Privacy Policy

Last updated: September 29, 2026

1. Information We Collect

When you use Fan Card Builder, we may collect:

Account information: email address and password when you sign up, or the email address provided when you sign in with Google or with Apple — Sign in with Apple may provide a private relay address if you choose to hide your email (no password is stored for social sign-in)
User content: messages you write and translations you save
Usage data: pages visited, features used, learning progress, and in-product feedback activity
Device information: browser type, operating system, and screen size on the web; app version, device type, and operating system in the mobile apps
Guest session identifier: if you use the Service without an account, a randomly generated session ID is stored in your browser's local storage (or in the app's local storage in the mobile apps) to track daily translation usage. This identifier is not linked to any personal information.
Feedback data: if you choose to rate your experience after saving a fan card, we collect your star ratings for translation, practice, and fan card design, along with response type (submitted or skipped), language, platform, premium status, and related technical metadata.
IP address: collected when you grant or revoke consent, submit a support request, or submit in-product feedback, for record-keeping and security purposes. Also used for rate limiting.
Approximate location: our CDN derives country-level location from your IP address and stores it with first-party usage events. If analytics is enabled for the website or mobile app, Google Analytics may also infer approximate location from your IP address. We do not collect GPS or precise location.
Photos: if you add a photo to a fan card or save a finished card in the mobile app, the image is processed on your device only. Photos are never uploaded to our servers.
Payment information: billing details processed securely through our third-party payment providers — Polar on the web, Google Play Billing with RevenueCat in the Android app, or Apple's App Store in-app purchase system with RevenueCat in the iOS app. We do not store your credit card number directly.
Push notification token: if a future version of our mobile app offers push notifications and you enable them, a Firebase Cloud Messaging (FCM) device token will be collected to deliver those notifications. Push notifications are not active in the current app version, and no device token is collected today. You can disable push notifications in your device settings at any time.

2. How We Use Your Information

We use collected information to:

Provide and maintain the Service
Generate Korean translations by sending your messages to OpenAI
Process subscriptions and payments through Polar (web), Google Play Billing with RevenueCat (Android app), or the App Store with RevenueCat (iOS app)
Save your learning progress and message history
Improve and optimize the Service
Understand how users interact with our features
Collect optional star-rating feedback after saving a fan card to evaluate translation, practice, and fan card design quality
Track daily translation usage to enforce tier limits (per user ID for logged-in users, or per guest session ID for guests)
Cache translation results temporarily to improve performance and avoid redundant API calls
Store a local browser timestamp to limit how often the feedback prompt is shown on your device

3. Analytics

When enabled, Google Analytics on the website runs only when analytics cookies are accepted in your cookie settings. It records page views for approved public routes and a limited set of feature events. URL query strings and fragments are never sent, page titles are fixed, and routes that may contain authentication or user-provided data are omitted. Event details are limited to predefined values such as the selected language, save method, or a general error category. iOS and Android app versions with Firebase Analytics collect app usage only after you accept optional analytics in the app. You can withdraw either choice through cookie settings or in the app, and declining analytics does not limit the Service. When enabled, Google Analytics may process an analytics identifier, approximate location derived from your IP address, browser or device information, page views, feature interactions, sessions, and in-app purchase or subscription events. We do not send your message text, email address, or account ID to Google Analytics. We continue to record first-party usage events in our database to understand feature usage and maintain the Service, as described in this policy.

4. Data Storage

Your data is stored securely using Supabase, a trusted cloud database provider. We use industry-standard security measures to protect your information.

5. Third-Party Services

We use the following third-party services to operate the Service:

Supabase: Cloud database for storing your account data, content, learning progress, support requests, and in-product feedback (hosted in the United States).
Polar: Merchant of Record for payment processing, billing, and invoicing on the web.
App Store, Google Play Billing & RevenueCat: Process in-app purchases in the iOS and Android apps. Apple or Google handles the payment itself; RevenueCat processes purchase receipts and subscription status to activate Premium features. We never receive your card details.
Sign in with Apple: If you sign in with Apple in the iOS app, Apple provides an identity token and the email address (or private relay address) you choose to share. When you delete your account, we notify Apple to revoke the sign-in authorization.
Google Sign-In: If you sign in with Google, Google provides an identity token and your email address.
Google Analytics: when enabled, the website tag collects approved page views and predefined feature events after analytics cookies are accepted; Firebase Analytics collects app usage and app-level identifiers after optional consent in iOS and Android apps. URL query strings, message text, email addresses, and account IDs are not sent by our analytics code.
OpenAI: When you translate a message, the text content is sent to OpenAI to generate a Korean translation. Only the message text is sent; no account information is included.
Cloudflare: Hosts and delivers the Service via its global CDN. All traffic passes through Cloudflare, which may process IP addresses and request metadata for performance, security, and bot protection.
Upstash Redis: Provides rate limiting and daily translation usage tracking (per user ID for logged-in users, or per guest session ID for guests). Translation results are cached temporarily (up to 24 hours) to improve performance. All data expires automatically and is not stored long-term.
Firebase Cloud Messaging (FCM): Will deliver push notifications if a future app version enables them (not active today). A device token would then be generated and stored to route notifications. No message content or personal data is shared with Firebase beyond the token itself.
Sentry: Error tracking for the website and backend services. Reports contain operational error categories and release information, not raw exception messages, stack traces, account details, or message content. Client-side error reporting is disabled in the mobile apps. Retention depends on the configured Sentry project settings.
Discord: Receives operational alert categories and support request reference numbers for internal response coordination. New alerts exclude message content, names, email addresses, IP addresses, and account IDs.

We do not share your account information with third parties beyond what is necessary to provide the Service as described above.

6. Data Retention & Deletion

Active accounts: Your data is retained for the duration of your active use of the Service.
Account deletion: When you delete your account, all associated data is immediately removed (via cascading deletion). Residual copies in encrypted backups are purged within 90 days.
Cookie data: Analytics cookies are removed immediately when you decline or revoke consent; otherwise they expire according to the provider's standard cookie lifetime.
Feedback prompt timing: the browser local-storage timestamp used to limit feedback prompt frequency remains on your device until it is overwritten, cleared by you, or removed by your browser.
Translation usage data: Daily usage counters and cached translations stored in Redis expire automatically after 24 hours.
Payment records: Billing and transaction records are maintained by Polar (our Merchant of Record) for web purchases, and by Google Play or Apple and RevenueCat for in-app purchases in the mobile apps, in accordance with their own data retention policies. Upon account deletion, all payment data in our systems is removed.

7. Your Rights (Data Subject Rights)

You have the right to:

Access your personal data
Request correction of inaccurate data
Delete your account and all associated data
Export your data in a machine-readable format (available in Profile > Export My Data)
Withdraw optional analytics consent at any time

To exercise any of these rights, email us at support@pittsedu.com. We will acknowledge your request within 7 days and complete it within 30 days.

8. Cookies

We use essential cookies for authentication and session management. We also set first-party measurement cookies (a randomly generated visitor identifier and first-visit attribution values) to understand how visitors arrive at the Service; they contain no personal information and are never shared with third parties. Analytics cookies (Google Analytics) are only set after you provide explicit consent via our cookie consent banner. You can change your cookie preferences at any time by clicking "Cookie Settings" on our website. iOS and Android app analytics use native SDKs rather than analytics cookies; you can change your optional analytics choice in the app.

9. Children's Privacy (COPPA Compliance)

The Service is not directed to children under 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected personal information from a child under 13 without parental consent, we will take steps to remove that information from our servers.

10. Your Rights Under GDPR (EEA Users)

If you are located in the European Economic Area (EEA), we process your personal data under the following legal bases:

Consent: For optional Google Analytics collection. You may accept or decline through the website cookie banner or the iOS and Android app analytics choices.
Contract: To provide the translation and learning services you requested when you use the Service (with or without an account).
Legitimate Interests: To improve our service, ensure security, and prevent fraud.

Under the GDPR, you have the following rights:

Right of Access: Request a copy of the personal data we hold about you.
Right to Rectification: Request correction of inaccurate or incomplete data.
Right to Erasure: Request deletion of your personal data.
Right to Data Portability: Request a copy of your data in a structured, machine-readable format by contacting us.
Right to Restrict Processing: Request that we limit how we use your data.
Right to Object: Object to processing of your data based on legitimate interests.
Right to Withdraw Consent: Withdraw analytics consent through "Cookie Settings" on the website or the app's analytics choice.

International Data Transfers: Your data is stored on servers located in the United States via Supabase and delivered globally through Cloudflare. We rely on Standard Contractual Clauses (SCCs) approved by the European Commission, and our vendors' own GDPR-compliant data processing agreements, as the legal basis for transferring personal data outside the EEA.

You have the right to lodge a complaint with your local data protection supervisory authority if you believe your data has been handled incorrectly.

To exercise any of these rights, please contact us at support@pittsedu.com.

11. Your Rights Under CCPA (California Residents)

If you are a California resident, the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) provide you with specific rights regarding your personal information:

Do Not Sell / Do Not Share: We do not "sell" or "share" your personal information as those terms are defined under California law.
Right to Know: You may request details about the categories of personal information we collect, the purposes for collection, and the categories of third parties with whom we share it.
Right to Delete: You may request deletion of the personal information we have collected from you, subject to certain exceptions.
Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights. You will not receive different pricing or quality of service.

Categories of information we collect: identifiers (email, IP address), usage data (pages visited, features used, star-rating feedback), and device information (browser type, OS).

To exercise any of these rights, please contact us at support@pittsedu.com.

12. Additional Disclosures for South Korean Users (PIPA)

In accordance with Korea's Personal Information Protection Act (PIPA), we provide the following additional disclosures:

Personal Information Collected

Email address and password, or email address via Google sign-in (upon registration; account creation is optional)
Guest session identifier (randomly generated UUID stored in browser local storage; only for non-logged-in users)
Messages you write and their translations
Learning progress data (jamo practice records; only for logged-in users)
Optional feedback ratings for translation, practice, and fan card design, plus whether you submitted or skipped the prompt
Device information (browser type, operating system)
IP address (used for rate limiting and stored with consent records, support requests, and feedback records)
Approximate location (country-level data derived from IP address for first-party usage events; the app analytics SDK may infer approximate location from a masked IP address after optional consent)
Payment information (processed through our third-party payment providers — Polar on the web, Google Play Billing with RevenueCat in the Android app, or the App Store with RevenueCat in the iOS app)
Push notification device token (FCM token; only if a future app version enables push notifications — not collected today)

Purpose of Collection and Use

Providing the Service and managing user accounts
Storing learning progress and message history
Providing AI-powered Korean translation
Processing subscriptions and payments
Evaluating satisfaction with translation, handwriting practice, and fan card design to improve the Service
Service improvement and statistical analysis (with consent)

Disclosure to Third Parties

OpenAI: Message text is sent to generate Korean translations.
Apple & Google (sign-in): Identity tokens and email addresses are exchanged when you use social sign-in; Apple sign-in authorization is revoked when you delete your account.
Polar: Payment information is processed for billing and subscription management (web).
App Store, Google Play & RevenueCat: In-app purchases in the iOS and Android apps are processed, and subscription status is managed to activate Premium features.
Supabase (United States): Account data, learning records, support requests, and feedback records are stored.
Google Analytics: when enabled, the website tag collects approved page views and predefined feature events after analytics cookies are accepted; Firebase Analytics collects app usage and app-level identifiers after optional consent in iOS and Android apps. URL query strings, message text, email addresses, and account IDs are not sent by our analytics code.
Cloudflare: All traffic is delivered through Cloudflare CDN; IP addresses and request metadata are processed.
Upstash Redis: Provides rate limiting and daily translation usage tracking (per user ID or guest session ID). Cached translations are stored temporarily. All data expires within 24 hours.
Firebase Cloud Messaging (FCM): If push notifications are enabled in a future app version, device tokens will be stored to deliver app notifications.
Sentry: Operational error categories and release information are collected for website and backend reliability. Client-side reporting is disabled in the mobile apps.
Discord: Operational alert categories and support request reference numbers are forwarded for internal response coordination.

Retention Period

Upon account deletion: immediately removed (backups purged within 90 days)
Payment records: maintained by Polar (web, Merchant of Record) and Google Play or the App Store / RevenueCat (mobile apps) per their retention policies; removed from our systems upon account deletion
Analytics cookies: removed immediately upon consent withdrawal; otherwise they expire per the provider's standard cookie lifetime
App analytics: new SDK collection stops when you withdraw consent; data collected earlier remains subject to Google Analytics retention settings and applicable deletion requests
Translation usage counters and cached translations (Redis): automatically expire after 24 hours

Destruction Procedure

When a user deletes their account, all personal data is immediately destroyed through cascading deletion in the database. Electronic files are deleted using methods that prevent recovery.

User Rights

You may request access, correction, deletion, or suspension of processing of your personal data.
You may export your data (JSON) and delete your account from your profile settings.
You may withdraw analytics cookie consent at any time.

Privacy Officer

Email: support@pittsedu.com

13. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you through a notice within the Service at least 7 days before the changes take effect. Continued use of the Service after changes take effect constitutes acceptance of the updated Policy.

14. Vendor Data Processing Agreements

We maintain Data Processing Agreements (DPAs) with our key service providers:

Supabase: Supabase DPA
Google Analytics: Google Ads Data Processing Terms
OpenAI: OpenAI Data Processing Addendum

15. Contact

Fan Card Builder — distributed on the web, on Google Play, and on the Apple App Store as "K-pop Fan Card Builder" — is operated by PittsEdu. Your use of the Service is also subject to our Terms of Service. If you have questions about this Privacy Policy, please contact us at support@pittsedu.com.

16. Business Information

Business Name: PittsEdu
Business Registration No.: 511-73-00601
Mail-Order Sales Registration No.: 제2026-안양동안-1084호
Address: Office 3919, 11-41, Simin-daero 327beon-gil, Dongan-gu, Anyang-si, Gyeonggi-do, Republic of Korea, 14055
Contact: support@pittsedu.com