social features (announced on October 23, 2026) take effect on October 31, 2026. Through October 30, 2026, the performance and device diagnostics version (effective October 30, 2026) applies. The earlier avatar and draw amendment version (applied October 27–29, 2026) and the Previous Privacy Policy (applied through October 26, 2026) also remain available.
If you have any inquiries, please contact us at support@loing.app.