Natmal

Natmal Privacy Policy

Effective date: October 25, 2026. Last updated: October 25, 2026.

This policy explains what information Natmal: Korean Crossword (“Natmal”, “the app”, “we”) collects, why, how long we keep it, and how you can delete it. Natmal is operated by MIKOMARU (미코마루), 401, 454 Gangseo-ro, Gangseo-gu, Seoul, Republic of Korea (“we”, “us”). Contact: contact@mikomaru.com.

Summary

1. Information we collect

Category What exactly Where it is stored Linked to your user ID
Anonymous user ID A random identifier created on first launch (no personal details) Our backend (Supabase) and your device —
Learning progress Puzzle progress (letters entered, hints used, time, completion), review schedule, stamps (badges), app language Our backend Yes
Purchase status Whether Premium is active, which plan, store, expiry date; coin purchases and use (amount, product, store transaction ID) Our backend and RevenueCat Yes
In-app events Events such as “shared a result”, “opened the Premium screen”, “started a purchase”, with small details like the puzzle number or product Our backend Yes
Crash reports Error message and stack trace, app version, operating system version, device model, recent screen names Sentry No
Deletion requests (web) The user ID you enter and, optionally, your email address Our backend —

Some information stays only on your device and is never sent to us: your settings (grade, theme, text size, reminder time), your word book, your streak calendar and cached puzzles. Daily reminders are scheduled locally by your device; we do not use push notification tokens. Pronunciation (“Listen”) uses your device’s built-in text-to-speech engine.

Payment details. Purchases are processed by Apple (App Store) or Google (Google Play). We never receive your card number or billing address. We receive the purchase status and a transaction identifier through RevenueCat.

Technical data. Like any internet service, our hosting providers process your IP address when the app connects to them, to deliver the service and protect it from abuse. We do not store IP addresses in our database, and we have configured crash reporting not to store them.

2. Why we use it (purposes and legal bases)

Purpose Information Legal basis (EEA/UK)
Provide the app: save progress, schedule reviews, sync across sessions User ID, learning progress Performance of a contract (Art. 6(1)(b) GDPR)
Provide Premium and coins, restore purchases, prevent fraud User ID, purchase status Performance of a contract; legal obligations for transaction records
Understand which features are used, to improve the app In-app events Legitimate interests (Art. 6(1)(f))
Find and fix crashes Crash reports Legitimate interests
Handle deletion and other privacy requests Deletion requests Legal obligation (Art. 6(1)(c))
Send daily reminders (on your device) Reminder time (device only) Consent (you can turn reminders off at any time)

We do not use your information for advertising, profiling or automated decisions that have legal or similarly significant effects.

3. Service providers

We use the following processors, which handle data only on our instructions:

Provider Role Data
Supabase, Inc. Database, authentication and server functions (Seoul, Republic of Korea) User ID, learning progress, purchase status, in-app events, deletion requests
RevenueCat, Inc. In-app purchase and subscription management User ID, purchase history, store receipts
Functional Software, Inc. (Sentry) Crash reporting Crash reports (no user ID)
Apple Inc. / Google LLC App distribution and payment processing As described in their own privacy policies

We do not sell or rent personal information, and we do not share it with third parties for their own purposes.

4. How long we keep it

Information Retention
User ID, learning progress, purchase status Until you delete your account. Guest accounts with no activity for 24 months are deleted automatically, unless they hold an active Premium plan or unused coins
In-app events 12 months, then deleted. When you delete your account, events are disconnected from your user ID
Crash reports Up to 90 days
Purchase webhook logs 90 days
Deletion requests 90 days after we process them
Data on your device Until you delete your account, clear the app’s data or uninstall the app

5. Deleting your data

Deleting your account does not cancel a subscription. To stop future charges, cancel in your App Store or Google Play account settings. Unused coins are lost when the account is deleted.

Uninstalling the app removes the data on your device but not the data on our servers; because the account is anonymous, it then becomes inactive and is deleted after 24 months as described above. If you reinstall, the app creates a new user ID. Premium can be restored with “Restore purchases”; coins cannot.

6. Your rights (EEA, UK and Switzerland)

If you are in the European Economic Area, the United Kingdom or Switzerland, you have the right to access, rectify, erase, restrict or object to the processing of your personal data, and to data portability. Where processing is based on consent, you may withdraw it at any time. To exercise these rights, contact contact@mikomaru.com and include your User ID so that we can find your data; we will respond within one month. You also have the right to lodge a complaint with your local data protection authority.

International transfers. Our service providers may process data outside your country, including in the United States. Where required, transfers rely on the European Commission’s Standard Contractual Clauses (and the UK Addendum) or an adequacy decision, together with appropriate safeguards.

Contact for EEA/UK users. We have not appointed a representative in the EU or UK. Please contact us directly at contact@mikomaru.com.

7. Other regions

8. Children

Natmal is a general-audience language-learning app and is not directed at children under 13 (or under 16 in the EEA). We do not knowingly collect personal information from children. The app does not ask for names, contact details or other direct identifiers.

9. Security

Data is encrypted in transit (HTTPS). Access to our backend is restricted by row-level security so that each user ID can read only its own records, and administrative keys are never included in the app.

10. Changes

We will post any changes to this policy on this page and update the date above. If a change materially affects how we use your information, we will tell you in the app.

11. Contact

MIKOMARU (미코마루) — 401, 454 Gangseo-ro, Gangseo-gu, Seoul, Republic of Korea — contact@mikomaru.com