Privacy Policy
In short
- If you do not sign in, your learning records stay on this device. We do not send them to our server.
- If you create an account, we store your email, nickname, birth year and learning records to sync devices, run guardian reports and group rankings.
- There are no ads and no analytics or tracking tools. We do not read advertising identifiers.
- Deleting your account in the app erases your data on our server right away.
1. Scope
This policy covers OkiVoki (the “app”), an English vocabulary app provided by Laonmon (“we”), its account server and this website.
Every learning feature works without signing in. An account is only for people who want to sync devices, connect with a guardian, join a friend group, play remote duels or share a purchase with family.
2. Information we handle
| When | What | Where |
|---|---|---|
| Using the app without an account | Profile name, learning records, settings, profile lock PIN (hash only) | On this device only. Never sent to our server |
| Creating an account with email | Email address, password (stored only as a one-way hash), nickname, avatar (one of the pictures the app offers), birth year. The app language only picks the language of our emails and is not stored | Server |
| Signing in with Apple or Google | The above except a password, the provider’s user identifier, and the email the provider shares (a relay address if you use Apple’s Hide My Email). For Apple, an encrypted token used to revoke the link when you delete your account. We do not receive your name | Server |
| Sign-up under 14 | While waiting for consent, only the child’s email and the guardian’s email. After consent, the account items above and the time of consent. See the children’s privacy notice | Server |
| Sync and backup | Learning records (right or wrong answers, response times, word numbers, test results, game progress such as starlight), settings, timestamps and time zone, and random device and profile numbers created by the app | Server |
| Guardian links, groups, duels | Links, the child settings and locks a guardian chose, group name and members, weekly starlight, duel scores and response times | Server |
| Reports | Who reported (account), what was reported (the account of a group member or duel opponent, or a group), a copy of the nickname or group name at the time, the reason (inappropriate name, harassment, spam, other) and the time | Server |
| Purchases | Whether “Unlock everything” is active and the user number of our purchase service (RevenueCat). We never receive card numbers or other payment details (Apple and Google handle payment) | Server, RevenueCat |
| Weekly guardian notification | The push token of a signed-in device, device type (iOS or Android) and notification language (the only place the app language is stored), only if notifications are allowed | Server |
| Created automatically | Sign-in session records (creation time, a hash of the refresh token), counters that block brute-force attempts (IP addresses and emails turned into one-way hashes and kept briefly), web server access logs | Server |
What we do not collect: real name, phone number, address, location, contacts, photos, camera, microphone, advertising identifiers (IDFA, AAID). The app contains no advertising, analytics or tracking SDK, and the Android advertising ID permission is blocked.
Pronunciation uses the device’s built-in speech, so words never leave the device. “More in the dictionary” on a word screen simply opens the Cambridge Dictionary website in your browser; the app sends nothing to that site.
3. Why we use it
- Creating accounts, signing in and confirming identity (email verification, password reset)
- Syncing learning records between devices and restoring them on a new device
- Obtaining and keeping a record of guardian consent for sign-ups under 14
- Guardian links, guardian reports and weekly notifications, applying settings a guardian chose
- Weekly friend group rankings, remote duels, sharing “Unlock everything” within a family group
- Confirming purchases and removing access after a refund
- Reviewing reports and preventing misuse of the service
- Preventing abuse (limits on sign-in, invite codes and consent emails; score re-checks) and answering your questions
4. How long we keep it
Account information and learning records are kept until you delete your account. Other records are deleted automatically as below.
| Information | Kept for |
|---|---|
| Account, learning records, settings, guardian links, group membership and weekly starlight, duels, family, push tokens | Deleted from the server as soon as the account is deleted |
| A friend group you created | If other members remain when you delete your account or leave, the group and its name stay and the member who joined earliest takes it over. The group is deleted when its last member leaves |
| Reports | Deleted automatically after 180 days, or earlier when the reporter or the reported account or group is deleted |
| Sign-ups whose email was never verified | Deleted after 7 days |
| Unanswered consent requests for under-14s (child’s and guardian’s email) | Deleted after 7 days, or at once if the guardian declines |
| Record of guardian consent | While the child’s account exists. If the guardian deletes their own account, their email is erased and only a hash of it and the time of consent remain as proof, until the child’s account is deleted |
| Sign-in refresh tokens | 60 days (void at once on sign-out or password change) |
| Invite codes | 24 hours, or deleted once used |
| Remote duels | Deleted 30 days after they expire (72 hours) |
| Token for revoking the Apple link | After account deletion, until Apple accepts the revocation (hourly, up to 48 attempts) |
| Rate-limit counters (hashed) | Deleted when the limit window ends |
| Web server access logs | to be confirmed before release |
| Database backups for disaster recovery | Overwritten after the set retention period (to be confirmed before release). A deleted account disappears from backups after this period |
Apple, Google and RevenueCat keep purchase history under their own policies. We keep no separate purchase ledger; we ask RevenueCat when needed. Electronic data is erased so it cannot be recovered.
6. Service providers and international transfers
These providers handle personal information only as needed to run the service.
| Provider (country) | Role | Data |
|---|---|---|
| RevenueCat, Inc. (USA) | Confirming in-app purchases, managing “Unlock everything”. Only seeing the price connects for that app session only. Once you start a purchase or a restore, or when this device has a purchase on record, the app connects at every launch after that. For a signed-in account our server checks access by account number | RevenueCat user number (account number or anonymous number), purchase and refund records, technical data such as device and app version |
| Apple Inc. (USA) | Sign in with Apple, revoking it on deletion, delivering iOS push notifications, App Store payment | Sign-in token, push token and notification text (fixed text without numbers or names) |
| Google LLC (USA) | Sign in with Google, delivering Android push notifications (FCM), Google Play payment | Sign-in token, push token and notification text |
| Amazon Web Services, Inc. (Amazon SES; US company, processing in the Seoul region, Republic of Korea) | Sending verification, password reset and guardian consent emails (from no-reply@laonmon.com; replies go to support@laonmon.com) | Recipient email address, the link in the email |
| to be confirmed before release | Running the server and relaying network traffic | Everything stored on the server |
Email (Amazon SES) is processed in the Seoul region of the Republic of Korea, so we treat it as domestic outsourcing rather than an international transfer; if the recipient’s mail service is abroad, the email is delivered there. International transfers happen over encrypted connections when you use the feature concerned (purchase, sign-in, notifications). To avoid them, use the app without an account: then nothing is sent to RevenueCat either, unless you open the purchase screen or Restore purchase. Only seeing the price sends an anonymous number and device and app information to RevenueCat for that app session only. Once you start a purchase or a restore, or when this device has a purchase on record, this happens at every launch after that; buying also involves the store (Apple or Google).
7. Your rights
You may ask at any time to access, correct, delete or stop the processing of your personal information.
- In the app: change nickname or avatar, remove a guardian link, leave a group, turn off notifications, delete the account
- By email: support@laonmon.com. Write from your account’s email address; we confirm it is you and act without undue delay.
To keep the protection rules reliable, the birth year cannot be changed in the app after sign-up. If you entered it wrongly, contact us. A parent or legal guardian may exercise these rights for a child under 14. Depending on where you live (for example the EU, UK or a US state with a privacy law) you may have further rights, including complaining to your data protection authority.
8. Children under 14
Children under 14 can create an account only after a parent or legal guardian consents. Before consent we receive only the child’s email and the guardian’s email, to ask for that consent. See the children’s privacy notice.
9. Security
- All traffic is encrypted with HTTPS.
- Passwords are stored only as BCrypt hashes; sign-in tokens, invite codes and email links as keyed hashes.
- The Apple link token is encrypted with AES-GCM.
- Every request is limited to your own account; a guardian sees only the learning statistics of a linked child.
- Sign-in, invite codes, consent emails and password resets are rate-limited.
- Access is limited to the operator, and backups are made regularly.
11. Contact
- Operator: Laonmon, to be confirmed before release
- Privacy officer: SeungDae Bang (representative)
- Email: support@laonmon.com
12. Changes
We announce changes on this page and in the app at least 7 days before they take effect (30 days if they are less favourable to you).