Draft. This document is being finalised before launch and may change.
Privacy Policy
Effective date: 2026-11-01
TODO Operator name ("we") runs the Lexidomy app and lexidomy.com (the "Service"). We follow Korea's Personal Information Protection Act, the EU and UK GDPR, and Japan's APPI. This policy explains what personal data the Service processes, why, and when we delete it. If the Korean version differs from this one, the Korean version prevails.
1. Data we process
You can play as a guest without signing up. We do not ask for your name, phone number or email address.
| Category | Data | How we get it |
|---|---|---|
| Guest account | An internal account ID, your language setting, your device time zone | Created automatically on first launch |
| Gameplay | The words and topics you draw, the sentences you write, the AI opponent's sentences, scores, how many battles you played today, when you last used the app | When you play |
| Reports | The reason you pick and any note you write | When you report a battle |
| Connection data | IP address, time of request, requested path, app and device information (User-Agent) | Automatically when you use the Service |
The app stores a session token in your device's secure storage (iOS Keychain, Android Keystore) to keep you signed in. The birth year and month you enter on first launch are not stored: only whether you may play is kept on the device, and it is never sent to us. The website uses no cookies and no analytics.
Before we add features such as social sign-in, nicknames and rankings, or paid subscriptions, we will update this policy with any additional data they need.
2. Purposes and legal bases
| Purpose | Data | Legal basis |
|---|---|---|
| Running battles (giving you a word, generating the opponent's sentence, scoring, showing results) | Guest account, gameplay | Performance of our contract with you |
| Applying daily limits and preventing duplicate requests | Guest account, time zone, battle count | Performance of our contract with you |
| Preventing abuse, security, troubleshooting | Connection data | Our legitimate interests |
We do not use your sentences to train AI models. If we ever want to use them to improve scoring, we will ask for your separate consent first.
3. Retention
| Data | How long we keep it |
|---|---|
| Guest account and gameplay | Until you delete your data in the app or ask us to. Deleted after 1 year without use |
| Connection data (web server logs) | Up to 14 days |
| Backups | Up to 3 days on the server, and up to 30 days as encrypted copies in Cloudflare R2 |
| Hashed IP used to limit sign-ups (cannot be turned back into the IP) | Up to 2 days |
When the retention period ends we delete the data so that it cannot be recovered, unless a law requires us to keep it longer.
4. Service providers and international transfers
We use the following providers to run the Service. Data is sent to them over encrypted connections (TLS) while you use the Service.
| Recipient | Country | Data | Purpose | Retention |
|---|---|---|---|---|
| Google LLC (Gemini API) | United States | Words, your sentence, the opponent's sentence, language | Generating the opponent's sentence, scoring | Limited period for abuse monitoring under Google's terms. We use the paid API, and Google does not use these inputs to train its products |
| Cloudflare, Inc. | United States and global network | IP address, request data, encrypted database backups | Content delivery, security (DDoS protection), backup storage (R2) | Request data short-term under Cloudflare's policies; backups up to 30 days |
| Hostinger International Ltd. | TODO 서버 국가 | All Service data | Server hosting | Until our contract ends |
Transfers outside your country are needed for the Service's core feature (AI battles and scoring). Where required, they rely on the European Commission's Standard Contractual Clauses or an adequacy decision. If you do not want your data transferred, you can stop using the Service and ask us to delete your data. We do not sell or share your personal data with third parties.
5. Children
The Service is for people aged 14 or older in Korea and 13 or older elsewhere (or the higher age your EU member state sets). If we learn that we hold data from a younger child, we delete it.
6. Your rights
You can ask to access, correct, delete or restrict the processing of your data, and EEA and UK users can also ask to receive their data in a portable format. Use the delete option in the app's settings or email contact@lexidomy.com. Because guest accounts have no name or email, include the account ID shown in the app. We reply within 10 days (and always within the time the law allows).
If you are in the EEA or UK, you can also complain to your local data protection authority.
7. Security
- All traffic is encrypted with TLS, and our server only accepts requests that come through Cloudflare.
- The database is only reachable from our internal network.
- Server access is limited to the operator's own keys.
- We do not collect passwords, and session tokens are signed so they cannot be forged.
8. Automated scoring
Scores are game results produced by AI models. They have no legal or similarly significant effect on you. If you think a result is unfair, you can ask for a review through the in-app report button or by email.
9. Contact
- Privacy officer: TODO 개인정보 보호책임자 이름
- Email: contact@lexidomy.com
10. Changes
We announce changes in the app and on this page 7 days before they take effect, or 30 days before for changes that significantly affect your rights.