Privacy Policy

Published 2026-09-28 · Effective 2026-10-05 · Version 1.2

This document applies to use of the publicly released service. It does not apply retroactively to pre-launch testing or replace permission for earlier data transmissions. Facet is made and operated by EchoKindness (따뜻함의발견, represented by Chansoo Kim).

1. Names, nicknames and accounts

There is no sign-up or separate login account. However, onboarding asks what to call you and collects a name or nickname. A real name is not required. This answer is saved on your device with your other onboarding answers and may be sent to OpenAI as context for personalized questions, keywords, reports and recaps. We do not require email or phone details for registration. RevenueCat processes the customer identifier created on your device and purchase information for purchase verification and purchase analytics. Having no account does not mean that processing is anonymous or that no data reaches third parties.

We do not use the advertising identifier (IDFA) or an advertising SDK, and do not request access to contacts, photos or location. Free-form answers or support emails may contain personal information you choose to provide.

2. Device storage and iCloud sync

Records are saved on your device. The app syncs records between iPhones and iPads using the same Apple account through that account's Apple CloudKit private database, when iCloud is available. This does not publish records to other users. Eight record types are included:

• Question cards, written answers, and onboarding answers (including names or nicknames)
• Question categories and keywords, milestone reports, and weekly recaps
• Deck progress and completion summaries, and area summaries

Record language, timestamps, relationships and progress information are also synced. App language selection, notification preferences, usage-statistics preference, guidance entered in Settings, and AI-sharing permission are managed per device and are not part of this CloudKit record sync. Purchase access is checked separately through Apple and RevenueCat; syncing records does not itself restore purchases. Withdrawing permission to send data to OpenAI does not disable CloudKit sync.

Updates can be delayed by connectivity, iCloud sign-in or storage availability, and system conditions. Saved records remain readable offline, and changes are reflected after syncing becomes available. Our server does not operate this full record archive. OpenAI sharing for generation, reported questions and operational retention are described separately below.

3. AI sharing, consent and provider retention

To generate personalized questions, keywords, reports and recaps, the necessary onboarding answers (including your name or nickname), relevant questions and answers (including earlier records where needed for the feature), profile and keywords, guidance entered in Settings, and language information are sent through our server to OpenAI in the United States. The particular data sent depends on the feature being requested. Free-form content may identify you even without a name; we do not describe this sharing as anonymous.

The app explains the recipient, purpose and data before requesting explicit permission. If you decline or withdraw permission in Settings, it stops sending subsequent AI-generation requests. You can still read records already saved on your device. Withdrawal does not delete earlier transmissions or recall requests already in progress.

Under OpenAI’s default settings, API data is not used for training unless sharing is opted into. No training does not mean no retention. Current Responses API requests do not disable response storage, so response data is stored for at least 30 days under default retention settings. Separately, abuse-monitoring logs can retain request and response content for up to 30 days, or longer if legally required. Facet does not claim approved zero retention. See OpenAI API data controls.

Deleting the app or withdrawing permission does not immediately delete data already sent to a provider. For retention or deletion questions, contact support@echo-kindness.org. If we change AI providers or the scope of sharing, we will explain the change and obtain any required renewed permission.

4. Server processing and retention

Generation requests include the selected Korean or English language identifier. We do not retain question or answer text on our servers except for reported questions described in section 5. The app has no sign-up or separate login account, but this does not mean that request-authentication state is never stored.

The subscription identifier used for entitlement checks and usage counting is assigned by RevenueCat, rather than being an Apple transaction number itself. We do not receive payment methods or Apple account login credentials. Device-authentication and access data, including the device identifier, App Attest public key and request counter, and onboarding allowance, are also retained.

Usage records do not contain question or answer text. The device identifier is a random string created on first launch and kept in the device keychain; it can survive reinstalling. Cloudflare Workers log persistence is enabled. Logs include request URL, method and response status, partial device/subscription/attestation-key identifiers, outcomes, token counts and error categories. No separate log export or external log forwarding is currently configured. Native Workers log retention is 3 or 7 days depending on the plan, with a maximum of 7 days. Other provider retention is described separately in section 6.

4-1. Usage statistics

To understand how the app is used, we store content-free usage records in Cloudflare Workers Analytics Engine via our server. For example, we want to see at which onboarding question people stop, how many answers are written and skipped per day, and whether seeing a subscription offer leads to a purchase.

• What is sent: the kind and time of events such as opening the app, progressing through and finishing onboarding, saving or skipping an answer, reporting a question, seeing a subscription offer and the purchase result (success, cancel or failure), starting or buying a deck, and opening the map, weekly recap or report. These carry the question type (observation, hypothetical, criterion and so on) and origin (default, personalized or deck), whether it was a follow-up question, whether a choice was used, the time before you started writing, the answer-length range (for example under 20 characters or 200 and more — not the exact count), product and deck identifiers, app version and app language.
• Country: Only the country code that Cloudflare derives from the connection IP address is stored. The IP address itself is not kept in these records.
• Telling devices apart: The device identifier in section 4 is not stored as is. It is converted with a server-side secret into a pseudonymous identifier. We do not link it to the RevenueCat customer identifier or purchase records. Because it is pseudonymous, we do not describe it as anonymous.
• What is never sent: Question or answer text, your name or nickname, guidance, keywords, area names, or any other text you wrote or that was generated for you is not included in any field. The server rejects values outside the defined fields.
• Use: Only for aggregate analysis to improve the service. Not for advertising or tracking, and not provided to third parties.
• Turning it off: Settings › Send usage statistics. It is on by default. When turned off, nothing further is sent and records waiting on the device are deleted. This is separate from AI-sharing permission (section 3).
• Retention and deletion: Stored records are deleted automatically after 3 months. Because they are kept only under a pseudonymous identifier and the store does not support deleting individual records, it is difficult to single out one person's records. If you want deletion, contact support@echo-kindness.org. We will explain what is possible and, if deletion is not possible, exclude those records from analysis until the automatic deletion at 3 months.

5. Questions you report

Reporting a question through ‘Give me another question’ sends its text, type, style, explanation where supplied, selected language and localization version to our server. Answer text is not included in the report request, but personalized questions and explanations can reflect your circumstances. We use reports to improve question quality and delete them after review, with automatic deletion within one year at the latest. You do not have to report a question you do not wish to share.

6. Service providers and international processing

The website loads fonts from Google Fonts, so a visitor's browser sends font requests directly to Google. This is separate from sharing answer records in the app. The RevenueCat project currently has no active external integrations. This does not mean RevenueCat does not perform its own purchase processing and analytics. Our server's 5-minute or 1-hour cache expiry does not apply to RevenueCat customer data; deletion requests are handled using the relevant customer identifier. Return/deletion on contract termination and backup or legal retention exceptions follow RevenueCat's Data Processing Agreement.

Data is transmitted over the internet when you use the relevant feature and may be processed outside Korea. Expiry of our server cache does not delete a provider's own records. Provider purchase, transaction and security records may be retained under their policies and applicable law. Contact us as described in section 7 for access or deletion questions.

Apple Privacy Policy · RevenueCat Privacy Policy · Cloudflare Privacy Policy · OpenAI API data controls

RevenueCat Data Processing Agreement · RevenueCat customer deletion guidance · Cloudflare Workers log retention · Google Fonts privacy guidance

7. Deletion and backup management

The app currently has no built-in button to delete all records or turn CloudKit sync off. Deleting the app removes its data from that device, but does not erase synced CloudKit records, copies on other devices, exported files or iOS backups. Cloud records may return after reinstalling with the same account. Withdrawing AI permission or cancelling a subscription does not delete records.

Manage or delete Facet's CloudKit data through Apple's iCloud storage management. Menu names vary by OS version. Records may return if copies on other devices or backups are used again, so check those copies as well when your intention is complete deletion. See Apple's guidance for third-party iCloud app data, or contact support@echo-kindness.org for deletion guidance. Requests to delete information on our server are separate from managing private records in your Apple account.

iCloud sync does not replace a separate point-in-time backup. Exported files created in Settings and iOS device backups must be managed and deleted separately. Backup import is available only when the app has no existing records, and imported records may also sync through CloudKit. Exported files do not contain AI-sharing permission.

For access or deletion requests concerning information processed by our server and service providers, email support@echo-kindness.org. We explain how to identify the relevant records, verify the requester, and delete data or guide a provider request subject to applicable retention obligations and our control over the data. This is separate from managing private records in your Apple account. Cancel subscriptions through iOS Settings › Apple Account › Subscriptions.

8. Children

The app is intended for people aged 14 and over. We don't knowingly collect information from children under 14.

9. Notifications

Daily reminders and the weekly recap notification are scheduled on your device. Notification scheduling does not send the reminder schedule or answer status to our server. Operational requests such as AI generation and purchase verification, and the usage statistics in section 4-1, are separate. You can turn notifications off in Settings.

10. Contact

Privacy officer: Chansoo Kim · support@echo-kindness.org

When you email support, we use your email address, inquiry and any identifiers or attachments you provide to respond and handle access or deletion requests. We retain them for as long as needed for that purpose and delete unnecessary information once handling is complete. Information may be retained to the extent and for the period needed to meet legal obligations or resolve disputes.

Send questions, access or deletion requests, and complaints by email. We reply as soon as we can. Residents of Korea may also contact the Personal Information Infringement Report Center (privacy.kisa.or.kr, 118) or the Personal Information Dispute Mediation Committee (kopico.go.kr, 1833-6972).

11. Changes to this document

When the contents change, we post the new version on this page and update the effective date. Significant changes, such as keeping additional data, are announced on this page and in the app at least 7 days before they take effect (changes that start with an app update are announced on this page at least 7 days before they take effect and explained in the app on the first launch after the update before they apply). We follow any longer notice period or separate consent requirement imposed by applicable law.

Revision history