Privacy Policy

Cosmo Studio Inc. (the "Company") takes the personal data of everyone using AllLang (the "Service") seriously and complies in good faith with Korea's Personal Information Protection Act and other applicable law. This policy explains, in plain language, what information the Company collects and for what purpose, and what rights you have as a user.

Article 1 (Information Collected)

The Company collects and uses the following information. Anything beyond required fields is collected only with separate consent.

① Information collected at sign-up

The Company identifies members through email sign-up or through third-party social login providers. The information collected or received through each method is as follows.

② Information you enter during onboarding and preferences

• Native language, target learning language, learning motivation, usage frequency, and other fields needed to personalize your AI tutor
• Preferred voice, notification times, theme, and other settings

③ Learning data recorded automatically while you use the Service

• Conversation transcripts with the AI tutor, correction/translation history
• Saved words, sentences, and mistakes
• Call time, streaks, word-game scores, and roleplay history

④ Payment information

Paid subscriptions are billed exclusively through the Apple App Store and Google Play, and the Company never directly collects payment method details such as credit card numbers. We only collect and manage a subscription identifier and status (active/expired/canceled) to confirm your billing.

⑤ Device and connection information (collected automatically)

• Device model, OS version, app version
• Push token used to deliver notifications
• Connection IP, error logs, anonymous usage statistics
• When the app hits an error or crashes: the error details and a record of the app's actions just before it, device model, OS and app version, and your member identifier (account ID). This never includes conversation content, your name or your email.
• Ad measurement information: your advertising identifier (on iOS, the IDFA only if you choose “Allow” when asked about tracking; on Android, the advertising ID), a device identifier used for ad measurement (AppsFlyer ID), the ad or campaign that led to your install, and key in-app events (sign-up completed, first AI call, subscription start, renewal and cancellation). This never includes conversation content.

⑥ Information collected when you contact support

When you submit an inquiry, your email address and the content of the inquiry (including any attachments) are collected.

Article 2 (Purpose of Use)

Collected information is used only within the following purposes.

• Providing the Service — the AI voice tutor and learning-history features
• Member identification, fraud prevention, and identity verification
• Sending notifications for scheduled calls and learning reminders
• Visualizing learning progress and providing statistics
• Improving Service stability and AI response quality
• Diagnosing and fixing app errors and crashes
• Measuring and improving our advertising (finding out which ads bring in new users and subscribers)
• Verifying paid subscription entitlement and managing billing history
• Responding to inquiries and handling disputes
• Fulfilling legal obligations and delivering important notices
• (With separate consent) Providing marketing information such as new feature announcements, events, and offers

Article 3 (Retention Period and Destruction)

Information you input or generate while using the Service is retained for as long as your membership is active. Upon account closure or your deletion request, that information is destroyed without undue delay, in a manner that cannot be recovered.

The following are exceptions, retained separately:

• Under the Personal Information Protection Act, information for members who have not used the Service for 1 year or more is separated and stored, then destroyed as required by applicable law.
• Member information may be kept separately for 1 year from the date your account is closed, in case of disputes, rights-infringement reports, or investigation requests.
• Where laws such as e-commerce law require retention for a set period, information is kept for that legally required period.

Electronic files are permanently deleted in a way that cannot be recovered; any printed copies are shredded or incinerated.

Article 4 (Consent to Collection)

Consent to information collection is obtained through your agreement to the Terms of Service and this Policy during sign-up; completing sign-up is treated as agreement to this Policy. Where separate consent is required for a given item, we request it at that time.

Article 5 (Outsourced Processing)

To provide real-time AI voice tutoring, the Company transmits your voice and conversation content to third-party AI providers such as OpenAI and Google for processing. These providers process data only as processors acting on the Company's behalf under contract, and do not use it to train their own models.

This processing occurs only where you have explicitly consented within the app, and you may withdraw consent by discontinuing use of voice features. The Company reflects the safeguards required under Article 26 of the Personal Information Protection Act in its contracts with these processors. Questions about our processors can be directed to support@alllang.app.

The Company also entrusts processing to the error-monitoring service Sentry (Functional Software, Inc.) to diagnose and fix app errors and crashes, which involves transferring personal information outside Korea as follows.

• Recipient: Functional Software, Inc. (Sentry) · privacy@sentry.io
• Destination country: United States
• Items transferred: error details and a record of the app's actions just before the error, device model, OS and app version, member identifier (account ID)
• Timing and method: sent over an encrypted connection when an app error occurs
• Purpose: diagnosing and fixing app errors and crashes
• Retention: deleted automatically at most 90 days after collection

Error reports never include conversation content, audio, your name, email or IP address. If you do not want this transfer, you can ask us at support@alllang.app, though our ability to diagnose problems you run into may be limited.

The Company entrusts processing to RevenueCat, Inc. to verify subscription purchases and manage subscription status, which involves transferring personal information outside Korea as follows.

• Recipient: RevenueCat, Inc. · privacy@revenuecat.com
• Destination country: United States
• Items transferred: member identifier (account ID), subscription product, status and purchase history (app store receipt data), device model, OS and app version, connection IP, ad measurement identifiers (advertising identifier, AppsFlyer ID)
• Timing and method: sent over an encrypted connection when the app runs or a purchase is made
• Purpose: verifying subscription purchases, managing subscription entitlement, and passing subscription events to our ad measurement service
• Retention: until your account is closed or the contract ends

The Company also entrusts processing to the ad measurement service AppsFlyer (AppsFlyer Ltd.) to measure how well our advertising works, which involves transferring personal information outside Korea as follows.

• Recipient: AppsFlyer Ltd. · privacy@appsflyer.com
• Destination countries: Israel and the countries where AppsFlyer operates its servers
• Items transferred: the ad measurement information in Article 1 ⑤, member identifier (account ID), device model, OS and app version, connection IP
• Timing and method: sent over an encrypted connection when the app runs and when key events occur
• Purpose: measuring advertising effectiveness (which ads led to installs, sign-ups and subscriptions)
• Retention: aggregated data up to 25 months; device-level data for the period set by each ad platform (for example, TikTok 13 months, Meta 6 months)

Article 5-2 (Sharing with Advertising Partners)

To measure and improve our advertising, the Company shares the following information with these advertising partners through AppsFlyer. Your name, email and conversation content are never shared.

• Recipients: TikTok (TikTok for Business), Meta Platforms, Inc. (Facebook, Instagram)
• Items shared: advertising identifier, app install information, key in-app events (sign-up completed, first AI call, subscription start and renewal)
• Purpose: measuring and optimizing the ads we run with that partner
• Retention: according to each partner’s privacy policy

You can opt out of ad measurement at any time:

• iOS: Settings → Privacy & Security → Tracking, and turn off tracking for AllLang. If you don’t allow tracking, your advertising identifier is not collected.
• Android: Settings → Google → Ads, and delete your advertising ID.

Article 6 (Your Rights and How to Exercise Them)

As a data subject, you may exercise the following rights against the Company at any time.

• Request access to, and a copy of, your information
• Request correction or deletion
• Request suspension of processing
• Withdraw consent (this may limit your use of some features)

The fastest way is the in-app Profile → Settings → Account → Delete account menu, which erases all learning data immediately. For any other request, contact support@alllang.app and we'll act on it without undue delay.

Article 7 (Children's Personal Information)

The Company does not intentionally collect personal information from children under 14. If we discover that we have collected such information, we destroy it immediately — parents or guardians can reach us at support@alllang.app.

Article 8 (Changes to This Policy)

If this Policy changes, we will announce the change and the reason for it via an in-app notice or this page at least 7 days before it takes effect (30 days for changes unfavorable to users). Continuing to use the Service after the effective date is treated as agreement to the revised Policy.

Article 9 (Data Protection Officer)

The Company has designated the following Data Protection Officer to handle inquiries and reports related to your personal information.

For other personal-data-infringement reports or consultations, you can contact the following Korean authorities (Korean-language service only).

• Personal Information Infringement Report Center · privacy.kisa.or.kr / 118 (within Korea)
• Personal Information Dispute Mediation Committee · www.kopico.go.kr / 1833-6972
• Cyber Investigation Bureau, Korean National Police Agency · ecrm.police.go.kr / 182 (within Korea)

Addendum

This Policy takes effect on May 29, 2026.

The revised Policy (adding the error-monitoring processor and overseas transfer) takes effect on September 24, 2026.

The revised Policy (adding the subscription-management and ad-measurement processors and overseas transfers, and sharing with advertising partners) takes effect on October 28, 2026.