떠올림 개인정보 처리방침

Recall Privacy Policy (English)

Effective 2026-10-19. Scope: the Recall (떠올림) iPhone app.

1. Summary

Recall lets you shelve the books you read and the movies and TV shows you watch, save passages you like, and recall them again at growing intervals. There is no account or sign-in, and your shelf, saved passages, page photos and spine photos never reach Vivory Lab ("we"). Text recognition and speech recognition run on the device. The app uses the internet only to search for books, movies and TV shows (the search text or ISBN passes through our server to book and film information services), to download the cover of a title you add, to buy or restore Pro (Apple), and for Pro iCloud sync when you turn it on (your own iCloud). There is no advertising, analytics, tracking or crash reporting.

2. What is stored on your device

• Your shelf (titles, authors, publishers, years, ISBNs, status, progress, ratings, one-line reviews and dates for books, movies and TV shows), saved passages with their pages and notes, your recall schedule and self-grades, and memorizing stages are stored in files in the app's private storage.
• Page photos, spine photos and cover images are kept as image files in the same storage, together with where each passage sits on its page photo.
• These files use iOS file protection (unreadable until the device is first unlocked after starting up) and are included in device backups, including iCloud Backup. Backups are kept by Apple in your Apple Account; we cannot see them.
• Settings such as the reminder time, appearance and whether sync is on are kept in the app's settings.
• If a saved file cannot be read, the app sets it aside inside the app instead of deleting it and opens the previous version.

3. Permissions and on-device processing

• Camera: only to read a book page, the spines on your bookshelf or the barcode on the back of a book. Text in photos is recognized on the iPhone by Apple's on-device text recognition; photos and recognized text are never sent anywhere. Barcodes are read from the live camera view without taking a photo (searching by the ISBN read is described in section 4).
• Photo picking: only the photos you pick in the system photo picker (such as e-book screenshots or a bookshelf photo) are brought into the app. The app does not ask for access to your whole photo library.
• Microphone and speech recognition: only when you say a passage out loud from memory. It is offered only on devices that support on-device recognition, on-device recognition is required (it never falls back to server recognition), and audio is never saved. How closely your words match the passage is shown for reference only.
• Notifications (optional, off by default): a reminder with the number of passages to recall today is computed and scheduled on the device for the time you choose. Reminders never contain passage text.
• The app does not ask for location, contacts, calendars or health data.

4. When the app uses the internet

• Searching for books, movies and TV shows: when you search for a title or scan a book's barcode, the app sends our server (vivory.app) the search text (a title or author you typed, or a title read from a spine photo that you search with) or the ISBN, whether you are looking for a book or a movie or TV show, the interface language (Korean or English) and the results page number. To get the total seasons and episodes of a TV show, it sends only that show's ID (its Wikidata ID, or its TMDB ID for titles added before October 19, 2026). Requests carry only an app version tag (for example ios/1.0.0); no account, device identifier, cookie, shelf or passage is included. Search text is sent only in the request body, never in the address.
• Our server uses it to look up public title information (title, authors, publisher, year, ISBN, cover address and summary) from Kakao Book Search, Open Library and Google Books for books (and from the National Diet Library Search in Japan for Japanese books, only when the operator has switched it on) and from the Wikimedia Foundation's Wikidata and Wikipedia and from TVmaze for movies and TV shows, and returns it. Because our server makes these requests on your behalf, those services receive only the search text, ISBN or title ID (TVmaze gets only a show ID), never your IP address or anything that identifies you. Summaries are shown on screen only and not saved.
• Our server does not keep search text or ISBNs in logs or databases. To answer repeated searches quickly it keeps results (public title information) for up to one hour, keyed by a one-way hash of the search text; the text itself is not stored. Server metrics for this path keep only the response status and timing, not the IP address or device details. To prevent abuse, requests are counted per 10 minutes and per day under a one-way hash of the connection (IP) made with a server secret and the date, and these counters are deleted automatically after 10 minutes or one day (25 hours at most).
• As with any web request, the access logs of Cloudflare and of the front of our server may record basic connection details such as the time, the path (which never contains search text), the response status, the IP address and the app and iOS versions, for security and troubleshooting; they rotate out automatically. We do not use them to identify you or to build a search history.
• Cover downloads: when you add a title you found, the app downloads its cover or poster once, directly from the server that hosts the image (Kakao and Daum image servers, the Open Library covers server, the Google Books image server, the Wikimedia image server or the TVmaze image server), and stores it on the device so it shows without the internet afterwards. Like any internet connection, that server receives your device's IP address and basic details such as the app and iOS versions, and its own privacy policy applies. No cookies are used, and these downloads do not pass through our server.
• If you never search, none of these requests are made. You can add books from spine photos or by typing alone.
• Pro purchases are processed by Apple through the App Store, and the app checks Pro on the device using your App Store purchase record. We never receive your payment method or Apple Account details.
• iCloud sync (Pro, optional, off by default): when you turn it on, your shelf, passages, recall records and page, spine and cover photos move through a hidden app folder in your own iCloud Drive (not shown in the Files app) to keep your devices on the same Apple Account in step. Each device writes one file that includes a random device number made by the app and the device type name (for example iPhone). Apple stores this data in your iCloud under Apple's privacy policy; it never passes through our servers and we cannot see it. Turning sync off only stops syncing and leaves the data on your devices and in iCloud.

5. Widgets, sharing, Spotlight, Siri and Shortcuts

• Home Screen widgets (Pro): the app writes one small file for the widgets (the number of passages to recall today, the book title and page of the next passage, and the titles and small spine images of books on your shelf) to an app group container on this device. Widgets never show passage text, and this file never leaves the device.
• Sharing from other apps: text and images you send to Recall from another app's share menu stay in the app group container on this device until the app saves them as passages. They never reach us.
• Spotlight: saved passages and books are added to the search index on this device so you can find them from device search. The index stays on the device, and you can turn it off in Settings.
• Siri and Shortcuts: actions of Recall that you run from the Shortcuts app or Siri are carried out by the app on this device. When you speak a request to Siri, that voice request is handled by Apple under your Siri settings and Apple's privacy policy.

6. Importing and exporting

• Import: files exported from other services (for example Kindle's My Clippings.txt, or CSV exports from Goodreads or Readwise) are read on the device, only the file you pick in the system file picker, and turned into books and passages. The file and its contents are never sent anywhere.
• Export: only when you tap Export (내보내기), the app makes a Markdown or CSV file and hands it to the place you choose (an app in the share sheet, the Files app and so on). The file is not encrypted, the storage and sharing settings of that place apply, and it remains after you delete the app.

7. Retention and deletion

• Your shelf, passages and photos are never kept on our servers. The only traces of a search request are the results kept for up to one hour (search text as a hash only) and the connection counters deleted within 25 hours.
• Deleting the app removes the shelf, passages, photos, widget file, items received through sharing and the search index from the device. Copies in a device backup go away when you delete that backup.
• If you turned on iCloud sync, the copy in iCloud remains after you delete the app. You can delete it on your iPhone in Settings > [your name] > iCloud > Manage Storage (Manage Account Storage) > Recall.
• Delete exported files from wherever you saved them.

8. Provision to third parties, processors and transfers abroad

Because we receive no personal data, there is none to provide to third parties or to entrust to processors. For search requests:

• Network delivery: search requests pass through the CDN and security service of Cloudflare, Inc. (USA) and are handled by our server in the Oracle Cloud South Korea (Chuncheon) region. Your IP address may be processed by Cloudflare along the way.
• Title information: our server sends only the search text, ISBN or title ID to Kakao (South Korea), the Internet Archive's Open Library (USA), Google Books (USA), the National Diet Library Search (Japan, only when switched on), the Wikimedia Foundation (USA) and TVmaze (show IDs only), with nothing that identifies you.
• Cover images: your device exchanges them directly with those services' image servers (section 4).
• Pro purchases and iCloud sync are handled directly by Apple Inc. (USA).

9. Children

We receive no one's personal data, including children's.

10. Your rights and contact

You may request access, correction, deletion or suspension of processing at any time. Data protection officer: 조제이 (대표), Vivory Lab, contact@vivory.app, 070-8095-9243. General contact: contact@vivory.app or the contact page. In Korea you may also contact the Personal Information Infringement Report Center (privacy.kisa.or.kr, dial 118).

11. Changes

Changes are posted on this page with a new effective date.

12. Android version (in preparation, added October 22, 2026)

The Recall Android app is not on Google Play yet; this section applies from the day it is released. Sections 1 to 11 also apply to the Recall Android app (Google Play, package app.vivory.recall). There is no account or sign-in, your shelf, saved passages and photos stay on the device, and searching for books, movies and TV shows works as described in section 4 (the app version tag on requests looks like android/1.0.0). The differences from the iPhone app are below.

• Text recognition: text in photos and book spines is recognized on the device by Google ML Kit text recognition built into the app (the Korean bundle, which reads Korean and Latin-script text). Page scans and barcode reading use Google's document scanner and code scanner screens shown by Google Play services; Google Play services uses the camera, and this app does not ask for camera permission. Photos, recognized text and barcode values are never sent anywhere, including to Google.
• Google ML Kit usage diagnostics: when its features are used, ML Kit sends Google usage diagnostics over HTTPS, such as device information (manufacturer, model, OS version), app information (package name, version), a per-installation identifier and a device identifier for diagnostics, performance such as processing time, error codes and event types (the items Google has published). The app prepares ML Kit only right before reading text from a photo or using the scanner or barcode reader, not when the app starts. Google handles this information under Google's privacy policy; we do not receive it.
• Pro purchases are processed by Google Play, and the app checks Pro on the device using your Google Play purchase record. We never receive your payment method or Google Account details. The Google Play Billing Library sends Google diagnostics such as the success or failure of billing connections. Pro bought on Android and Pro bought on iPhone do not carry over to each other.
• Android Auto Backup: if Android backup is on in your device settings, the library file with your shelf, passages and recall records (not the photos) is included in your own Google Account backup. Google keeps the backup under Google's privacy policy; it never passes through our servers and we cannot see it. When you move to a new device (device-to-device transfer), the photos move too. You can turn backup off in the device's backup settings or delete the backup in your Google Account's backup management. There is no iCloud sync on Android.
• Permissions: internet (searching, covers, and the diagnostics and billing above), notifications (optional, off by default), microphone (saying a passage out loud: offered only on Android 13 or later when on-device speech recognition is available, recognized only on the device, and audio is never saved) and boot completed, to set the next reminder again after the device restarts. The app does not use camera, photo and video reading, location or contacts permissions, or the advertising ID. Photos are brought in only when you pick them in the Android photo picker.
• Instead of the iPhone share extension, Spotlight, Siri and Shortcuts (section 5), the Android app has Home screen widgets (Pro), Recall in other apps' share menus and in the menu shown after you select text, app shortcuts and a Quick Settings tile. All of these are handled on the device and never reach us, and no device search index is created.
• Deletion: deleting the app removes the shelf, passages, photos, widget data and items received through sharing from the device. Delete the copy in Android backup from your Google Account's backup management.
• Third parties: Google LLC (USA) directly handles Google Play billing, Google Play services (document scanner, code scanner), ML Kit usage diagnostics and Android backup (in place of Apple in section 8).