Privacy policy

Who we are

BunnyKorean is operated by REPICK (DOHYUN LEE). This notice covers the BunnyKorean app and this website. For privacy questions or requests, email repick.official@gmail.com.

This policy explains information processing; it is not a blanket consent to every practice described here. Accepting the Terms of Use is separate from privacy consent. When consent is required for an optional use, BunnyKorean asks for it separately and provides a way to withdraw it.

Information used by the app

• Your account and preferences. Ordinary browsing and free video playback do not create a BunnyKorean account. If you tap Try this scene, Supabase can create an anonymous account identifier so the service can grant and remember the guided sample. If you later sign in with Apple, Google or email, Supabase processes an account identifier and information supplied by that sign-in method, which can include your name, email address or Apple private relay address. Account preferences can include your display name, Korean level, interests, learning goal and display settings.
• Your learning and protected access. Your learning is saved on your device. In app versions with Learning sync, signing in also synchronizes saved words and their sentence context, saved clip bookmarks, review progress, study activity, decks, custom practice and supported learning preferences with your account through Supabase. Changes made without a connection wait on your device until synchronization succeeds. Check the status in Data & account → Learning sync. Older app versions without this control do not back up saved words or review history. When you request protected learning details, the app sends your account session token with the manifest revision, clip identifier and learning reference identifier to BunnyKorean’s Supabase backend. The backend uses these details to return the requested item, check paid access when required, and record a protected learning grant linked to your account, the canonical learning item, access source, manifest and clip/reference identifiers, and grant time.
• Learning request diagnostics. The protected-learning function writes a technical diagnostic event containing the manifest revision, clip identifier, learning reference identifier when present, whether the request was for onboarding, and the result or error code. Hosting and infrastructure providers can also process ordinary request and security logs. These records help diagnose failures, enforce access and protect the service. This is separate from optional PostHog usage analytics.
• Access and purchases. Before authenticated sign-in, RevenueCat may operate under its own anonymous installation identity to load available offerings, but BunnyKorean does not send the anonymous Supabase guided-sample user ID to RevenueCat for purchase access while that account remains anonymous. If you later link Apple, Google or email to the same Supabase account, its user ID can remain the same and can then be identified to RevenueCat and associated with subscription records. RevenueCat receives product, entitlement, transaction, purchase and restore information to provide and manage access and subscription reporting. BunnyKorean does not receive your full payment-card details; the app store you purchased through handles payment information under its own terms and privacy practices.
• Video requests and advertising. BunnyKorean uses YouTube API Services, including the official embedded player. When the player or video thumbnails load, YouTube receives network and device information, such as your IP address, device identifiers, browser or app identifiers, playback information, player interactions and ad interactions. Google may infer an approximate location from the connection and process information to deliver and protect its services, measure usage and show advertising under its own privacy practices. Embedded videos may contain YouTube advertising; a BunnyKorean subscription does not remove that advertising. BunnyKorean does not ask you to authorize access to your YouTube account, channel, subscriptions or other user-specific YouTube data. The player uses privacy-enhancing settings, but these do not mean that no information is sent to YouTube.
• Optional usage analytics. When you enable Usage analytics, PostHog processes random analytics identifiers, app/platform information, screen names, interaction types and aggregate counts. The app does not include your saved Korean text, clip identifiers, email address or BunnyKorean account identity in those events. Analytics is disabled until an opt-in is recorded.
• Profile pictures and pronunciation. If you choose a profile picture, BunnyKorean resizes it and keeps an app-local copy on your device; the app does not upload that picture with Learning sync. When you request pronunciation, selected learning text is passed to your device's text-to-speech service. Depending on your device and voice settings, that provider may process the text under its own privacy practices. BunnyKorean does not record your voice.
• Support. If you contact us, we receive your email address and the information you choose to send. We use them only to reply and handle your request. You can withdraw your request or ask us to delete this information at any time by emailing repick.official@gmail.com. Please do not send passwords, verification codes or full payment-card details.

How this information is used

We use this information to provide accounts and learning tools, remember preferences, grant the guided sample, verify paid access, handle support requests, protect the service and complete account-deletion requests. Optional analytics helps us understand which parts of the app are useful.

Where applicable law requires a legal basis, processing may be necessary to provide the service you request, satisfy legal obligations, protect legitimate service and security interests, or follow your consent for optional features. You can withdraw optional analytics consent in the app.

Service providers and external content

BunnyKorean uses Supabase for authentication, learning synchronization, protected learning access and account services; RevenueCat and the app store you purchased through for purchases and subscription access; YouTube for video playback; PostHog for optional usage analytics; Expo (EAS Update) to deliver app fixes; and Vercel to host this website. Your device's notification and text-to-speech services support reminders and pronunciation. These providers process information needed for their respective services and may operate in countries other than yours.

In app versions that support automatic fixes, the app contacts u.expo.dev when it starts to check for updates. Expo receives a random installation identifier (EAS-Client-ID), app/runtime information and ordinary network request information. No BunnyKorean account data is sent with these checks.

Providers can also process information independently under their own terms and privacy practices, including when you use Apple, Google or YouTube services. International transfers remain subject to the protections required by applicable law; provider-specific locations, retention periods and legal transfer mechanisms depend on the service and provider configuration.

Read the providers’ notices: Supabase, Apple, RevenueCat, Google / YouTube, PostHog, Expo, and Vercel. BunnyKorean’s use of YouTube API Services is also governed by the YouTube API Services Terms of Service. External links and videos are subject to the relevant provider’s terms and privacy practices.

BunnyKorean does not sell your personal information or include its own advertising SDK. The official YouTube player may display advertising and process information independently under Google's privacy practices. Paying for BunnyKorean learning tools does not remove YouTube advertising.

This website

This website does not set BunnyKorean cookies or load an analytics SDK or advertising pixel. This website does not submit or store a signup form. Its images are served with the page. YouTube links open that external service only when you follow them. App Store download links open Apple's public listing when you follow them.

Vercel can process ordinary request information, such as an IP address, requested URL, browser information and request time, to deliver and protect the site. Emailing support uses your email provider and ours.

Your controls and requests

• Remove individual saved words in the app. Resetting device data or signing out clears local learning data. Records that have not synchronized cannot be restored.
• Reset this device clears local learning data. It does not delete your cloud account or synchronized learning, or cancel a subscription. Signing in again can restore synchronized learning.
• Delete account starts the account-deletion process. If it is pending, use Retry account deletion. A network connection and account verification may be required.
• Turn Usage analytics off in the app. This stops new optional analytics and clears queued events; it does not erase events already received by PostHog.
• Manage notification permission in your device's settings. BunnyKorean study reminders are scheduled locally; the app does not currently register you for a remote push-notification service.

Depending on your location, you may have rights to request access, correction, deletion, portability, restriction or objection, withdraw consent, or complain to a privacy regulator. Contact us to make a request, including a request about previously sent analytics. We may need to verify your identity before acting.

Retention and deletion

Local learning data remains until you remove it or use a relevant reset or deletion control. Synchronized learning, account preferences and protected learning grants are retained until account deletion. Removing a synchronized record clears its learning payload while minimal entity and revision metadata remains to stop an older device restoring it. Recently watched history is on by default and stays only on this device for up to 30 days. You can remove individual entries, clear it or turn it off in Personalization; turning it off also clears it. Learning diagnostic and infrastructure logs are retained while reasonably needed to diagnose failures, protect the service, meet legal obligations, and follow the applicable hosting or provider log cycle. Contact us for record-specific information relevant to your request.

After account deletion completes, the completed request record supports safe retries and operational review. Records whose terminal date is older than 30 days are eligible for opportunistic cleanup only when a new authenticated deletion is prepared; this is not a guarantee of deletion at exactly 30 days. A minimal deletion record is retained without automatic expiry so later subscription or account events cannot recreate the deleted account. Transaction, security, support, provider log and backup records can remain where reasonably necessary for security, dispute handling, legal obligations or the provider’s retention cycle. Contact us for record-specific information relevant to your request.

Deleting an account or the app does not cancel a subscription or delete transaction records the app store must maintain. Manage or cancel renewals in the subscription settings of the app store you purchased through. Resetting device data or signing out clears local learning data; unsynchronized records cannot be restored. Account deletion also removes synchronized learning.

Age and younger users

BunnyKorean is intended for people aged 13 and older and is not directed to children under 13. The app asks users to confirm that they are at least 13, but this acknowledgement does not verify age. Anyone under 13 must not create an account, use the guided sample, enable optional analytics or make a purchase.

Privacy consent and the parent or guardian authorization to enter the Terms of Use are separate requirements. One does not replace the other.

If we learn that personal information was provided by a child without the authorization required by law, we will take steps to delete or restrict it as required. A parent or guardian can contact repick.official@gmail.com to ask about a child’s information, request deletion or raise a concern.

Security and changes

We use measures such as encrypted network connections, protected account tokens and access restrictions to safeguard information. No storage or transmission method is completely secure. We may update this notice when the service or its information practices change; the date above identifies the latest revision. We will provide additional notice or request renewed consent when applicable law requires it.