Privacy Policy
Published 2026-09-14 · Effective: Date of public App Store launch · Version 1.1
This launch edition applies to use of the publicly released service. It does not apply retroactively to pre-launch testing or replace permission for earlier data transmissions. Facet is made and operated by EchoKindness (따뜻함의발견, represented by Chansoo Kim).
1. Names, nicknames and accounts
There is no sign-up or separate login account. However, onboarding asks what to call you and collects a name or nickname. A real name is not required. This answer is saved on your device with your other onboarding answers and may be sent to OpenAI as context for personalized questions, keywords, reports and recaps. We do not require email or phone details for registration. RevenueCat processes the customer identifier created on your device and purchase information for purchase verification and purchase analytics. Having no account does not mean that processing is anonymous or that no data reaches third parties.
We do not use the advertising identifier (IDFA) or an advertising SDK, and do not request access to contacts, photos or location. Free-form answers or support emails may contain personal information you choose to provide.
2. Device storage and iCloud sync
Records are saved on your device. The app syncs records between iPhones and iPads using the same Apple account through that account's Apple CloudKit private database, when iCloud is available. This does not publish records to other users. Eight record types are included:
- Question cards, written answers, and onboarding answers (including names or nicknames)
- Question categories and keywords, milestone reports, and weekly recaps
- Deck progress and completion summaries, and area summaries
Record language, timestamps, relationships and progress information are also synced. App language selection, notification preferences, guidance entered in Settings, and AI-sharing permission are managed per device and are not part of this CloudKit record sync. Purchase access is checked separately through Apple and RevenueCat; syncing records does not itself restore purchases. Withdrawing permission to send data to OpenAI does not disable CloudKit sync.
Updates can be delayed by connectivity, iCloud sign-in or storage availability, and system conditions. Saved records remain readable offline, and changes are reflected after syncing becomes available. Our server does not operate this full record archive. OpenAI sharing for generation, reported questions and operational retention are described separately below.
3. AI sharing, consent and provider retention
To generate personalized questions, keywords, reports and recaps, the necessary onboarding answers (including your name or nickname), relevant questions and answers (including earlier records where needed for the feature), profile and keywords, guidance entered in Settings, and language information are sent through our server to OpenAI in the United States. The particular data sent depends on the feature being requested. Free-form content may identify you even without a name; we do not describe this sharing as anonymous.
The app explains the recipient, purpose and data before requesting explicit permission. If you decline or withdraw permission in Settings, it stops sending subsequent AI-generation requests. You can still read records already saved on your device. Withdrawal does not delete earlier transmissions or recall requests already in progress.
Under OpenAI’s default settings, API data is not used for training unless sharing is opted into. No training does not mean no retention. Current Responses API requests do not disable response storage, so response data is stored for at least 30 days under default retention settings. Separately, abuse-monitoring logs can retain request and response content for up to 30 days, or longer if legally required. Facet does not claim approved zero retention. See OpenAI API data controls.
Deleting the app or withdrawing permission does not immediately delete data already sent to a provider. For retention or deletion questions, contact support@echo-kindness.org. If we change AI providers or the scope of sharing, we will explain the change and obtain any required renewed permission.
4. Server processing and retention
Generation requests include the selected Korean or English language identifier. We do not retain question or answer text on our servers except for reported questions described in section 5. The app has no sign-up or separate login account, but this does not mean that request-authentication state is never stored.
The subscription identifier used for entitlement checks and usage counting is assigned by RevenueCat, rather than being an Apple transaction number itself. We do not receive payment methods or Apple account login credentials. Device-authentication and access data, including the device identifier, App Attest public key and request counter, and onboarding allowance, are also retained.
| Item | Purpose | Retention |
|---|---|---|
| Device identifier and onboarding allowance | Onboarding usage and access lookup | Until deletion is requested |
| App Attest public key, device identifier and request counter | Request origin and replay protection | Until deletion is requested |
| Subscription lookup result (access, expiry, RevenueCat subscription identifier, subscription-history flag, check time) | Subscription and trial access checks | Up to 1 hour; inactive results up to 5 minutes |
| Deck-access lookup result (entitlement identifiers, expiry information, check time), linked to device identifier | Free and purchased deck access control | Up to 5 minutes |
| Daily and monthly usage per subscription or per device and deck | Generation limits | Daily count 2 days; monthly count 40 days |
| App Attest challenge and daily new-registration count | Request authentication and abnormal-registration limits | Challenge 5 minutes; count 2 days |
| Reported question text, type, style, explanation, language and localization version | Question quality improvement | Deleted after review, at most 1 year |
| Workers operational logs (request URL/method/status, partial identifiers, outcomes and token counts) | Diagnostics and operations | Up to 7 days |
Usage records do not contain question or answer text. The device identifier is a random string created on first launch and kept in the device keychain; it can survive reinstalling. Cloudflare Workers log persistence is enabled. Logs include request URL, method and response status, partial device/subscription/attestation-key identifiers, outcomes, token counts and error categories. No separate log export or external log forwarding is currently configured. Native Workers log retention is 3 or 7 days depending on the plan, with a maximum of 7 days. Other provider retention is described separately in section 6.
5. Questions you report
Reporting a question through ‘Give me another question’ sends its text, type, style, explanation where supplied, selected language and localization version to our server. Answer text is not included in the report request, but personalized questions and explanations can reflect your circumstances. We use reports to improve question quality and delete them after review, with automatic deletion within one year at the latest. You do not have to report a question you do not wish to share.
6. Service providers and international processing
| Service | Purpose | Information received | Processing location and retention |
|---|---|---|---|
| Apple (App Store) | Payments, subscriptions, deck purchases and refunds | Apple payment and purchase/transaction information | US and other locations; retained under Apple's policies |
| Apple (CloudKit) | Record sync within the same Apple account | Records and related information in section 2 | Apple's iCloud infrastructure; deletion and backups in section 7 |
| RevenueCat | Purchase verification and purchase analytics | Customer identifier created on device, Apple purchase/subscription information, device/app information | US and other locations; while needed for purchase verification during the service or until a deletion request is processed, subject to legal retention exceptions |
| Cloudflare | Request relay, authentication, usage, reports and website hosting | AI request/response processing, information in sections 4–5, connection IP and request metadata | Global edge; application storage periods in section 4 |
| OpenAI | Question, keyword, report and recap generation | Generation context described in section 3 | US; retention described in section 3 |
| Google Fonts | Website font display | Connection information such as IP address and browser information sent with font requests | Google's infrastructure, processed under Google's policies |
The website loads fonts from Google Fonts, so a visitor's browser sends font requests directly to Google. This is separate from sharing answer records in the app. The RevenueCat project currently has no active external integrations. This does not mean RevenueCat does not perform its own purchase processing and analytics. Our server's 5-minute or 1-hour cache expiry does not apply to RevenueCat customer data; deletion requests are handled using the relevant customer identifier. Return/deletion on contract termination and backup or legal retention exceptions follow RevenueCat's Data Processing Agreement.
Data is transmitted over the internet when you use the relevant feature and may be processed outside Korea. Expiry of our server cache does not delete a provider's own records. Provider purchase, transaction and security records may be retained under their policies and applicable law. Contact us as described in section 7 for access or deletion questions.
Apple Privacy Policy · RevenueCat Privacy Policy · Cloudflare Privacy Policy · OpenAI API data controls
RevenueCat Data Processing Agreement · RevenueCat customer deletion guidance · Cloudflare Workers log retention · Google Fonts privacy guidance
7. Deletion and backup management
The app currently has no built-in button to delete all records or turn CloudKit sync off. Deleting the app removes its data from that device, but does not erase synced CloudKit records, copies on other devices, exported files or iOS backups. Cloud records may return after reinstalling with the same account. Withdrawing AI permission or cancelling a subscription does not delete records.
Manage or delete Facet's CloudKit data through Apple's iCloud storage management. Menu names vary by OS version. Records may return if copies on other devices or backups are used again, so check those copies as well when your intention is complete deletion. See Apple's guidance for third-party iCloud app data, or contact support@echo-kindness.org for deletion guidance. Requests to delete information on our server are separate from managing private records in your Apple account.
iCloud sync does not replace a separate point-in-time backup. Exported files created in Settings and iOS device backups must be managed and deleted separately. Backup import is available only when the app has no existing records, and imported records may also sync through CloudKit. Exported files do not contain AI-sharing permission.
For access or deletion requests concerning information processed by our server and service providers, email support@echo-kindness.org. We explain how to identify the relevant records, verify the requester, and delete data or guide a provider request subject to applicable retention obligations and our control over the data. This is separate from managing private records in your Apple account. Cancel subscriptions through iOS Settings › Apple Account › Subscriptions.
8. Children
The app is intended for people aged 14 and over. We don't knowingly collect information from children under 14.
9. Notifications
Daily reminders and the weekly recap notification are scheduled on your device. Notification scheduling does not send the reminder schedule or answer status to our server. Operational requests such as AI generation and purchase verification are separate. You can turn notifications off in Settings.
10. Contact
Privacy officer: Chansoo Kim · support@echo-kindness.org
When you email support, we use your email address, inquiry and any identifiers or attachments you provide to respond and handle access or deletion requests. We retain them for as long as needed for that purpose and delete unnecessary information once handling is complete. Information may be retained to the extent and for the period needed to meet legal obligations or resolve disputes.
Send questions, access or deletion requests, and complaints by email. We reply as soon as we can. Residents of Korea may also contact the Personal Information Infringement Report Center (privacy.kisa.or.kr, 118) or the Personal Information Dispute Mediation Committee (kopico.go.kr, 1833-6972).
11. Changes to this document
When the contents change, we post the new version on this page and update the effective date. Significant changes, such as keeping additional data, are announced on this page and in the app at least 7 days before they take effect. We follow any longer notice period or separate consent requirement imposed by applicable law.
Revision history
| Version | Effective | Change |
|---|---|---|
| 1.1 | Date of public App Store launch | Consolidated launch edition: AI sharing, retention and consent; iCloud sync; purchases and language |