Privacy Policy

1. Scope

This Policy applies to the web service provided at class.coffeecong.ai.

The Service is currently in a preparatory stage. Once features such as joining classes, creating courses, and submitting assignments are added, the information collected will change. This Policy will be revised and announced in advance at that time.

2. Information We Collect and How We Collect It

When a user signs in with a Google or Apple account, the Service receives and stores the following information from that provider.

• Email address (required)
• Name or display name (where the provider supplies it)
• Provider type (Google or Apple) and the account identifier assigned by the provider
• Whether the email address has been verified

3. Information We Do Not Collect

The Service does not collect or store the following information.

• Passwords (the Service does not create its own passwords and uses social sign-in only)
• Phone number, address, or date of birth
• Payment information
• Location information
• Advertising identifiers or behavioral data

4. Purposes of Use

The information collected is used solely for the following purposes.

• Identifying users and maintaining sign-in status
• Linking users who sign in with the same email address to a single account
• Delivering essential notices about use of the Service
• Preventing misuse and supporting the operation and security of the Service

5. Handling of Identical Email Addresses

The Service uses the email address as the basis of an account. If a Google account and an Apple account share the same email address, they are treated as the same user and linked to a single account.

As a result, signing in through either provider gives access to the same account and the same learning records. Account linking is not permitted where the provider has not verified the email address.

6. Retention and Destruction

Account information is retained until the user requests withdrawal. Upon receiving a withdrawal request, the Service deletes the account information without delay or renders it non-identifiable.

However, where records must be preserved for course administration (academic records such as attendance, quiz attempts, and assignment submissions), those records may be retained in a form that cannot identify the user.

Sign-in session information is deleted when it expires or when the user signs out.

7. Information Stored in Your Browser

The Service uses a session cookie to keep you signed in. This cookie contains only a randomly generated token and holds no personal information such as your name or email address. The cookie is set as HttpOnly so that it cannot be read by scripts, and it is transmitted only over HTTPS connections.

The server stores only a hash of the token, not the token itself. Even if the stored value were exposed, it could not be used on its own to sign in.

The Service also stores a language preference in your browser's local storage (localStorage) to remember the display language. The stored value is one of 'ko', 'en', 'ja', or 'zh', and is not information that can identify an individual.

The Service does not use cookies for advertising or for analyzing user behavior.

8. Server Access Logs

The web server automatically records access logs for operational and security purposes. These logs include the accessing IP address, the time of access, the address requested, and browser information.

These records are used solely to respond to service incidents and to block abnormal access.

9. Provision to Third Parties and Processing Entrustment

The Service does not sell or provide users' personal information to third parties.

However, given the nature of the sign-in process, information is exchanged with the following companies.

When you press a sign-in button, you are taken to that provider's sign-in screen, where you review and consent to the scope of information shared directly on the provider's screen. Each provider's own policy governs its processing of personal information.

• Google LLC — social sign-in authentication and transmission of email address and name
• Apple Inc. — social sign-in authentication and transmission of email address and name
• Amazon Web Services — server and database infrastructure for the Service (Republic of Korea region)

10. Your Rights and How to Exercise Them

You may request access to, correction of, deletion of, or suspension of processing of your personal information, and you may withdraw from the Service at any time.

Automated on-screen procedures are not yet available, so please send your request from the email address used to sign up to the contact below; we will review and process it.

You may also revoke the connection to your Google or Apple account from that provider's own account settings.

11. Security Measures

The Service encrypts all communications with HTTPS. Sign-in session tokens are stored in hashed form, and no passwords of our own are retained.

The database cannot be reached directly from outside and is connected only from within the server, and server access rights are limited to the minimum scope required for operations.

12. Changes to This Policy

If the contents of this Policy change, the changes and their effective date will be posted on this page. Changes that materially affect users' rights will be announced before they take effect.

13. Contact

Please send questions about the handling of personal information, as well as requests for access, deletion, or withdrawal, to the address below.