Privacy Notice

Who is responsible

CherryK is responsible for the personal data described in this notice. For privacy questions or requests to access, correct, or delete your data, contact CherryK privacy support at leekw1245@gmail.com.

What we collect

• Account data: your Google account identifier, display name, email address, email verification status, profile image, and the information needed to maintain your signed-in session.
• Learning content: Korean text you type or confirm after OCR, correction results and explanations, identified learning tags, quiz answers and progress, and the times of completed learning activities. Your browser’s time zone is used to calculate local learning days and streaks.
• Service usage: daily correction and OCR usage counts, plus anonymous website analytics such as the page, referrer, country, device type, operating system, and browser.

Why we process it

We process this information to authenticate your account, provide the OCR or correction you request, show reviewed practice, remember learning progress, enforce usage limits, secure the service, and understand aggregate website reliability and use. We do not sell your personal data.

Google sign-in and domestic processing

Google handles the sign-in flow and, with your approval, returns the account information listed above to CherryK. Google processes the sign-in interaction under its own Privacy Policy.

Oracle Corporation · Chuncheon, South Korea

Purpose and data:Oracle Cloud Infrastructure hosts CherryK's Nginx, Spring backend, and PostgreSQL database. Each authentication or API request can include account claims, session cookies, IP and request metadata, OCR images, correction text, or quiz requests. PostgreSQL stores account, identity, session, correction, quiz, learning-progress, and usage records.

Timing and method: each authentication and API request, forwarded by Vercel over HTTPS to OCI Chuncheon.

Retention: request content is processed in memory and is not included in ordinary logs. Nginx and OCI security access metadata such as IP, path, time, status, and user agent is retained for no more than 30 days. Root-only PostgreSQL logical backups are retained on OCI for no more than 7 days and are not used for ordinary processing.

Contact: Oracle Korea privacy representative, privacy_kr_grp@oracle.com, 02-2194-8000

NAVER Cloud CLOVA OCR · South Korea

Purpose and data: handwriting image recognition using the normalized image you choose to upload.

Timing and method: each OCR request, over HTTPS to the CLOVA OCR Korea region.

Retention: CherryK does not persist the original image. CLOVA states that it does not store or use the image or recognition result after processing and retains only minimal access records for billing. The extracted draft remains editable, and only text you confirm and submit for correction is stored with the result.

Overseas processing and storage

The following transfers are necessary to provide the requested service or operate CherryK. Data is sent through encrypted connections when you use the relevant feature.

OpenAI OpCo, LLC · United States

Purpose and data: Korean text, learner level, and generated correction output for a correction you request.

Timing and method: each correction request, over HTTPS to the OpenAI Responses API.

Retention: CherryK sends store: false, so no Responses application state is kept. OpenAI may retain content in abuse-monitoring logs for up to 30 days, or longer when legally required. API data is not used to train models by default.

Contact: privacy@openai.com

Vercel Inc. · United States and global edge locations

Purpose and data: frontend delivery and same-origin routing to the CherryK backend. Vercel transiently handles request IP, headers, path, session cookie, and request content such as correction text or an OCR image. Anonymous analytics use page, referrer, country, device, OS, browser, and event time and are not linked to your CherryK account or IP address.

Timing and method: on page requests and navigation, over HTTPS.

Retention:request bodies are processed in transit and CherryK does not intentionally log them on Vercel. Vercel runtime request metadata is retained for no more than 30 days, depending on the active plan. The analytics visitor identifier is discarded after 24 hours; anonymous aggregate metrics remain for the plan's reporting window.

Contact: privacy@vercel.com

How long we keep data

• Sessions: 90 days after the last activity, unless you sign out earlier.
• Account and learning records: until a verified account-deletion request is completed.
• OCR originals: processed in memory for the request and not retained by CherryK or CLOVA after the response.
• Provider and backup data: for the periods stated in this notice.

If law requires a record to be retained longer, we keep only the required data for that statutory period and do not use it for another purpose.

Deletion and destruction

Send a request to the privacy contact above. After verifying control of the account, CherryK completes a valid request within 30 days by permanently deleting the account and linked learning records from the active database. Provider-side records expire within the periods stated above. OCI backup data is isolated from ordinary use, expires within 7 days, and is not restored except for disaster recovery or a legal requirement.

Your choices and rights

You may request access to, correction of, deletion of, or restriction on your personal data, and may raise a question about how it is handled. Some requests require account verification.

• You can avoid CLOVA processing by entering text instead of uploading an image.
• You can avoid OpenAI processing by not submitting text for correction; CherryK cannot provide an AI correction without it.
• Browser controls may block Vercel Analytics without affecting core learning features.
• OCI PostgreSQL storage is required for signed-in accounts and saved learning records; refusing it means CherryK cannot provide those features.

Security

We use access controls, secure session cookies, encrypted network connections, and restricted provider credentials. No online service can guarantee absolute security, but we limit access to what is needed to operate CherryK.

Changes to this notice

We may update this notice when CherryK changes. The effective date at the top of this page will be updated, and material changes will be communicated through the service when appropriate.