Privacy Policy
This is a translation of the Korean original. If the two versions differ, the Korean version prevails.
Min Q Kim (김민규) (the “operator”), who runs SayText, https://saytext.app (the “Service”), complies with the Personal Information Protection Act (「개인정보 보호법」) and other applicable laws, and processes users’ personal information only to the extent strictly necessary to provide the Service. This policy explains what information is processed, why, and for how long, and what rights users have.
1. At a glance
- The Service can be used without logging in. In that case, texts are stored only in the user’s browser and are not sent to the operator.
- Texts saved by logged-in members are stored on the server so that they can be accessed from other devices.
- Uploaded files are converted into text inside the user’s browser, and the original files are not sent to the server.
- When a sentence is played, the user’s browser sends that sentence directly to Microsoft’s speech server (see Section 7).
- For members, the Service stores access records (IP address, approximate region estimated from the IP address, device, operating system and browser) and counts of how often features are used. These records are used only to answer users’ inquiries, fix device-specific errors, improve the Service and prevent abuse.
- We show ads through Google AdSense. Google may use cookies and similar technologies to show personalised ads (see section 12). We use no external analytics tools and no marketing emails, and we do not sell personal information or provide it to third parties.
- Precise location (GPS) is not collected, and browser fingerprinting (covertly recognizing users from their device’s unique characteristics) is not used.
2. Personal information processed and purposes of processing
The operator processes the following information. Account information and saved texts are processed to the extent necessary to perform the service agreement with users (Personal Information Protection Act, Article 15(1)(iv)). Service-use records and error records are processed for the operator’s legitimate interest in running a safe service that works properly (Article 15(1)(vi) of the same Act); members are informed about service-use records and asked to agree on the sign-up screen. Information that is not needed to provide and operate the Service is not collected.
| Category | Items | Purpose |
|---|---|---|
| Members who signed up with email | Email address, password (stored only as an irreversible hash), verification code (hashed, short validity period) | Identifying members, confirming the member’s own email address at sign-up, login, password reset, sending service-related emails |
| Members who log in with Google | Email address, unique Google account ID, name | Identifying members, login, automatically linking accounts with the same email |
| Texts saved by members | Title, body, format (typed in, pdf, etc.), original file name, time created and modified, last reading position | Saving and loading texts, syncing across devices, resuming listening |
| Generated in the course of using the Service | Login session information (session cookie, login and expiry times, browser information), language setting, account creation and modification times, time of withdrawal request, suspension status, time and reason | Keeping users logged in, providing screens and emails in the selected language, account management, managing the withdrawal grace period, handling abuse |
| Security records (members and non-members) | IP address, number of requests per email address | Preventing abuse such as brute-force login attempts and email flooding |
| Service-use records (members) | IP address used for access, approximate location estimated from the IP address (country, region/province and city level, using IP location data provided by Cloudflare), operating system, browser, device type and model (to the extent the browser reports them), browser language setting, time zone, screen size, whether the app is installed, sign-up date and method (email/Google), login and access times, how the member first arrived (referring address and campaign tag), feature-use counts (how many times features such as playback, file upload, MP3 saving and repeat were used; text content is not included) | Responding to user inquiries, identifying device- and browser-specific errors and improving service quality, preventing abuse, usage statistics |
| Feedback (members and non-members, only when the user sends it) | Type and content of the feedback, email address for replies (for members, the account email; for non-members, only if they enter one), screen language, the screen it was sent from, operating system, browser and device type, country, member identification number for members | Answering inquiries, fixing errors, improving the Service |
| Reason for withdrawal (optional) | Reasons selected, any comments, screen language, sign-up method, number of days since sign-up, number of saved texts. Stored without being linked to an email address or member identification number, so that no one can tell whose response it is | Improving the Service |
| Error records (members and non-members) | Error details, the screen where the error occurred, operating system, browser and device information, country (IP addresses of non-members are not stored), member identification number for members | Fixing errors |
| Visit statistics (members and non-members) | Date the page was opened (by day), whether playback was started or the button to get Edge was pressed, page language, country, type of operating system, browser and device, name of the referring site (such as a search engine; the full address is not stored), and whether the user was signed in. These are stored only as daily totals, without IP addresses, cookies or browser storage, so no individual can be identified | Understanding visitor numbers and how visitors find the Service; improving the Service |
Passwords are transformed once in the user’s browser (key stretching) before being sent, and on the server they are combined with a value unique to each user (a salt) and stored only as a one-way hash. Even the operator cannot know the original password.
Texts and settings created by non-members remain only in the user’s browser storage (localStorage), and the operator does not receive them. They may be lost if browser data is cleared.
The operator views member information, service-use records and saved texts on the administration screen only when needed for user support, fixing errors, investigating abuse, or handling a user’s request for access or data portability. Every view and export is recorded in an audit log showing who viewed which account and when.
3. Retention and use period
- Member information and saved texts: retained until the member withdraws. When a member requests withdrawal, the account is kept in a deactivated state for 30 days, and logging in again during this period restores it. Reminder emails are sent 7 days, 3 days and 1 day before deletion; after 30 days, the data is destroyed without delay and an email confirming the deletion is sent.
- Texts deleted by members: moved to the trash and kept there so the member can restore them; deleted without delay when the member deletes them forever or empties the trash, and automatically deleted after 60 days in the trash, and also destroyed together with the account when the member leaves. After permanent deletion, only the text’s identification number and deletion time may remain until the account is deleted, for syncing with other devices.
- Verification codes: become invalid once used or once their validity period (about 10 minutes) after issuance expires, and are deleted afterwards.
- Login sessions: deleted upon logout or expiry.
- Security records (request counts): kept for up to 24 hours and then deleted.
- Service-use records and feature-use statistics: retained until the member withdraws. Feature-use statistics are destroyed together with the account. However, access records (access times, IP addresses, etc.) are kept for 3 months after the account is deleted, as required by the Protection of Communications Secrets Act (「통신비밀보호법」), and then destroyed.
- Error records: kept for 3 years and then destroyed. For members who withdraw, the member identification number is removed from their error records so that no one can tell whose records they are.
- Visit statistics: daily totals that cannot identify any individual; kept for 3 years and then destroyed.
- Feedback: kept for 3 years, in line with the retention period for records of consumer complaints and dispute handling under the Act on the Consumer Protection in Electronic Commerce, etc. (「전자상거래 등에서의 소비자보호에 관한 법률」), and then destroyed. The member identification number is removed from feedback sent by members who withdraw.
- Reasons for withdrawal: kept for 5 years in a form that does not reveal whose response it is, and then destroyed.
- Administrator records (audit log: administrator viewing, exporting, suspensions of use, etc.): kept for 5 years and then destroyed.
- Database recovery records: under Cloudflare D1’s automatic recovery feature (Time Travel), deleted data may remain in recovery records for up to 30 days and then disappear automatically. These records are not used for any purpose other than recovering from failures.
4. Provision of personal information to third parties
The operator does not provide users’ personal information to third parties, except where specifically required by law or where an investigative agency requests it in accordance with procedures prescribed by law.
5. Outsourcing of personal information processing
To provide the Service, the operator outsources personal information processing tasks as follows. The operator ensures that the processors handle personal information securely through contractual terms (data processing agreements).
| Processor | Outsourced tasks |
|---|---|
| Cloudflare, Inc. | Website hosting, server operation, database storage (member information, texts and usage records), IP location data, security (blocking attacks) |
| Resend (Plus Five Five, Inc.) | Sending verification codes and notification emails, sending emails that forward feedback from users to the operator |
6. Transfer of personal information overseas
Because the Service uses facilities of overseas companies, personal information is transferred outside Korea. Transfers to Cloudflare and Resend are outsourcing and storage necessary to perform the service agreement and are made by disclosure in this policy (Personal Information Protection Act, Article 28-8(1)(iii)). The Google and Microsoft entries are transmissions between the user’s browser and those companies that occur when the user chooses to use the relevant feature; they are listed here as well so that users are informed.
| Recipient (contact) | Country | Items transferred | Timing and method | Purpose of use | Retention and use period |
|---|---|---|---|---|---|
| Cloudflare, Inc. ([email protected]) | United States (data centers worldwide) | Member information, saved texts, sessions, security records, service-use records and error records described in Section 2; access IP addresses and request logs | Transmitted over the network each time the Service is accessed or a text is saved | Hosting, database storage, security | Until the member withdraws (periods in Section 3 apply). Access logs are subject to Cloudflare’s policies |
| Resend (Plus Five Five, Inc.) ([email protected]) | United States | Recipient email address, email content (verification codes, etc.), and, if feedback is sent, its content and the email address for replies | Transmitted over the network each time an email is sent | Sending service emails | After sending, for the period Resend retains its sending logs |
| Google LLC (policies.google.com/privacy) | United States | Google login request information (IP address, browser information, the service being logged into). After login, Google passes the email, Google account ID, name and profile picture URL to the operator (the operator does not store the profile picture URL) | Transmitted over the network between the user’s browser and Google when the user chooses Google login | Logging in with a Google account | Subject to Google’s privacy policy |
| Microsoft Corporation (aka.ms/privacyresponse) | United States | Text of the sentence being played, IP address, browser information | Transmitted over the network directly from the user’s browser each time the user plays a sentence | Speech synthesis (converting text into speech) | Subject to Microsoft’s privacy policy (the operator does not receive or store this content) |
| Google LLC (AdSense ads) (policies.google.com/privacy) | United States | Information needed to show ads (IP address, browser information, address of the page visited, cookies and device identifiers) | When a page with ads is opened, sent over the network between the user's browser and Google | Serving and measuring ads, preventing invalid clicks | As set out in Google's privacy policy |
How to refuse, and the effect of refusing: Users who do not want their information transferred overseas can choose not to sign up, or can delete their account. However, because the Service itself is delivered through Cloudflare, refusing the transfer means member features (such as saving texts) cannot be used. The transfer to Google can be avoided by signing up with email, and the transfer to Resend can be avoided by using only Google login (in which case email verification and password reset emails cannot be received). Users who do not want data sent to Microsoft can simply not play sentences, in which case the listening feature cannot be used.
7. About speech synthesis
The Service’s voices use the speech server behind Microsoft Edge’s “Read Aloud” feature (speech.platform.bing.com). When a sentence is played, the user’s browser sends that sentence directly to Microsoft and receives the audio (MP3). This process does not pass through the operator’s server, and the operator does not receive or store the audio or the transmitted content. Users are advised not to play texts that contain sensitive personal information.
8. Procedure and method of destruction
- Personal information is destroyed without delay once its retention period ends or the purpose of processing has been achieved.
- Electronic files are deleted from the database so that they cannot be recovered. Recovery records disappear automatically after the period stated in Section 3.
- The operator does not keep personal information in paper documents.
9. Users’ rights and how to exercise them
Users may exercise the following rights at any time.
- Access and portability: If you make a request using the contact details below, the operator will, after verifying your identity, provide your account information, usage records and all saved texts in a single file (JSON).
- Correction: Texts can be edited directly in the Service, and corrections to other information can be requested using the contact details.
- Deletion, suspension of processing, and withdrawal of consent: You can request withdrawal via “Delete account” in Account settings. After a 30-day grace period, member information, saved texts and usage records are destroyed; logging in again during the grace period cancels the withdrawal.
Requests made using the contact details will be handled within 10 days after verifying the requester’s identity, and the result will be communicated to you. Requests may also be made through a legal representative or an authorized agent, in which case a power of attorney must be submitted. Requests may be limited where there are grounds such as a legal obligation to retain the information, in which case the reason will be given.
10. Children under 14
Only persons aged 14 or older may sign up, and the operator does not collect personal information of children under 14 as member information. If the operator learns that an account has been created by a child under 14, the account and its information will be deleted without delay.
11. Measures to ensure the security of personal information
- All communications are encrypted with HTTPS.
- Passwords are transformed in the browser and then stored on the server only as a salted one-way hash; verification codes and session values are also stored as hashes.
- Security attributes are applied to login cookies, and the number of login attempts and emails sent is limited.
- Only the operator can access the database, and strong authentication is used for administrative accounts.
- The administration screen can be accessed only with designated operator accounts, and in addition to logging in, access is confirmed once more with a verification code sent by email (two-step verification). Every view and export of member information and every administrative action is logged.
- Personal information is handled by one person only: the operator.
12. Cookies and browser storage
- Login cookie: When a member logs in, a single cookie is stored to keep the member logged in. It is strictly necessary and is not used for advertising or tracking.
- Language cookie (golla_lang): Remembers the language the user chose so that the Service is shown in that language on the next visit. It is kept for 1 year.
- Google sign-in security cookies: While a user signs in with Google, short-lived cookies are stored to block forged requests and return the user to the right page. They are deleted when sign-in is complete.
- Browser storage (localStorage): Non-members’ texts and settings such as the selected language, voice and speed are stored in the user’s browser. This information is not sent to the operator.
- Advertising cookies (Google AdSense): The Service shows Google AdSense ads. Google and its advertising partners may use cookies or device identifiers to show personalised ads based on visits to this and other websites (pages visited, ads viewed or clicked, approximate location, browser information). Google collects this information directly; we do not receive it, and it is kept according to Google's policies. You can turn off personalised ads in Google's Ad Settings (https://adssettings.google.com). Visitors from the European Economic Area, the UK and Switzerland can choose in the consent message shown on their first visit. Details: https://policies.google.com/technologies/ads
- No analytics cookies or external analytics tools are used (visit statistics are counted as daily totals without cookies).
- Cookies and storage can be cleared or blocked in the browser settings. If cookies are blocked, logging in is not possible, and if storage is cleared, non-members’ texts and settings are lost.
13. Privacy officer
For inquiries, complaints or requests for remedies relating to the processing of personal information, please contact us below. We will respond and handle them promptly.
- Privacy officer: Min Q Kim (김민규) (operator of the Service)
- Contact: [email protected]
14. Remedies for infringement of rights
To obtain remedies for infringement of personal information, users may apply for dispute resolution or counseling with the following organizations.
- Personal Information Dispute Mediation Committee: (in Korea) 1833-6972, www.kopico.go.kr
- Personal Information Infringement Report Center (KISA): (in Korea) 118, privacy.kisa.or.kr
- Supreme Prosecutors’ Office: (in Korea) 1301, www.spo.go.kr
- Korean National Police Agency cyber crime reporting: (in Korea) 182, ecrm.police.go.kr
15. Changes to this policy
This policy applies from 2026-10-16. If it changes, the change will be announced on the Service 7 days before it takes effect; changes that are unfavorable to users or otherwise significant will be announced 30 days in advance, and members will also be notified by email.