Privacy Policy

The current email sign-up form requests your email address, display name and password, together with acceptance of the terms. It does not request your date of birth.

We do not collect precise location, advertising IDs, or contacts. Payment instruments (card, bank account) never reach Kavy — Apple App Store and Google Play handle the charge and forward only the receipt and outcome to us through RevenueCat.

Records kept by law

Separately from the periods above, information that law requires us to keep is stored apart and destroyed after the statutory period:

• Records of contracts, withdrawals, payments and supply of content: 5 years (Korean E-Commerce Act)
• Records of consumer complaints and dispute handling: 3 years (same Act)
• Service access logs: 3 months (Korean Protection of Communications Secrets Act)

Information whose retention period has ended is destroyed without delay in a way that cannot be recovered.

Comment moderation

Before a comment is published, we send its text and language setting to Google Vertex AI (Gemini) for an automated safety check. The response includes approval or rejection, a score, a reason and safety categories.

We do not add your email address, display name, IP address or account ID as separate fields in this request. Information you include in the comment itself is part of the text sent. Processing and retention by Google are governed by the applicable service terms; deleting your Kavy account does not itself confirm deletion of provider-held copies.

Episode generation and author voice

Episode panels and author-voice replies are generated through a third-party AI image and text generation provider. We send the persona reference sheet, the storyboard prompt, the locale, and — for author-voice replies that respond to a published comment — the comment body and your display name as it appears with the comment. No other account identifier, no email, and no IP are sent.

The provider processes data under its cloud terms. Inputs are not used to train foundation models without explicit opt-in, which we do not grant.

Private author conversations

When author chat is available, Google Vertex AI receives your message, recent conversation turns, relevant saved conversation summaries, the fictional author profile, and available public work information to generate a reply. For signed-in readers, Kavy stores conversation messages and may summarize previous sessions to support continuity. Clearing the conversation from your browser does not delete these server-side records.

Google Vertex AI (Gemini) also receives the generated reply for output safety review before it is shown. Account email addresses and IDs are not added to these chat generation or review prompts, but anything you type into a conversation can be included in the text sent to the providers.

• Contract performance — operating your account, displaying and crediting your comments, sending the transactional and notification emails you opt into.
• Legitimate interest — moderation, rate limiting, and abuse prevention.
• Consent — optional website analytics, marketing emails and push notifications. You can withdraw consent any time from the settings page or the unsubscribe link in any marketing email.

Transfers outside Korea/EEA rely on each provider's Standard Contractual Clauses or equivalent safeguards. Production data (database, uploads, primary logs) is stored in AWS Seoul.

If you are in the EEA, UK, or Switzerland, you have the right to: be informed, access your data, rectification, erasure ("right to be forgotten"), restriction of processing, data portability, and to object to processing based on legitimate interest. You may also withdraw any consent you have given.

To exercise any of these rights, email hello@kavy.app from the address on your account. We respond within 30 days. You also have the right to lodge a complaint with your local supervisory authority.

California residents have the right to know what personal information is collected, to access and delete it, to correct inaccurate data, to opt out of sale or sharing, and to be free from discrimination for exercising these rights. Kavy does not sell or share personal information for cross-context behavioral advertising.

Kavy is not directed to children. We do not knowingly collect personal information from anyone under 13 (under 14 in the Republic of Korea). Because we do not support guardian consent, accounts of children under 14 in Korea are deleted when identified. EEA/UK users under 16 may not register without verifiable parental consent, which we do not currently support. If you are a parent or guardian and believe a child has registered, contact us and we will delete the account.

Kavy uses one strictly necessary cookie — a NextAuth session JWT, HTTP-only, SameSite=Lax, 7-day TTL — to keep you signed in. For optional website analytics, configured providers load only after you allow them using the control above:

• Plausible Analytics — optional, cookie-less public page-view counts. Kavy sends a fixed public page path or an aggregate blog category only after you allow analytics. Authentication, account, chat and payment routes are excluded, along with query strings, fragments and referrers. Requests expose your network IP and browser User-Agent to the provider. Do-Not-Track, Global Privacy Control and native app use keep these analytics off. You can withdraw permission using the control above.

We do not use advertising, profiling, or cross-site tracking cookies.

Passwords are stored as salted bcrypt hashes. All traffic is served over HTTPS. Database and object storage are encrypted at rest by AWS. Access to production data is limited to operators with MFA. If we become aware of a breach affecting your personal data, we will notify affected users without undue delay and within 72 hours where required by law.

If we make material changes, we will update the "Last updated" date above and, for changes that adversely affect users with active accounts, send a notice to your registered email at least 14 days before the change takes effect.

You can permanently delete your Kavy account at any time from Account → Danger zone → Delete account while signed in. Deletion updates the active account and related service records immediately, as follows:

• Cleared from active records — email, display name, any previously stored date of birth, password hash, Google/Apple identifiers, push subscription tokens, email-verification codes, password-reset codes, private author-chat sessions and messages, saved conversation memories, and notification preferences. The sign-in methods on the row are detached so the deleted account cannot re-authenticate.
• Comments linked to the deleted account — we erase comment text and moderation details from active records and remove associated report, author-response and generation-job records. Empty internal reference records may remain. Author-lounge comments are removed from public display immediately, but their stored text is not erased automatically; email hello@kavy.app if you want it deleted. This does not automatically change previously published episode images or erase copies held outside Kavy.
• Purchase records (when IAP is enabled) — receipts and Ink-ledger entries remain linked to the internal account ID for refund handling and Apple/Google reconciliation. Account deletion does not automatically erase these records or make them anonymous.

If you cannot access in-app deletion (for example, you lost access to your sign-in method), email hello@kavy.app from the address registered on the account and we will action the deletion within 30 days.

We designate a privacy officer who oversees personal-data processing and handles inquiries, complaints and remedies. Send privacy questions and requests to access, correct, delete or suspend processing of your data to:

Contact

hello@kavy.app

For reports or advice on privacy infringement, users in Korea can contact:

• Personal Information Dispute Mediation Committee: 1833-6972, www.kopico.go.kr
• Personal Information Infringement Report Center (KISA): 118, privacy.kisa.or.kr
• Supreme Prosecutors’ Office: 1301, www.spo.go.kr
• Korean National Police Agency: 182, ecrm.police.go.kr