MANDU — PRIVACY POLICY ====================== Last updated: October 31, 2026 1. Who we are ------------- Mandu is a Korean learning app operated by Corentin Martins ("we", "us"), who is the data controller for the personal data described here. Contact: corentin.martins.pro@outlook.fr. We collect as little as we can. Mandu has no ads, and we never sell your data. If you allow it when your iPhone asks ("Allow tracking?"), we share app events with Meta to measure which of our ads brought you to Mandu; if you don't, Meta only receives anonymous, aggregated install counts from Apple. 2. What we collect and why -------------------------- Stays on your device (we can't see it): - Your onboarding answers (level, goals, daily time, reminder time), saved words, flashcard progress, streak, watch time, achievements and settings. - A copy of your words for the home screen widget. Sent to our servers: | Data | Why | Kept | |---|---|---| | An anonymous account ID (created automatically; no name, email or phone number) | To run your account, the feedback board and Talk with Mandu | Until you delete your account | | Talk with Mandu: the text of what you say (after speech recognition), Mandu's replies, your level and your saved words | To generate Mandu's replies | Not stored by us after the reply is sent; a daily counter of how many turns you used | | Pronunciation check (only when you tap "?" on something you said): a short recording of that sentence | To score your pronunciation | Not stored by us: sent to Microsoft and discarded after the score comes back; a daily counter of checks | | Words and sentences Mandu says aloud (text only) | To create Mandu's voice | The audio is cached so it doesn't need to be created again | | Which onboarding screens you reached, and how you heard about Mandu (if you answer) | To see where people leave onboarding and which channels bring learners | Until you delete your account | | Feedback board posts, comments, votes, reports and blocks | To show the board to other users and keep it safe | Until you delete them or your account | | Subscription status (once available): a purchase ID from Apple, no payment details | To unlock Mandu Pro | While your account exists | We never receive your payment card details (Apple handles payments), your contacts or your location, and we don't keep any audio recordings. 3. Microphone and speech recognition ------------------------------------ When you hold the microphone button in Talk with Mandu, your iPhone turns your speech into text using Apple's speech recognition. When your device supports it this happens on the device; otherwise Apple processes it under Apple's privacy policy. Only the recognised text is sent to generate Mandu's reply. The app keeps a short copy of what you said on your device, so you can check your pronunciation; it's sent (to Microsoft, see below) only if you tap "?" on that sentence. The microphone is only used while you hold the button. 4. Service providers -------------------- We use these providers to run Mandu. They process data only on our behalf: - Supabase (database, accounts and servers, hosted in the EU, Ireland). - Google (Gemini, the main AI model behind Talk with Mandu) and Anthropic (Claude, used as a backup). They receive your conversation text and saved words to generate replies. They don't use this API data to train their models, and keep it only for a limited time for safety and abuse monitoring. Google (Cloud Text-to-Speech) also turns the text Mandu says into Mandu's voice. - Microsoft (Azure Speech, pronunciation scores). When you tap "?" on something you said, it receives that recording and the sentence to score your pronunciation, on our behalf. - Apple (App Store purchases, speech recognition, notifications). - Meta (Facebook SDK, ad measurement). It receives app events such as app opens, trial starts and purchases, your device model and iOS version, and, only if you allowed tracking, your device's advertising identifier. We use it to know which of our ads work. You can change your choice anytime in iPhone Settings → Privacy & Security → Tracking. - RevenueCat (subscription management, once subscriptions are available). It receives your anonymous account ID and purchase receipts, but no payment details. - YouTube / Google (video playback). Videos play in YouTube's official embedded player, and YouTube may collect information, such as viewing data and cookies, under Google's Privacy Policy (https://policies.google.com/privacy). Some providers may process data outside the EU (for example in the United States), protected by safeguards such as the European Commission's Standard Contractual Clauses. Each provider is bound by data processing terms that require it to protect your data with the same or a higher level of protection than this policy. Your permission comes first: the first time you open Talk with Mandu, the app shows exactly what will be sent and to whom (Google, Anthropic and Microsoft), and nothing is sent unless you tap Allow. You can withdraw your permission at any time in Settings → AI tutor data sharing; Talk with Mandu then stays off until you allow it again. 5. Legal bases (GDPR) --------------------- We process your data to provide the service you asked for (contract), to keep the feedback board safe and prevent abuse (legitimate interest), and where required by law (legal obligation). Sending your Talk with Mandu conversation to Google, Anthropic and Microsoft is based on your consent. Sharing app events with Meta for ad measurement is based on your consent (Apple's tracking prompt), which you give in the app and can withdraw at any time. 6. Your rights -------------- You can access, correct, export or delete your data, object to or restrict processing, and complain to your data protection authority (in France, the CNIL: www.cnil.fr). - Delete everything: Settings → Delete my account removes your account and all data on our servers straight away. Deleting the app removes the data on your device. - Anything else: email corentin.martins.pro@outlook.fr and we'll reply within 30 days. 7. Security ----------- Data is encrypted in transit (HTTPS) and protected by access rules on our servers. No system is perfectly secure, but we work to protect your data and will tell you about any breach as required by law. 8. Children ----------- Mandu is not for children under 13, and we don't knowingly collect data from them. If you think a child under 13 has used Mandu, contact us and we'll delete their data. 9. Changes ---------- If we change this policy, we'll update the date above and tell you in the App when the changes are significant. 10. Contact ----------- corentin.martins.pro@outlook.fr