Privacy Policy

Effective date: October 22, 2026 (changes about app usage records take effect on October 23, 2026)

This is an English translation of the Korean original (개인정보처리방침). If the two differ, the Korean version governs.

Spreneur Inc. (the "Company") handles the personal information of people who use Mumbly (the "Service") in accordance with the Personal Information Protection Act of Korea and other applicable laws. This Policy explains what personal information the Company processes and why, how long it keeps it, and how it protects it.

1. Personal Information We Process and Why

Information collected at sign-up (required)

You can sign up for and sign in to Mumbly only with an Apple or Google account (only Google in the Android app). We do not collect passwords.

• Used for: verifying members and signing in, linking different sign-in methods to one account, managing members and answering inquiries, and preventing misuse such as managing the Add Content limit
• From iOS app version 1.0.4, the profile photo of your Google account is copied once and used as the starting value of your Mumbly profile photo (see 'Profile photo' below). If your Google photo changes later, we do not follow that change

Information created while you use the Service

• App usage records do not include text you type (search terms, pasted links, etc.)
• The Company uses the information above to produce usage statistics such as the number of sign-ups, the number of members who practiced, and practice time, and uses them to improve the Service. Statistics are viewed as combined numbers, and the operator views individual members' records only when needed to manage members or answer inquiries
• What we do not collect: passwords, location (device location such as GPS; app usage records keep only the region at the country level), contacts, your photo library (we receive only the one photo you choose as your profile photo), voice (the app does not use the microphone), or advertising identifiers. We do not do ad tracking. However, if you use Google sign-in, Google may estimate your approximate location from your IP address to prevent misuse, and the Google Privacy Policy applies to this
• We do not make automated decisions with personal information that have legal effects or similarly significant effects on users

2. Retention Periods

• Member information, topics of interest and listening level answered at first sign-up, and practice records: until the member withdraws (deletes the account). They are deleted without delay on withdrawal
• Profile photo: when you change it to another photo, the previous one is deleted, and it is deleted immediately when you remove the photo or withdraw
• Segments you added
  • Segments not yet published and visible only to you (awaiting review, being created, failed, or ones the operator decided not to publish) are deleted on withdrawal
  • Segments the operator reviewed and published to all users remain as Service content, and the information about who added them is deleted (only content that cannot identify that person remains, such as the video link, range, and script)
• Add Content records (time added, video link, outcome, cost): on withdrawal, who made them is deleted, and only the video link, time, and outcome are kept for cost accounting and limit management
• Service usage records: deleted after 7 days
• App usage records: on withdrawal, the information linking them to the member is deleted so that no one can tell whose records they are, and they are then kept for usage statistics
• Notifications: the device notification token is deleted immediately when you sign out or withdraw, and tokens that notifications no longer reach are deleted after 90 days. Notification settings, consent records, and records of notifications sent are kept until withdrawal
• Inquiries: on withdrawal, who sent them and the reply email are deleted, and only the message, inquiry type, time sent, and app and device information are kept to improve the Service
• Information kept as required by law: sign-in records (IP address and device information of sign-in sessions): 3 months. Sign-in records unused for 3 months are deleted automatically

3. How Information Is Destroyed

• Information whose retention period has ended or whose purpose has been achieved is destroyed without delay. Withdrawal is processed as soon as you request it in the app
• Electronic files are deleted in a way that cannot be recovered. No personal information is kept on paper
• Information kept because of legal requirements is stored separately from other information and is not used for any other purpose

4. Provision to Third Parties

The Company does not provide personal information to third parties. The only exceptions are when the law has special provisions or when an investigative agency requests it through procedures set by law.

5. Outsourcing of Processing

To run the Service, we entrust the processing of personal information to the companies below. Our contracts require them to handle personal information securely.

Outside services we do not send personal information to

• Anthropic, PBC (generative AI Claude): creates scripts, translations, and words from the English captions, video title, and channel name of segments that users add. We do not send account information or anything that could identify a user
• Webshare: a relay (proxy) service used to fetch YouTube captions. Only video links pass through it, and no user information is sent

6. International Transfers

To run the Service, personal information may be transferred to, or processed by, companies outside Korea as follows.

If you do not want these international transfers, you can choose not to sign up, or withdraw. However, the Service cannot be provided without them, so in that case you cannot use the Service.

7. Your Rights and How to Exercise Them

• You can ask at any time to view, correct, or delete your personal information, or to stop its processing, and you can withdraw your consent
• Deleting your account: in the app, open Settings at the top right of the Profile tab > Account, tap "Delete Account" at the bottom, and confirm once more. You are withdrawn and your information is deleted immediately (the same in the iPhone and Android apps). If you have signed in with Apple, deleting your account in the iPhone app also removes Mumbly's sign-in connection to your Apple account. If you deleted it in the Android app or by email, you can remove Mumbly yourself under "Sign in with Apple" in your Apple account settings. You can also remove Mumbly's access to your Google account in your Google account settings. If you have deleted the app or can't use it, email [email protected] with the subject "Account deletion request" from the email address you use to sign in to Mumbly. After confirming it's you, we delete the account within 10 days and let you know the result (how to delete your account)
• Send any other request to [email protected]. After confirming your identity, we will handle it within 10 days and let you know the result
• A legal representative or an authorized person can also make a request. In that case, please include a letter of authorization
• Where the law protects the rights of others or requires retention, we may refuse part of a request and will tell you why

8. Children's Personal Information

Only people aged 14 or older can sign up for the Service, and people living in Vietnam can sign up only if they are 16 or older. We do not collect personal information from children below this age, and if we learn that someone below this age has signed up, we delete that account and its information without delay. Where the law requires apps to check age (such as in some US states), the app checks whether you are 14 or older using the age range provided by the App Store (Apple) or Google Play, and you can't use the app if you are under 14 or if a required check has not been completed. This age range is used only for the check on your device and is not sent to or stored on our servers.

9. Automatic Collection

• We do not use ad tracking or outside analytics tools. We collect app usage records ourselves to improve the Service (Section 1)
• The app stores the following only on your device: your sign-in state (in the device keychain on iPhone, in the app's private storage on Android), practice records and app usage records not yet sent to the server, the app install ID, screen settings (showing translations and progress, repeat), an Apple sign-in name not yet saved to the server (iPhone), and a copy of your profile photo (deleted when you sign out). Deleting the app also deletes the practice records and screen settings. On iPhone, your sign-in state may remain in the keychain, so to remove everything from the device, sign out and then delete the app. On Android, deleting the app also deletes your sign-in state
• Videos are played with the official YouTube player. During playback, YouTube (Google) may collect information through cookies and similar means, and the Google Privacy Policy (https://policies.google.com/privacy) applies to this
• The website mumbly.kr does not use cookies. You can refuse cookies in your browser settings

10. YouTube API Services

Mumbly uses YouTube API Services (the official YouTube embedded player) to play videos. When you use Mumbly, the YouTube Terms of Service (https://www.youtube.com/t/terms) also apply, and the Google Privacy Policy (https://policies.google.com/privacy) applies to information that YouTube processes. Mumbly does not access your YouTube account information.

11. Use of Generative AI

Script cleanup, sentence-by-sentence translations, key expressions, and word meanings and levels for segments are created or refined with generative AI. In this process, we do not send users' personal information to the AI.

12. Security Measures

• Administrative measures: the people who handle personal information are kept to a minimum (the operator), and only the operator account can use the admin tool
• Technical measures
  • All communication between the app, the website, and the servers is encrypted (HTTPS)
  • Row-level access control on the database means users can read and write only their own records. Information users don't need, such as operator notes, is blocked at the column level
  • We do not collect passwords and use only Apple and Google sign-in
  • Server access keys are managed only by the operator, and the app contains only keys that are safe to make public
• Physical measures: data is kept in a cloud data center run by Supabase (Amazon Web Services, Seoul region)

13. Privacy Officer

For questions, complaints, or remedies related to personal information, please contact us below. We will respond and handle it without delay.

• Privacy officer: Jimin Kim
• Email: [email protected]

14. Remedies for Infringement

If you need advice or a remedy for a privacy infringement, you can contact the following Korean agencies.

• Personal Information Dispute Mediation Committee: 1833-6972, www.kopico.go.kr
• Personal Information Infringement Report Center (Korea Internet & Security Agency): 118, privacy.kisa.or.kr
• Supreme Prosecutors' Office: 1301, www.spo.go.kr
• Korean National Police Agency: 182, ecrm.police.go.kr

15. Changes to This Policy

If we change this Policy, we will announce it on this page 7 days before it takes effect. Changes important to users' rights will be announced 30 days in advance.

• Announced: October 22, 2026
• Effective: October 22, 2026 (it takes effect on the day of the announcement)
• What changed: with the Android app, described the operating system and country (read from the SIM, mobile network, or time zone) that the Android app records in app usage records, where the app was installed from, and where data is stored on the device (Sections 1 and 9). Added the age check that uses the age range from the App Store or Google Play where the law requires it (Section 8), and how to request account deletion by email without the app and how to remove the Apple sign-in connection when you delete your account in the Android app (Section 7). Clarified that profile photos, notifications, answers at first sign-up, and in-app inquiries apply from iOS app version 1.0.4 (Section 1)
• Earlier announcement: announced October 21, 2026, effective the same day. Added that people living in Vietnam can sign up only if they are 16 or older (Section 8), and profile photos (a copy of your Google photo as the starting value, or a photo you choose in the app) and their retention period (Sections 1, 2, and 9). Profile photos are processed from iOS app version 1.0.4, which includes that feature
• Earlier announcement: announced October 20, 2026, effective the same day. Added the information used for app push notifications (device notification token, notification settings and consent records, records of notifications sent) and its retention periods, Apple's delivery of notifications, the topics of interest and listening level answered at first sign-up, and inquiries sent from the app (including the reply email) (Sections 1, 2, 5, and 6)
• Earlier announcement: announced October 16, 2026, effective October 23, 2026. Added the items collected as app usage records and their retention periods (Sections 1, 2, 5, and 9). It takes effect as planned
• Previous policy: effective October 12, 2026

Spreneur Inc., [email protected]