Privacy policy
Version 0.1-draft · Effective: not in effect yet — draft published ahead of launch
This policy is published ahead of launch. The extension is not on the Chrome Web Store yet and no accounts exist. Items marked To be confirmed before launch are filled in before the extension is submitted for review. The processing described here is the processing the service is being built to do.
1. Who we are
Korean Learning Overlay (“we”) is the controller for the personal data described in this policy.
- Legal entity: To be confirmed before launch
- Address: To be confirmed before launch
- Privacy contact: To be confirmed before launch
- Security contact: To be confirmed before launch
- EU representative (GDPR Art. 27): To be confirmed before launch. We do not rely on the Art. 27(2) exemption — our processing is not occasional.
2. What we collect
| Data | Where it comes from | Why | How long |
|---|---|---|---|
| Subtitle text (the lines on the video) | The extension, when you play a video | Morphological, speech-level and pronunciation analysis | Only while the request is being handled (see section 5) |
| A hash of each subtitle line, plus the analysis result | Generated by our server | A shared cache so the same line is analysed once | Deleted after 90 days without access |
| An install identifier created on your device | The extension | Counting free daily viewing time | On your device until you remove it. Our server stores only a keyed hash of it, for 48 hours |
| Email address and the provider account ID | Signing in with Google or Apple | Your account, saved words, subscription | Until you delete your account |
| Device tokens for the extension, short-lived access tokens | Issued by us when you connect the extension | Authenticating the extension | Device token until revoked; access token 15 minutes |
| Words and sentences you save, with the title and timecode | You, when you press save | Your saved list and export | See section 8 |
| Subscription status: plan, current period end, payment provider reference | The payment provider | Deciding what your account may use | Anonymised after the subscription ends |
| Anonymous usage counts: platform, a title key, an event name, the day. Sent without any account or install identifier | The extension, if usage statistics are on | Ranking what learners watch, tuning the engine, detecting platform changes | Kept only as daily counters, never as individual events |
| Error reports: platform name, our own stack frames | The extension, if usage statistics are on | Diagnosing failures | 30 days |
| Server access logs, including IP address | Every HTTP request, as with any web service | Security and troubleshooting | 30 days. The usage-statistics endpoint does not log IP addresses at all |
3. What we do not collect
- We do not keep subtitle text. See section 5 for exactly what happens to it.
- We do not collect your browsing history. The extension only runs on YouTube, and on Netflix if you turn that on. It does not read other pages.
- We do not link what you watch to your account. The usage-statistics endpoint takes no authentication, and the tables behind it have no column for an account or install identifier. This is enforced by the database schema, not by a promise.
- We never receive your payment details. The payment provider is the merchant of record. We do not store amounts, card numbers or a transaction history.
- No advertising, no ad or tracking pixels, no profiling, no sale of data.
- No third-party analytics. This website loads no scripts from other origins; its content security policy blocks them.
- We do not ask for your age, your location, or access to your microphone or camera.
4. Why we process it, and our legal basis
We do not use consent (GDPR Art. 6(1)(a)) as the basis for the service itself. That keeps the service working without a cookie banner and without a parental-consent system.
| Purpose | Legal basis | How to stop it |
|---|---|---|
| Subtitle analysis, the overlay, word cards, pronunciation, speech level | Art. 6(1)(b) — performance of a contract | Turn the overlay off, or remove the extension |
| Saved words, export, subscription | Art. 6(1)(b) | Delete your account (section 9) |
| Counting free viewing time | Art. 6(1)(b) | Part of the service |
| Anonymous usage statistics and error reports | Art. 6(1)(f) — legitimate interests | Turn off “usage statistics” in the extension popup |
| Security logging, abuse prevention | Art. 6(1)(f) | Not separately opt-out-able |
| Tax records held by the payment provider | Art. 6(1)(c) — legal obligation of that provider | Not opt-out-able |
Our legitimate interests assessment, in short
- Purpose: improving the product and noticing when YouTube or Netflix changes something that breaks the extension.
- Necessity: there is no alternative signal, and attaching an identifier would not make the result more useful — so we do not attach one.
- Balance: no identifiers, no link to your account, no advertising, no profiling, and the switch is off-able at any time.
5. How we handle subtitle text
Subtitle text is sent to our servers for analysis, and is discarded immediately after the response. What remains on our servers is a hash of the text and the analysis result.
- Your browser fetches the subtitles directly from YouTube or Netflix. Our servers do not fetch them on your behalf.
- We do not store which video a line came from. Our servers hold no mapping between a video and a subtitle line, so we cannot reconstruct what you watched.
- The analysis result is a shared, immutable object keyed by the hash of the lines. Because it is shared, the same line is analysed once for everyone.
- Parts we cannot resolve with our own rules are sent to a third-party AI provider — sentence breakdown, unlisted expressions, and translation when a video has no English subtitles. Those requests carry the subtitle line only. No account identifier, install identifier, session identifier or IP-derived value is attached, and the provider is configured not to retain the content or train on it.
- Subtitle text is never written to our disks or logs. We verify this by searching our staging logs for known test strings.
6. Third parties
Processors act on our instructions. Independent controllers decide for themselves what they do with your data, and you should read their own policies.
| Who | What for | What they see | Role | Where |
|---|---|---|---|---|
| Google Cloud | Our API, the analysis cache, logs | Access logs, account data, saved words, quota records | Processor | South Korea (Seoul region) |
| Vercel | Hosting this website | Access logs | Processor | United States |
| Database hosting — To be confirmed before launch | Accounts, saved words, subscriptions | Those records | Processor | To be confirmed before launch |
| AI provider — To be confirmed before launch | Sentence breakdown, translation | Subtitle lines only, with no identifiers | Processor | To be confirmed before launch |
| Paddle | Payments, as merchant of record | Your payment details and billing information | Independent controller — Paddle is the seller | To be confirmed before launch |
| Google, Apple | Signing in | Your email address and account identifier | Independent controllers | To be confirmed before launch |
| Transactional email provider — To be confirmed before launch | Deletion notices and account emails | Your email address | Processor | To be confirmed before launch |
7. International transfers
- EU/EEA to South Korea. Our servers run in the Seoul region. Transfers rely on the European Commission's adequacy decision for the Republic of Korea, Implementing Decision (EU) 2022/254 of 17 December 2021, which the Commission confirmed in its first review in July 2026. No additional safeguards are required for that leg.
- Onward transfers from Korea. The only content that leaves Korea is subtitle text sent to the AI provider, with no identifiers attached. The country each processor operates in is listed in section 6, which is also how we meet the Korean supplementary rule on prior notice of onward transfers.
- Where a processor is outside an adequate jurisdiction, its transfer terms (standard contractual clauses or an equivalent certification) are part of the agreement we accept with that processor.
8. How long we keep things
| Data | Retention |
|---|---|
| Subtitle text | Only in memory, while the request is handled |
| Quota records (a keyed hash, the day, seconds used) | 48 hours |
| Rate-limit counters | 10 minutes, never written to disk |
| Access tokens / device tokens | 15 minutes / until revoked |
| Server access logs, error reports | 30 days |
| Analysis cache objects | Deleted after 90 days without access |
| Words and sentences you saved | While your account exists. If a subscription ends, they stay available to export for 12 months; signing in resets that clock. After 12 months without a sign-in we email you twice, then delete 30 days later |
| Subscription records | Anonymised after the subscription ends, kept only to reconcile with Paddle |
| Daily usage counters | Kept indefinitely — they contain no personal data |
9. Your rights, and how to use them
You can exercise the two rights that matter most yourself, without contacting us. Both buttons are on the Account page, on the first screen.
- Download my data — access and portability (Art. 15 and 20). Gives you a machine-readable JSON file straight away.
- Delete my account — erasure (Art. 17). Takes effect immediately; the data is hard-deleted 30 days later, and we email you when it is done.
- If you have never signed in, there is nothing on our servers to request. Use Reset local data in the extension popup.
- Objection (Art. 21) to the statistics described in section 4 is exercised by turning off “usage statistics” in the extension popup.
- Rectification (Art. 16): the only thing you give us is your email address, which comes from Google or Apple. Change it there and it updates the next time you sign in.
- Restriction (Art. 18) or anything else: email To be confirmed before launch. We answer within one month. If a request is complex we will tell you within that month and take up to two more.
What deleting your account does not remove
- Daily usage counters and the analysis cache are not affected, because neither is linked to you in the first place. There is no record to find.
- Server access logs expire on their own 30-day schedule; we do not delete them early.
- Payment records held by Paddle are Paddle's, not ours. We will point you to their process.
10. Local storage and cookies
- The extension keeps your settings, a local subtitle cache, the install identifier and the device token in the browser's extension storage. It is strictly necessary for the feature you asked for, it is not synced to your Google account, and it never leaves your device except where section 2 says so.
- This website sets one cookie: an HttpOnly session cookie, only after you sign in. There are no advertising or analytics cookies, which is why you are not seeing a cookie banner.
11. Children
- You must be at least 13 to use the service. If you are in the EU and below your country's digital-consent age, use it with a parent or guardian.
- We do not ask for your age and we do not profile anyone, so we do not build age-based or behavioural profiles.
- Accounts are created only through Google or Apple sign-in, so their account-age policies apply.
- The service is not directed at children under 13.
12. Security
- Everything is transmitted over HTTPS.
- We hold no passwords — sign-in is delegated to Google or Apple. We hold no card details. The extension is never given a refresh token.
- Access tokens live 15 minutes. A device token can be revoked from your account at any time, which disconnects that extension immediately.
- The strongest control we have is holding less: no subtitle text, no persistent IP records for statistics, no link between an account and what it watched.
- Report a security problem to To be confirmed before launch.
13. Changes to this policy
- Version 0.1-draft — first draft, published ahead of launch. No processing has started.
When what we collect changes, the extension shows you a summary of the change the next time it starts, before it resumes sending statistics.
14. Complaints
If you are in the EU or EEA you may lodge a complaint with your national supervisory authority (GDPR Art. 77), and if you are in Korea with the Personal Information Protection Commission. We would rather hear from you first at To be confirmed before launch.