Privacy Policy

Effective: 10 June 2026

Data controller: Malggu, [Your registered business address — update in Framer]. Privacy contact: privacy@malggu.com

This policy covers malggu.com, market.malggu.com, spell.malggu.com, wordbook.malggu.com, magic.malggu.com, simulation.malggu.com, aichat.malggu.com, note.malggu.com, report.malggu.com, level.malggu.com, the Malggu Grammar Master Chrome extension, and related interactive learning Services. It applies to users in the United States, UK, EEA, Korea, and worldwide. Where GDPR or UK GDPR applies, you have the rights in Section 9.^[EU-6]

1. Data we collect

• Account: email, password hash, consent choices, age confirmation flag.^[KR-15]
• Grammar Master extension (optional): episode/video identifiers, grammar IDs, timestamps, hit counts, explain-claim logs, marketing-consent flags, and optional sense-feedback metadata (lemma, sense index, short gloss, vote; never caption/dialogue text) used to improve on-device meaning selection, and anonymous global counts of which lemmas are opened or heard (no user id). Caption/dialogue text is matched on your device / in the browser and is not stored as full episode scripts on our servers. Sense feedback may remain device-local if you are not signed in. See Section 12A.^[KR-15]
• Purchase & redeem: order references, license/redeem keys, purchaser email (via Polar checkout and market.malggu.com).
• Learning & games: wordbook/quiz progress, scores, deck completion, faction/profile choices, simulation dialogue selections, mistake/error history, session timestamps. We do not require camera or microphone data for core account features.
• Free Level Check (optional): mission answers, speak or typed responses, level band and scores, email for transactional result delivery, and consent choices collected at level.malggu.com. See Sections 13–14 and “Free Level Check” below.
• AI tutor (optional): messages you send, AI replies, and limited learning context (e.g. recent mistakes, deck/level) used to generate answers and learning reports. See Sections 13–14.
• Voice input (optional): microphone audio and/or browser speech recognition when you use Level Check speak steps or AI Chat voice mode; STT transcripts where applicable; session metadata. See Section 14.
• Usage: pages visited, device/browser, IP (short retention) — analytics only with cookie consent.^[EU-7]
• Support: messages you send us (including Help widget inquiries, retained then archived/deleted per our schedule).
• Phone (optional): if you provide a number and consent to SMS marketing.

2. Lawful bases (GDPR Art. 6)

• Contract: account, delivery of digital products, license redemption, support, saving game/learning progress tied to your account, generating learning reports you request, and delivering a Free Level Check snapshot you request (including transactional result email).^[EU-6]
• Consent: marketing use of data, promotional email/SMS/push, analytics cookies, marketing cookies, camera access in Magic Motion games, AI tutor chat (text), voice AI / microphone / STT, Free Level Check AI scoring, and optional research / product-improvement use of level-check data. Withdraw anytime without losing core Services (except the feature that requires that consent). Optional consents are not pre-checked and are not required to take a Free Level Check (except consents needed to run that feature, e.g. AI scoring and result email delivery).^{[EU-7][KR-22-5]}
• Legitimate interests: security, fraud prevention, essential server logs — not for analytics cookies or promotional email.
• Legal obligation: tax and accounting.

3. Processors (who helps us)

We use trusted providers under data processing agreements:

• Supabase — auth, database (USA; SCCs).
• Polar — payments, merchant of record & license delivery.
• Cloudflare — CDN & security; hosts some game/app surfaces (including learning sites).
• Framer — website hosting (www).
• Google Analytics — only if you accept analytics cookies.
• Email provider — transactional and (if opted in) marketing email.
• AI chat — OpenRouter (United States) — chat completions API that routes to third-party models (e.g. OpenAI, Anthropic) — we call OpenRouter (openrouter.ai/api/v1/chat/completions) with your message and limited learning context. OpenRouter may route the request to underlying model providers (for example OpenAI or Anthropic families), typically in the USA, under their and OpenRouter's terms and DPAs/SCCs. We use API / business settings so content is not used to train foundation models where the provider offers that option. Exact model IDs may change and are not shown in the product UI.^[KR-28-8]
• Speech-to-text (AI Chat voice) — Groq (United States) — Whisper large-v3-turbo speech-to-text API (AI Chat voice mode) — in AI Chat voice mode, voice audio goes browser → our server (/api/stt) → Groq transcription API (api.groq.com/openai/v1/audio/transcriptions).^[KR-28-8]
• Browser speech recognition (Free Level Check, optional) — the speak step may use the browser Web Speech API (processed by your device/OS speech provider). We do not send Free Level Check microphone audio to Groq by default. You may type instead.
• Text-to-speech — Google Cloud Text-to-Speech (United States) — when voice replies are spoken aloud in AI Chat, reply text may be sent to Google Cloud TTS to synthesize audio. Separate from STT (Groq) and chat (OpenRouter).^[KR-28-8]

We do not sell your personal data.

4. Marketing & promotional messages

Service messages (receipts, redeem keys, password reset, security, Free Level Check result snapshots you requested) — sent under contract; no marketing consent required.

Optional marketing requires separate choices at signup, Level Check gate, or account settings. Refusing marketing does not block signup, purchase, Free Level Check, or use of learning games.^{[KR-22-5][EU-7]}

• Marketing use of personal data (events, offers, recommendations).
• Promotional email, SMS, or app push — each channel separately.

Free gift: optional marketing opt-in may include a free starter PDF. Not required to sign up or buy.

Grammar Master Explain: if you consent to marketing emails (including enrollment on our PLF / squeeze email list where that list is used as marketing consent), we may unlock unlimited grammar explanations in the Grammar Master extension. Withdrawing marketing consent or unsubscribing may lock unlimited Explain again, unless you have a paid membership that includes Explain. Core matching and practice features are not conditioned on marketing consent.^{[KR-22-5][EU-7]}

Withdraw in account privacy settings or via unsubscribe links. We keep proof of consent/withdrawal (timestamps, policy version).^[KR-15]

U.S. commercial email (CAN-SPAM): marketing messages include our physical address (Sheridan, WY), a clear opt-out, and we honor opt-out requests promptly (within 10 business days). Transactional Level Check result emails keep the result as the primary content; any upgrade mentions are secondary.

5. Cookies & similar technologies

Essential (always on): login session, malggu_at cross-site auth, checkout, security.

Analytics (opt-in): e.g. Google Analytics — loaded only after you accept in the cookie banner.

Marketing (opt-in): ad measurement cookies — only after consent.

Change choices anytime via “Cookie settings” in the footer. Rejecting non-essential cookies does not block the site.^[EU-7]

6. Third-party links

Our Services may link to other websites (Polar checkout, social profiles, partner venues shown in Simulation). Those sites are operated by third parties with their own privacy policies. Review their policies before you provide personal information.

7. International transfers

Data may be processed in the USA and other countries (including by AI and STT providers, and by browser/OS speech providers for Level Check). For UK/EEA users we use Standard Contractual Clauses and processor agreements. Request copies via privacy@malggu.com.^[KR-28-8]

8. Retention

• Account: until deletion request, then erase within 30 days (except legal holds).
• Consent logs: consent period + up to 3 years for proof.
• Game / learning progress & mistake history: while your account is active, unless you delete it.
• Grammar Master metadata (grammar IDs, timestamps, counts, explain claims, marketing-consent flags, optional sense votes): while your account is active, unless you delete it or we erase sooner after withdrawal where required. Device-local sense preferences stay on your device until you clear extension storage.
• Free Level Check results: while your account is active (deleted with your account), unless a shorter product schedule applies.
• Help / contact inquiries: kept in an active inbox, then moved to archive, then deleted per our schedule (see in-product notice).
• AI chat transcripts: while your account is active, or up to 12 months of inactivity, then deleted or anonymized — unless you delete earlier.
• Voice: we do not store raw audio by default. STT transcripts (AI Chat) follow AI chat retention. Level Check browser speech is not uploaded to Groq by default.
• Purchases: 5–7 years for tax/accounting where required.

9. Your rights

Access, rectification, erasure, restriction, portability, object to processing, withdraw consent, complain to a supervisory authority (ICO UK, your EU DPA, or PIPC Korea). Email privacy@malggu.com — we respond within one month. Use Profile → Request data export for portability where available (includes learning, Level Check, and AI chat data we hold).^[EU-6]

10. Children

Malggu is an educational product but not directed at young children without appropriate safeguards. At signup and on Free Level Check we require you to meet the minimum age for your region (Level Check UI states Ages 13+ for U.S. COPPA positioning):

• European Economic Area / UK: 16, or the lower age set by your country (not below 13) with parental consent below 16.^[EU-8]
• Republic of Korea: under 14 requires verifiable consent from a legal guardian; we do not knowingly collect data from under-14s without that process.^[KR-22-2]
• United States: we do not knowingly collect personal information from children under 13 (COPPA). If you believe a child under 13 has registered, contact privacy@malggu.com for deletion.^[US-COPPA]

Camera, AI tutor, Free Level Check AI scoring, and voice features are offered only after separate in-product consent steps (see Sections 11, 13, 14). Parents/guardians may contact us to review or delete a minor's account.

11. Camera & motion (Magic Motion games)

Some games (e.g. Grammar Spells / Magic Motion) may ask to use your device camera to detect body movement for gameplay. This is optional and requested only when you enter those games — not at account signup.^{[KR-ICT][EU-13]}

• On-device processing: video frames are processed in your browser (e.g. TensorFlow.js / MediaPipe). We do not upload raw video or store your face on our servers by default.
• What we may store: gameplay results (scores, spell success, session duration) linked to your account — not raw camera recordings.
• Refusal: you may decline camera access and use non-camera study modes where available. Declining does not block your account, purchased content, or non-camera games.^[KR-ICT]
• Withdrawal: revoke in browser settings and/or Profile → Privacy; previously saved scores remain unless you delete your account.

12. Korea Simulation & sponsored content

Our Korea Simulation experience may show maps, landmarks, fictional cafés, and real or partner restaurants/cafés for language practice. Some locations may be sponsored or promotional — they are labelled in-game (e.g. “Sponsored” / “Partner”).^[KR-AD]

• Dialogue scenarios are for learning only — not professional travel, immigration, or legal advice.
• We may log which scenarios you complete and choices you make to improve learning paths (contract/legitimate interest). We do not sell this data to sponsors.
• Partner names, logos, and offers are provided by those businesses; their own terms apply if you visit or purchase from them.

12A. Grammar Master Chrome extension (Netflix / YouTube)

The Grammar Master browser extension helps you study Korean grammar while watching supported streaming sites (currently Netflix and YouTube). It is optional and separate from Magic Motion camera games.^{[EU-13][KR-15]}

• On-device / browser: captions and playback time may be read in your browser to match grammar patterns and drive practice seek. We design the product so full dialogue / subtitle archives are not stored on our servers.
• What we may store: account-linked learning metadata such as episode or video keys, grammar IDs, timestamps, counts, explain unlock/claim events, marketing-consent status (grammar_marketing_opt_in / related PLF list linkage), optional sense votes (lemma, sense index, short gloss, vote type — not dialogue or subtitle text), and anonymous global lemma interaction counts (which headwords are opened, heard, or sense-voted — no user id, IP, or caption text). Device-local sense preferences may exist without an account.
• Third-party sites: Netflix and YouTube are not our processors for captions. Their privacy policies and terms apply when you use their services. We are not affiliated with them.
• Lawful bases: contract (account learning features you request); consent (marketing emails ↔ optional unlimited Explain, and any optional AI features inside membership); legitimate interests (security, abuse prevention).^[EU-6][EU-7]
• Refusal / withdrawal: you can stop using the extension or withdraw marketing consent. Refusing marketing does not block signup, purchase, or non-Explain learning features.^[KR-22-5]

13. AI tutor, Free Level Check, learning analytics & reports

Optional AI features may help with language practice, mistake review, Free Level Check scoring, and monthly/progress reports. These are not medical, legal, immigration, or investment advice.^{[EU-13][KR-15]}

• When requested: first use of AI chat shows a separate consent step (not at signup). Free Level Check asks for feature consents on level.malggu.com before the mission. Text chat can work without the microphone.
• What we send (AI Chat): your message, limited learning context (e.g. recent mistakes, deck IDs, level), and session metadata to OpenRouter, which may forward them to the selected underlying model provider. We do not send passwords, payment card data, or government ID numbers. Provider: OpenRouter (United States) — chat completions API that routes to third-party models (e.g. OpenAI, Anthropic).
• Free Level Check: we process mission answers and speak/type responses to produce a level band, study-pace estimates (illustrative, not a guarantee), and next-step suggestions. With your email-result-delivery consent we send a transactional snapshot email. Optional separate consents (unchecked by default): marketing email; research / product improvement (including aggregated or de-identified use where practicable). Consents already granted are not re-requested until you withdraw them or delete your account.
• Analytics & reports: we store and analyze learning/game data on our systems (Supabase) to power Mistake Collection, Monthly Report, Level Check history, and similar features under contract with you.
• Accuracy: AI output and level estimates can be wrong or incomplete. Use your judgment; do not rely on AI for exams, official translations, or professional decisions.
• Withdrawal: Profile → Privacy → withdraw relevant consents (AI tutor, voice, Level Check AI, research, marketing). Core wordbook/games without AI remain available.

14. Voice & speech — Level Check, AI Chat microphone, STT (Groq) & TTS (Google)

Voice and speech features are optional. Consent may be collected when you start a Free Level Check (level.malggu.com) and/or when you enter voice mode in AI Chat — not at account signup. Declining voice does not block signup, purchase, text AI, Free Level Check typing mode, or non-voice games.^{[KR-ICT][EU-13]}

• Free Level Check speak step: with your consent, the browser may use Web Speech API / OS speech recognition to score short spoken Korean lines, or you may type instead. We do not send Level Check microphone audio to Groq by default.
• AI Chat voice mode flow: browser records microphone audio (e.g. webm) → our server (/api/stt) → Groq Whisper (whisper-large-v3-turbo) → transcript → OpenRouter chat completions → text reply → (optional) Google Cloud TTS synthesizes spoken audio for playback.
• STT (AI Chat voice): Groq (United States) — Whisper large-v3-turbo speech-to-text API (AI Chat voice mode). AI Chat voice mode does not use browser Web Speech API.
• Chat: OpenRouter (United States) — chat completions API that routes to third-party models (e.g. OpenAI, Anthropic).
• TTS: Google Cloud Text-to-Speech (United States). Only reply text is sent to Google for synthesis — not your raw microphone recording.
• Raw audio (AI Chat): microphone audio is transmitted to Groq for STT. We do not store raw recordings on our servers by default after transcription (temporary processing only as needed).
• Transcripts: treated like AI chat messages (retention in Section 8).
• No voiceprint marketing: we do not use your voice to identify you for advertising or create a biometric voiceprint for marketing. Optional research / model-improvement use (if you consent) prefers aggregated or de-identified forms where practicable.
• Safety tip: do not speak passwords, payment details, or sensitive personal data into the microphone — especially in public places.
• Refusal: use text AI or typed Level Check responses instead.^[KR-ICT]
• Withdrawal: revoke browser microphone permission and/or Profile → Privacy → withdraw voice AI consent. Already-granted consents remain until withdrawal or account deletion.

15. Security & breaches

We use encryption, access controls, and monitoring. If a breach risks your rights, we will notify you and regulators as required by law.

16. Changes

We may update this policy. Material changes are posted here and may be emailed. Consent-based processing (marketing, camera, AI tutor, Free Level Check AI, voice/STT, research, analytics) may need fresh consent after major changes to that feature's consent version.

Legal references (MCP-verified, 11 Aug 2026)