HaruBit privacy policy

Last updated: October 31, 2026

HaruBit is an app for learning Korean. It works fully without an account and keeps your learning progress on your phone. If you choose to sign in with Google, your progress, profile nickname and settings are also stored in your account so they can follow you to other devices. HaruBit is free to start, and one-time purchases through Google Play unlock the rest of the course. It shows no ads, uses no analytics or tracking, and never sells or shares your personal information.

Who is responsible

HaruBit is made and sold by its developer ("we"), whose name, postal address and email address are shown on HaruBit's Google Play listing under "App support" and "About the developer". We decide how the data described here is used, and we are the data controller for it under the EU and UK General Data Protection Regulation (GDPR). Questions and requests about your data go to that email address.

Data on your device

HaruBit stores on your phone:

your learning progress: the lessons you finished, how you answered exercises and reviews, and the daily goals you set;
your profile nickname, if you pick one;
your settings: the daily reminder and evening note and their time, the theme and app color, sound effects, vibration and audio speed, and whether you finished the welcome screens;
which HaruBit products you bought, with the purchase tokens and order numbers Google Play gives the app, so the lessons you paid for stay unlocked offline.

We never receive this data unless you sign in, and then only your learning progress, nickname and the settings listed below. Your purchases are never sent to us or stored in your HaruBit account: Google Play restores them on any device signed in to the same Google account. Android's own backup can copy app data to your Google account's device backup; you control that in your phone's system settings, and Google handles it under its own privacy policy. Reminders, the home screen widget and hands-free listening all run on your phone without sending anything.

If you sign in with Google

Signing in is optional, and everything in HaruBit works without it. When you sign in, HaruBit uses Firebase Authentication and Cloud Firestore, services run by Google LLC on our behalf:

Data	Why	Legal basis (GDPR)
Your Google account's email address, name, the link to its profile picture and its ID, a HaruBit user ID, and when you created the account and last signed in	To create your HaruBit account and sign you in	Performing our contract with you: the sync you asked for (Art. 6(1)(b))
Your learning progress, as listed above	To sync it between your devices	Performing our contract with you (Art. 6(1)(b))
Your profile nickname, and the theme, app color, sound effects, vibration and audio speed and autoplay settings, each with the time you last changed it	To use the same name and settings on all your devices	Performing our contract with you (Art. 6(1)(b))
Your IP address and your device's user agent, processed by Firebase when you sign in	To protect sign-in against abuse	Our legitimate interest in keeping accounts secure (Art. 6(1)(f))

Data is sent encrypted (TLS), and Google stores it encrypted. The app doesn't use your Google name or picture; the profile shows the nickname you pick. The reminder and evening note and their time stay on each phone. The security rules of the database let each account read and write only its own progress and settings.

If you buy an unlock or email us

Purchases: HaruBit's unlocks are one-time in-app products sold by Google Play, which handles payment through Google Play Billing. We never see your payment details. On your phone, the app asks Google Play which products you own, confirms new purchases to Google Play as Play requires, and keeps the result on your phone so the course stays unlocked offline; none of this is sent to us. If Google Play refunds a purchase, the app locks its lessons again the next time it checks with Play, and your progress stays. Google gives us sales reports with an order number, the product, the price, and the country and region of purchase, which we keep as long as tax and accounting law requires (legal obligation, Art. 6(1)(c)). Google's own handling of your purchase is covered by Google's privacy policy.
Problem reports and email: the "Report a problem" button in a lesson opens your own email app with a message filled in: the course item, how the exercise asked and whether you answered it right, and the HaruBit and Android versions. Nothing is sent unless you send it. When you email us, we receive your email address and what you write, and use them only to answer you and fix the problem (our legitimate interest in supporting you, Art. 6(1)(f)). We delete these emails once they are handled, and at the latest 12 months later.
Sharing: pictures you share from the app go only where you send them, through Android's share sheet. We don't receive them.

Who else receives data

We don't sell, rent or share personal information with anyone, and we don't use it for advertising or profiling. The only companies that process it are our service providers, under contract:

Google LLC (Firebase Authentication and Cloud Firestore) stores your account and synced progress and settings, as our processor under the Firebase Data Processing and Security Terms.
Google (Google Play) sells HaruBit's in-app products and processes your purchases as an independent controller under its own terms.
Cloudflare, Inc. (Email Routing) receives emails sent to support@harubit.app and forwards them to our mailbox without keeping them, as our processor under Cloudflare's Data Processing Addendum.
Resend, Inc. sends our replies from support@harubit.app, so it handles the address we write to and the reply, as our processor under Resend's Data Processing Addendum.
Google LLC (Gmail) hosts the mailbox where your emails to us arrive.

Google, Cloudflare and Resend may process data in the United States and other countries. Transfers from the EU, the EEA, the UK and Switzerland rely on Google LLC's and Cloudflare, Inc.'s certifications under the EU-U.S. Data Privacy Framework (with its UK extension and the Swiss-U.S. framework) and on the Standard Contractual Clauses in each provider's data processing terms.

How long data is kept

Data on your phone, including the record of what you bought, is kept until you clear the app's storage or uninstall it. Your purchases themselves stay with your Google account at Google Play.
Your account, synced progress, nickname and settings are kept until you delete your account. Deleting it removes them from Firebase straight away; Google erases remaining copies from its backups within the periods set in its data processing terms.
Emails are kept as described above, and sales records as long as accounting law requires.

Your rights

Wherever you live, you can ask us to:

tell you what personal data we hold about you and give you a copy, including your synced progress and settings in a machine-readable format;
correct it, or delete it;
restrict how we use it, or object to our use of it based on legitimate interests.

You can delete your account and everything synced to it yourself in the app under Settings, or follow the steps at harubit.app/delete-account. For anything else, email us at support@harubit.app. We answer within one month and won't treat you differently for using your rights. If you live in the EU, the EEA, the UK or Switzerland, you can also complain to the data protection authority where you live or work.

We make no decisions about you by automated means that have legal or similarly significant effects. Choosing which words to review next is done on your phone and only affects your lessons.

What HaruBit doesn't do

No ads and no subscription. The only purchases are the one-time unlocks sold through Google Play.
No analytics, crash reporting or tracking across apps or websites. Because HaruBit doesn't track you, it has nothing to change when your browser or phone sends a "Do Not Track" or Global Privacy Control signal: it treats every learner that way.
No selling or sharing of personal information, as California and other U.S. state laws define those terms.
No access to your contacts, location, camera, microphone or files. The only permission HaruBit asks for is to show notifications, for the optional reminder and evening note.

Children

HaruBit is not directed at children under 13, and we don't knowingly collect personal information from them. A child can use the app without signing in, in which case we receive nothing. In the United States and Brazil, where the law asks apps to use the app store's age signals, HaruBit asks Google Play for your age range when it starts. Play asks you, or your parent, before sharing it. HaruBit uses the range only to turn sign-in off for anyone under 13, keeps it in memory until the app closes, and never stores or sends it. Purchases go through Google Play, where a parent can require approval for them with Google's parental controls. If you are a parent and believe your child under 13 signed in, email us and we will delete the account. If you are under 16, check with a parent before signing in.

Changes

If this policy changes, the new version is published at this address with a new date, and changes that affect how your data is used are also mentioned in the app's release notes.

Contact

Questions about privacy go to support@harubit.app, the developer email address also shown on HaruBit's Google Play listing.