TOPIK UP Privacy Policy
- Effective date: October 11, 2026 (version 2026-10-11)
- Operator: wevement (위브먼트), Republic of Korea
- Applies to: the TOPIK UP mobile app (Android and iOS, app ID
com.topikup.app), its servers (api.topikup.kr), customer support, and the website topikup.kr
wevement ("we", "us") publishes this policy under the Korean Personal Information Protection Act (PIPA) and related laws. It explains what personal information we process, why, for how long, and how you can exercise your rights. This policy is available in all 16 languages supported by the app. If the versions differ, the Korean version prevails.
Summary
- We process only what we need to run the learning service. There are no ads in the app. We do not collect advertising identifiers (IDFA/GAID) and we do not sell personal information.
- Payments are handled by the Apple App Store and Google Play. We never receive your card number or other payment method details.
- For AI feedback and the AI tutor we send only answer text, transcripts and questions. We never send your account ID, email or name. This data is not used to train AI models.
- Speaking audio files are deleted automatically within 24 hours of upload (the transcript and grade stay in your account).
- You can delete your account at any time in the app under Me → Delete account. Records we must keep by law, such as payment records, are separated from the account, pseudonymised and kept only for the legal period (Section 4).
1. Personal information we process and how we collect it
1-1. Using the app without signing in (anonymous account)
| Data | Required/Optional |
|---|---|
| Random device identifier created by the app; account ID issued by our server | Required |
| Device model, OS and version, app version, language, time zone | Required |
1-2. Signing up or signing in
| Method | Data | Required/Optional |
|---|---|---|
| Email address, password, display name | Required | |
| Google sign-in | Google account identifier, email address, name (as shared by Google) | Required |
| Apple sign-in | Apple account identifier, email address (Apple relay address if you choose Hide My Email), name (if shared) | Required |
| All | Confirmation that you are 14 or older; record of agreeing to the Terms and this Policy (version, time) | Required |
| All | Whether you agree to receive marketing messages | Optional |
Passwords are stored as one-way hashes by our authentication provider (Google Firebase Authentication). Our own servers never store your password.
1-3. Using the service
| Category | Data |
|---|---|
| Study settings | Track (EPS-TOPIK/TOPIK), country, language, industry, target level, exam date and round |
| Study records | Answers and correctness, time spent, sessions, ability estimates and predictions, review cards, study days, bookmarks, mock exam results |
| Writing | Your written answers; AI grades and corrections |
| Speaking | Voice recordings (deleted within 24 hours of upload), speech-recognition transcripts, pronunciation scores and AI grades |
| AI tutor | Your questions and the answers |
| Purchases | Product, period, subscription status and store receipt data such as transaction IDs; app user ID used by our billing service (RevenueCat); coupon and academy code redemptions |
| Pass extension request | Image proving your exam result, review outcome |
| Question error reports | Report type, comment (optional) |
| Support | Category and message, reply email (optional), app version, device model, the screen or question you were on |
| Notifications | Push token, notification settings |
1-4. Information generated automatically
- Server access logs: IP address, time, request path, errors
- App usage statistics (Google Analytics for Firebase): app instance ID, account ID (pseudonymous identifier), screen views and feature-use events, device/OS/app version, approximate region inferred from IP address (country or city level)
- Crash reports (Firebase Crashlytics): stack traces, device state at the time of the crash, installation identifier, account ID (pseudonymous identifier)
- AI usage records: number of calls, token counts and cost per feature. These never contain your answers or questions.
1-5. What we do not collect
We do not collect advertising identifiers (IDFA/GAID), GPS location, contacts, national ID numbers or other unique identifiers, or sensitive information, and we do not access your photo library (we receive only a result image you choose to upload). Speaking audio is used only for pronunciation assessment and grading, never as biometric data to identify you. Please do not include personal or sensitive information about yourself or others in writing answers, tutor questions or support messages. When you upload proof of your exam result for a pass extension, cover your passport number, alien registration number or similar ID numbers.
1-6. How we collect it
When you enter information or use features in the app, when you sign in with Google or Apple, automatically while you use the service, when you contact support, and when our billing service (RevenueCat) passes us the result of a store purchase.
2. Purposes and legal bases
| Purpose | Main data | Legal basis (PIPA) |
|---|---|---|
| Creating and managing your account, verifying you, confirming you are 14+, syncing progress across devices, processing account deletion | Account data, device identifier | Performance of contract (Art. 15(1)4) |
| Providing the learning service: diagnostic, predictions, daily set, mock exams, review, reports, league rank | Study settings and records | Performance of contract |
| Providing AI features: writing and speaking feedback, pronunciation assessment, AI tutor | Answers, audio, transcripts, questions | Performance of contract |
| Paid services: verifying purchases and subscriptions, granting and restoring access, applying coupons and academy codes, reviewing free pass extensions, handling refunds and disputes | Purchase data, proof of exam result | Performance of contract; legal obligation (Art. 15(1)2) |
| Answering support requests and sending essential service notices | Support data, email | Performance of contract |
| Study reminders, grading-complete and weekly report notifications | Push token, notification settings | Performance of contract (can be turned off in settings) |
| Marketing messages about events and offers | Push token, email | Consent (Art. 15(1)1; Network Act Art. 50) |
| Sharing study progress with an academy when you redeem its code | See Section 6 | Consent (Art. 17(1)1) |
| Crash analysis, stability and quality improvement, usage statistics | Usage statistics, crash reports | Legitimate interests (Art. 15(1)6) |
| Fraud prevention, security, legal compliance, dispute handling | Access logs, purchase records | Legal obligation; legitimate interests |
We do not use personal information for any other purpose. If a purpose changes, we will tell you in advance as required by law and ask for consent where needed.
3. Retention periods
We keep personal information until you delete your account, except as listed below.
| Data | Retention |
|---|---|
| Account and profile, study records, writing answers and grades, speaking transcripts and grades, AI tutor conversations, pass extension requests, push tokens, notification settings, consent records | Deleted immediately when you delete your account |
| Speaking audio files | Deleted automatically within 24 hours of upload, whether graded or not |
| Anonymous (not signed-in) accounts and their study records | Deleted automatically 365 days after last use (if a paid pass or subscription is still active, after it ends) |
| In-app support tickets | Deleted immediately on account deletion; billing-dispute tickets follow the legal period below |
| Support emails | Deleted within 90 days after the request is resolved; billing-dispute emails follow the legal period below |
| Server access and error logs (IP address, time, request path, error details) | 3 months; account identifiers pseudonymised on account deletion |
| Question error reports | On account deletion the comment is removed; only the report type and question are kept, pseudonymised, for content quality |
| AI usage records (call counts, tokens, cost; no content) | 1 year; pseudonymised on account deletion |
| App usage statistics | 2 months from collection (Google Analytics retention setting); aggregate reports are kept in a form that does not identify you |
| Crash reports | 90 days from collection (Firebase Crashlytics retention) |
Records kept after account deletion because the law requires it
The records below are unlinked from your account and pseudonymised (your identifier is replaced with a random one). They are stored separately from other data and destroyed when the period ends.
| Data | Period | Legal basis |
|---|---|---|
| Records of contracts and withdrawals, payments and delivery (purchases, subscriptions, refunds, transaction IDs, coupon and academy code redemptions) | 5 years | Korean Act on Consumer Protection in Electronic Commerce, Art. 6; Enforcement Decree Art. 6 |
| Records of consumer complaints and dispute handling (billing-dispute tickets) | 3 years | Same Enforcement Decree, Art. 6 |
| Server access logs | 3 months | Protection of Communications Secrets Act, Art. 15-2; Enforcement Decree Art. 41 |
Data remaining in disaster-recovery backups is overwritten or deleted on the backup cycle within 37 days at most, and is not accessed except to restore service.
4. Deleting your account and what happens to your data
Delete in the app
- Open the TOPIK UP app.
- Tap the Me tab at the bottom.
- Tap Delete account, then tap Delete account again to confirm.
Deletion takes effect immediately. A deleted account and its study records cannot be restored.
Request deletion without the app
If you have uninstalled the app or cannot sign in, email [email protected] with the subject "Account deletion request". Tell us the email address you signed up with and your sign-in method (email, Google or Apple). After confirming that you own the account, we delete it without delay, and within 10 days at most, and let you know. Never send passwords, verification codes, ID numbers or card details.
What is deleted and what is kept
| Data | What happens |
|---|---|
| Account, profile, email, display name, sign-in links, push tokens, notification settings, consent records | Deleted immediately |
| Answers, sessions, ability estimates, predictions, review cards, study days, bookmarks | Deleted immediately |
| Writing answers and grades | Deleted immediately |
| Speaking recordings, transcripts and grades | Deleted immediately |
| AI tutor conversations | Deleted immediately |
| Pass extension requests (result images), academy seat records | Deleted immediately |
| Question error reports | Comment deleted immediately; report type and question kept, pseudonymised |
| Support tickets | Message and email deleted immediately; only billing-dispute tickets are pseudonymised and kept for 3 years |
| Payment and subscription records, coupon and academy code redemptions | Pseudonymised and kept for 5 years |
| AI usage records (no content) | Pseudonymised and kept for 1 year |
| Firebase authentication account | Deleted immediately by our server |
| Server access and error logs | Pseudonymised; kept for 3 months, then deleted |
Important: Deleting your account does not cancel an App Store or Google Play subscription. To stop future charges, cancel the subscription in your store's subscription settings before deleting your account. Any remaining paid period and passes are lost when the account is deleted. Refunds follow the withdrawal and refund section of the Terms of Service.
5. How we destroy personal information
- Process: We destroy personal information without delay once the retention period ends or the purpose is achieved. Records we must keep by law are pseudonymised, kept separately and destroyed when the legal period ends.
- Method: Electronic records are deleted from databases and storage so that they cannot be recovered; we instruct our processors to delete them or use their automatic deletion features. Paper documents are shredded or incinerated.
6. Sharing with third parties
We do not sell personal information and, in principle, we do not provide it to third parties. We share it only in these cases.
(1) When you redeem an academy code (with your consent)
We share only if you enter a code from an academy or school and agree on that screen.
| Recipient | Purpose | Data | Retention |
|---|---|---|---|
| The academy or school that issued the code (its name is shown on the code screen) | Monitoring class progress and teaching | Display name, study days in the last 7 days, number of questions answered, predicted pass probability and score, weak question types | Until the academy seat ends, you withdraw consent, or you delete your account |
You have the right to refuse. If you refuse, you cannot use the academy code, but you can still buy the same features yourself.
(2) When the law requires it, for example when investigators present a warrant, or when we must comply with a legal obligation.
Apple and Google process payments themselves under their own privacy policies. If you use Google or Apple sign-in, their policies also apply.
7. Processors
We entrust the following processing to service providers. Our contracts prohibit processing beyond the entrusted task and require security measures, limits on sub-processing and liability for damage, and we supervise how the providers handle personal information.
| Processor | Task |
|---|---|
| Microsoft Corporation (Microsoft Azure) | Servers, database, file storage and backups (Japan West region); pronunciation assessment (Azure AI Speech) |
| Cloudflare, Inc. | DNS, content delivery (CDN), TLS proxy, security and attack protection, admin access control, website hosting, forwarding of support email |
| Anthropic, PBC | Generating AI writing and speaking feedback and AI tutor answers |
| Google LLC | Authentication (Firebase Authentication), usage statistics (Google Analytics for Firebase), crash analysis (Firebase Crashlytics), push notifications (Firebase Cloud Messaging), receiving and storing support email (Gmail) |
| RevenueCat, Inc. | Managing in-app purchase and subscription status; restoring purchases |
| Plus Five Five, Inc. (Resend) | Sending service emails such as support replies |
We will update this policy if a processor or task changes.
8. International transfers
To perform our contract with you, we have personal information processed and stored outside Korea as follows (PIPA Art. 28-8(1)3). All transfers use encrypted connections (TLS).
| Recipient (contact) | Country | Data | Purpose | When and how | Retention |
|---|---|---|---|---|---|
| Microsoft Corporation (https://aka.ms/privacyresponse) | Japan (Azure Japan West) | All service data in Section 1 (account, study records, writing and speaking data, support, purchase records, access logs) | Servers, database, storage, backups | Continuously over the network while you use the service | Periods in Section 3; deleted when the contract ends |
| Microsoft Corporation (Azure AI Speech) | Japan (Japan West) | Speaking audio, reference sentence | Pronunciation assessment | Over the network when you submit a speaking answer | Not stored after processing |
| Cloudflare, Inc. ([email protected]) | USA and other countries where Cloudflare's network operates | App and website traffic (in transit), IP address, request data, support email (in transit) | DNS, CDN, TLS proxy, security, website hosting, email forwarding | Continuously over the network | Deleted after transmission; security logs for a short period under Cloudflare's policy |
| Anthropic, PBC ([email protected]) | USA | Writing answer text, speaking transcripts, AI tutor questions and the related question content; never your account ID, email or name | Generating AI feedback and tutor answers | Via API when you use an AI feature | Automatically deleted from Anthropic's systems within 30 days of receipt; up to 2 years if flagged for usage-policy violations; not used for model training |
| Google LLC (https://support.google.com/policies/troubleshooter/7575787) | USA and other countries with Google data centres | Authentication: email, password (hashed), display name, sign-in provider ID, IP address. Statistics and crashes: app instance ID, account ID (pseudonymous), usage events, crash reports, device info, approximate region. Push: push token, app version. Support email: email address, message | Authentication, usage statistics, crash analysis, push notifications, receiving support email | Continuously over the network while you use the app | Authentication data: until account deletion. Statistics: 2 months. Crash reports: 90 days. Push token: until account deletion or token expiry. Support email: 90 days after resolution (billing disputes 3 years) |
| RevenueCat, Inc. ([email protected]) | USA | App user ID, store receipts and transaction IDs, product, period, price and currency, country, device platform | Subscription status, restoring purchases | Over the network when you buy or open the app | Deleted after the 5-year legal retention period for payment records |
| Plus Five Five, Inc. (Resend) ([email protected]) | USA | Recipient email address, email content | Sending service emails | Via API when an email is sent | For the period set by Resend's retention policy after sending |
How to refuse and what happens: These transfers are necessary to provide the service. To refuse, you can stop using the service and delete your account, or ask [email protected] to stop processing; you will then be unable to use all or part of the service. If you do not use AI features, nothing is sent to Anthropic; if you do not use speaking practice, nothing is sent to Azure AI Speech.
9. AI features
- Writing feedback, speaking feedback and AI tutor answers are generated automatically by Anthropic's Claude models. Pronunciation scores are produced by Microsoft Azure AI Speech.
- AI output may be wrong or inaccurate and is not an official score from NIIED (TOPIK) or HRD Korea (EPS-TOPIK).
- We send AI providers only what is needed for grading and answers (text to Anthropic, audio for pronunciation assessment to Azure AI Speech), never your account identifiers. By default, Anthropic does not use data received through its commercial API to train its models.
- Please report inappropriate AI responses with the in-app report function or through support. Reports are used only to improve quality and prevent recurrence.
- Predicted scores, pass probabilities and AI grades are study aids. They are not fully automated decisions that significantly affect your rights or obligations within the meaning of PIPA Art. 37-2. You may still ask us to explain how a result was produced.
10. Automatic collection tools and how to refuse
- Instead of web cookies, the app uses the Google Analytics for Firebase (usage statistics) and Firebase Crashlytics (crash analysis) SDKs to collect the data in Section 1-4. We do not collect advertising identifiers, track you across other companies' apps or websites, or use the data for targeted advertising.
- If you do not want usage statistics collected, ask [email protected] to stop processing. Uninstalling the app stops further collection.
- The website topikup.kr does not set advertising or analytics cookies of our own. Our hosting and security provider (Cloudflare) may use security technologies; you can block or delete cookies in your browser settings.
11. Your rights and how to exercise them
- You may at any time ask to access, correct, delete or stop the processing of your personal information, and withdraw consent.
- In the app you can edit your display name and study settings (My), change notification and marketing settings (My → Notifications) and delete your account (My → Delete account).
- For other requests, email [email protected]. After verifying your identity we act without delay, and within 10 days at most, and tell you the result.
- A legal representative or a person you authorise may also make requests, with documents proving their authority such as a power of attorney.
- We may refuse or partly fulfil a request where a law specifically provides for it, where it is unavoidable to comply with a legal obligation, or where it may harm another person's rights; we will tell you why.
- You must keep your account secure and must not enter or misuse other people's personal information.
12. Children under 14
The service is for users aged 14 and over. We ask you to confirm that you are 14 or older when you sign up, and we do not knowingly collect personal information from children under 14. If we learn that a child under 14 has signed up, we delete the account and its data without delay. A parent or guardian can request deletion at [email protected].
13. Security measures
- Administrative: an internal management plan, minimal staff access and regular training, management of processors
- Technical: TLS for all traffic; encrypted database connections and encryption of data stored in the cloud; access control for admin screens (Cloudflare Access plus admin authentication); least privilege; retention and review of admin activity logs; auth tokens kept in the device's secure storage; one-way password hashing (Firebase); secrets kept separate from code; timely security updates
- Physical: cloud data centres with physical access controls (Microsoft Azure and others)
14. Privacy officer and complaints
| Role | Contact |
|---|---|
| Chief Privacy Officer | Inho Lee (Operator) · [email protected] |
| Complaints and customer support | [email protected] |
| Customer support phone | +82 10 9915 7740 |
Send privacy questions, complaints or requests for remedies to the contacts above. We will respond and act without delay.
15. Remedies
For advice or dispute resolution about privacy infringements you can contact these Korean authorities:
- Personal Information Dispute Mediation Committee: 1833-6972 · www.kopico.go.kr
- Personal Information Infringement Report Center (KISA): 118 · privacy.kisa.or.kr
- Supreme Prosecutors' Office: 1301 · www.spo.go.kr
- Korean National Police Agency: 182 · ecrm.police.go.kr
16. Additional information for users outside Korea
- EEA and UK users: The controller is wevement. Our legal bases are performance of contract (GDPR Art. 6(1)(b)), legal obligation (c), legitimate interests (f: security, crash analysis, usage statistics) and consent (a: marketing, sharing with an academy). You have the rights of access, rectification, erasure, restriction, objection and data portability, may withdraw consent at any time, and may complain to your local supervisory authority. Korea benefits from an EU adequacy decision; transfers to US processors rely on safeguards such as EU-US Data Privacy Framework certification or Standard Contractual Clauses.
- Users in other countries: Where the law of your country requires separate consent or notice, we obtain consent under that law, for example on the sign-up screen. You may withdraw consent at any time.
17. Website (topikup.kr) and email support
- The website is served by Cloudflare Pages. When you visit, your IP address, requested URL, time and browser information are processed to deliver the page and keep it secure. The website has no sign-up or personal data entry forms.
- Support emails are forwarded through Cloudflare Email Routing and received and stored in Google Gmail. They are deleted within 90 days after the request is resolved; billing-dispute emails are kept for 3 years.
18. Changes to this policy
We announce changes in the app's notices and on this page at least 7 days before they take effect. Changes that significantly affect your rights, such as collecting new data or sharing with new third parties, are announced 30 days in advance, and we ask for consent again where required.
- Effective date: October 11, 2026
- The website-only privacy policy is provided separately at https://topikup.kr/privacy. App account, learning and purchase data are governed by this app privacy policy.