Privacy Policy
임재웅 (the "Operator") handles personal information as described below while providing the learning service Pocat (the "Service"). This policy takes effect on 2026-09-23.
1. Who handles your data, and how to reach us
- Data controller: 임재웅
- Contact: contact@pocatai.com or the contact page
Send any privacy question, or any request to see or delete your data, to that address.
2. What the server stores
The Service stores only the learning material you save, your learning records and your access state. There is no separate sign-up step, and we do not collect your name, phone number, address or payment details.
| Area | What is stored | Why |
|---|---|---|
| Account | The user identifier issued by the sign-in provider (Auth0) | To tell whose saved cards are whose |
| Capture Batch | Batch title, source excerpt, time saved, a key that prevents duplicate saves, whether it is locked | To show you what you saved |
| Card | Prompt, answer, elaboration, whether it is a favorite, its state (inbox or review), the next review time | To build the learning and review screens |
| Test | Questions, options and the correct answer, explanations, revision, results (number correct, number of questions, completion time) | To offer multiple-choice practice per batch |
| Learning and review results | Per-card result (correct or incorrect), when it happened, the device time zone at that moment, when the server received it | To schedule reviews and ignore duplicate uploads |
| Review history | Review time, rating, the next due date and the scheduling values computed from it | To recompute the review schedule |
| Access | Trial start and end, monthly free unlock usage, whether paid access is active, and subscription expiry or lifetime status | To provide the Trial, Free Access and Subscription features |
| Review reminders | Whether reminders are on, the reminder time and time zone, the device push token, a per-day delivery record | To send the review reminder at the time you chose |
Your email address is not stored on the server. The email address and name you signed in with are held by the sign-in provider (Auth0); the server receives only the user identifier from it.
3. About source excerpts
When cards are saved, part of the conversation they came from (a source excerpt) is saved with them. That text comes from your conversation with an AI and may contain sensitive material, so the Operator holds to these rules.
- When you save from an AI tool such as ChatGPT or Claude, the Service receives only what the save request contains: the batch title, the source excerpt, the cards and any Test. It never receives the whole conversation or your account with that AI tool, and it asks the AI tool to send only the smallest excerpt the cards need.
- Content that looks like a payment card number, a government identifier such as a resident registration or social security number, a medical record identifier, a password, an API key or other authentication secret, or a one-time verification code is refused before it is saved. Refused values are neither stored nor logged.
- Source excerpts are kept for you to view in the Service. Card and Test contents are used for learning and for tasks you request through a connected AI, such as editing cards or authoring Tests.
- Source excerpts and card and Test contents are never written to server logs, analytics events or error reports.
- The operator does not use this content for advertising, public disclosure or AI model training, or sell it. Section 6 explains what is shared with an AI you connect.
- A source excerpt is deleted together with its batch.
The safest way to keep something out of the Service is not to save it as a card in the first place.
3-1. Prohibition on storing or sharing children's personal information with AI
The Service is a knowledge-learning tool for general audiences and is not designed or promoted to explicitly target children under 13. Saving personal information of children under 13 or below the applicable legal age of consent for personal-data processing as learning material, or asking a connected AI such as ChatGPT or Claude to retrieve or receive it, is not permitted. Do not include information that identifies a child, such as their name, contact details, address or school, in cards, source excerpts or Tests.
When the Operator identifies such content or requests, it refuses the request or restricts use of the affected material and takes necessary measures, including deletion. If you find such information in your material, delete the material and, if action by the Operator is needed, contact contact@pocatai.com or use the contact page. Do not send the child's personal information again in your inquiry; provide only the minimum details needed to locate the affected material, such as its identifier.
4. What is stored on your device
So that learning works offline, the iPhone and iPad app keeps the batches, cards, source excerpts and Tests it received from the server, plus results not yet uploaded, on the device. Deleting the app removes them from the device. Sign-in tokens are kept in the iOS keychain and cleared when you sign out.
In a web browser, the Service keeps your chosen display language and, so that Learning, Review and Tests can resume after a reload, your position and any results not yet uploaded in browser storage (IndexedDB). These records hold identifiers, order, positions and scores only, never the text of cards, source excerpts or explanations, your email address or sign-in tokens, and they are cleared when you sign out or delete your account. On the web, sign-in tokens are kept in memory, not in browser storage.
The website uses no analytics or advertising cookies. The iPhone and iPad app uses Firebase Analytics for service usage statistics; section 6 describes the data collected. To keep you signed in, the sign-in provider (Auth0) sets essential cookies on the sign-in domain.
Guest records and recovery
Guests store default batches, cards, Tests and learning/review records on the server under a server-issued identifier. The server stores only a hash of the recovery credential. The credential itself is kept in the device Keychain and, when iCloud Keychain is enabled, Apple synchronizes it to devices on the same iCloud account. iCloud availability or synchronization delays do not restrict purchases. Record recovery is free and separate from restoring Apple purchases.
Signing in uploads pending results before importing default content and learning records. Existing account content, progress and deletion records take precedence for the same default pack. Guest originals remain available on sign-out; later changes are not automatically merged in both directions. Linked identities share monthly free-unlock usage. Deleting guest records removes server records and recovery credentials without canceling Apple subscriptions. Remaining shared usage is retained separately from personal identifiers so deletion does not reset another linked identity’s allowance.
RevenueCat receives the guest or member identifier to verify paid access. Purchasing and restoring purchases do not require registration or iCloud.
5. What is not recorded
- The Operator does not write IP addresses or browser or device details to its server access logs. This is separate from Firebase Analytics processing of device details and approximate geography derived from IP addresses, described in section 6. The access log in front of the server records only a request id, the kind of route, the response status and the response time.
- Authentication tokens and the contents of cards and source excerpts are never written to any log or analytics event.
- The current release app does not use advertising identifiers (IDFA) or crash collection tools. Firebase Analytics uses an app instance identifier; we do not guarantee that this data is anonymous.
6. Processors and external services
The following providers are used to run the Service.
| Provider | Role | What reaches them |
|---|---|---|
| Okta (Auth0) | Sign-in and account identity | What you enter while signing in, your email address, and the issued user identifier |
| Apple, Google | Authentication when you sign in that way | The authentication details passed to that provider |
| Amazon Web Services | Running the server, database and logs; sending contact-form email | The items listed in section 2, and what you send through the contact page (emailed to the Operator, not stored on the server) |
| Apple | Subscription and lifetime payments; delivering review reminders | Apple handles payment details and the Operator never receives them. Review reminders pass the device push token and the reminder text |
| RevenueCat | Checking subscription and lifetime purchase entitlements; purchase analytics | User identifier and App Store product, purchase, renewal, expiry and refund information |
| Google LLC | Service usage statistics (Firebase Analytics) | App launch, screen, learning, review, Test, favorite and purchase-screen interactions; device, OS and app versions; app instance identifiers; approximate country/city derived from IP addresses; and automatically collected App Store purchase events. Card prompts/answers, source excerpts, Test contents, emails and sign-in tokens are not sent in analytics events |
| Supabase | Database for the development and testing environments | The section 2 items saved in those environments |
Data of the live service is kept on AWS. When you connect an AI tool such as ChatGPT or Claude and request a task, it can read metadata such as batch titles, saved dates, card counts, lock status and tags, as well as the selected unlocked batch's cards (prompts, answers and elaborations) and Test (questions, options, correct answers and explanations). These read tools do not return source excerpts or learning and review records. The AI provider's policies govern how it handles the shared material and your conversation.
7. Transfers outside Korea
The server and database run in the AWS Seoul, Republic of Korea (ap-northeast-2) region. Sign-in is processed on Okta (Auth0) infrastructure, and identity information may be transferred abroad in the course of it. What is transferred is the information needed to sign in and the user identifier; the purpose is sign-in and account identification; retention follows that provider's policy.
Firebase Analytics usage statistics and RevenueCat purchase information may also be processed on their infrastructure outside Korea. Purposes and data are listed in section 6; retention and deletion follow each provider’s settings and policies. See Firebase privacy information and RevenueCat privacy information.
8. Retention and deletion
- Saved batches, cards, Tests and learning records are kept until you delete them or delete your account. There is no separate automatic expiry.
- Deleting a card also deletes that card's learning and review records. Deleting a batch also deletes its source excerpt, every card in it, their learning and review records, and the batch's Test and its results. Deleting only a Test deletes its questions and results. Deletion cannot be undone.
- Deleting your account immediately deletes every item in section 2 and your sign-in account at the sign-in provider (Auth0).
- The database is backed up once a day and each backup is kept for 14 days. Deleted material can remain in those backups for up to 14 days before it disappears with them.
- Server and access logs are kept for 14 days and then deleted automatically.
- External providers’ analytics and purchase records are separate from the 14-day retention of the Operator’s server logs and follow those providers’ retention settings and policies. Send requests to access or delete these records to the contact address above.
9. Your rights and account deletion
- You can open, edit and delete unlocked batches and cards in the iPhone and iPad app, and open and study them on the web. Access to unlocked batches continues after a trial or subscription ends. The Terms of Service and Refunds explain Locked Batch access limits and re-locking after a refund.
- You can delete your account yourself under Settings > Delete account in the iPhone and iPad app or on the web. This deletes all of your data on the server and your sign-in account at the sign-in provider (Auth0); signing in again the same way creates a new, empty account. You can also ask at contact@pocatai.com or through the contact page.
- Your Apple or Google account itself is not deleted and stays with that provider. Deleting your account does not cancel an App Store subscription; cancel it separately in the App Store.
- Requests to access, correct, delete or restrict the processing of your personal information can be sent to the contact address above and are handled within the period the applicable law sets.
10. Security measures
- All communication is encrypted with HTTPS.
- The disk the database is stored on is encrypted, and the database credentials are held in a separate secret management service.
- Every request is verified against a token signed by the sign-in provider, and requests are scoped so no one can reach another user's material.
- Authentication uses tokens rather than cookies, and tokens are kept only in the device's secure storage.
- The server container runs with a read-only file system and a least-privilege account.
11. Changes to this policy
Changes to this policy are posted on this page with their effective date at least 7 days in advance, or at least 30 days in advance when they are unfavourable to users.
Effective date: 2026-09-23
Public batches and personal copies
With your consent, your public nickname and allowed card content are stored as a public version. Filtering uses rules within our server and does not send this content to an external AI. Reports store the reporter account identifier, public version, reason category and submission time. Author blocks store account-specific blocking relationships. Sign-in names, emails, source excerpts and study records are excluded from public APIs and web previews. Public responses show only the first card.
Publications and associated reports are deleted when the original batch or creator account is deleted. Copies already captured by other users retain their card content and public attribution (public ID, version and nickname) until those users delete their copies or accounts. Withdrawal does not recall existing copies.
Current feature and data-collection description corrected: 2026-10-02
Explanation of the policy prohibiting storage and AI sharing of children's personal information added: 2026-10-04