Aloom

Privacy Policy

Effective November 1, 2026

NomadCarpenter (“we”) runs Aloom (aloom.ink, “the service”). This policy explains what personal information we process, why, and how you can control it, as required by Korea's Personal Information Protection Act.

1. What we process

  • Account: the email address, name, profile photo address and account identifier we receive when you sign in with Google or Apple. If you choose Apple's Hide My Email, we receive the relay address Apple creates.
  • Learning record: the questions and answers you choose to keep, the nodes, links and tags made from them, and your review questions and recall history. Answers you choose to discard are never stored.
  • Access: the invitation code you used and when, if you used one.
  • Payments: if you pay for a subscription, Paddle, the seller, takes your email address, payment method and billing country directly at checkout. We never receive your payment details; we receive only the subscription's state (its plan, when it was paid and when it ends), tied to your account identifier, and Paddle's identifiers for you and the subscription.
  • Usage: for every call to an AI model, its kind, model, token counts, cost and duration. The content of your questions and answers is not kept here.
  • Logs: running the service, Google Cloud may automatically log IP addresses, request times and errors.
  • Usage statistics: which screens you open and which buttons you press, how often you ask, keep and review and how it went (how long an answer took, whether you got a question right), your IP address and the approximate location it suggests (country, region, city), your device and browser (operating system, browser, screen size), and where you came from. They are tied to your account identifier. They never contain your questions, answers, searches or tags.
  • On your device: your chosen language and your sign-in state. We use no advertising cookies, and usage statistics are gathered without leaving cookies or identifiers on your device.

2. Why

  • To sign you in
  • To confirm a paid subscription and apply the limits that come with it
  • To answer your questions, connect what you keep into your graph, and make review questions
  • To understand usage and cost, keep the service running and design its pricing
  • To see how the service is used and make it better (usage statistics)
  • To answer you, and to prevent outages and abuse

We use it for nothing else, and we never use it for advertising or sell it.

3. How long we keep it

We keep your information until your account is deleted. When you ask us to delete it, we delete your account and everything under it, including its usage statistics, without delay and within 30 days at the latest. A node you delete in the service is removed from storage at once and cannot be restored.

Logs are deleted after Google Cloud's default retention of 30 days. Anything the law requires us to keep is kept separately, for that period only. Electronic files are deleted so they cannot be recovered.

4. Sharing

We do not share your personal information with third parties, except where the law specifically requires it or an investigating authority requests it through the procedure the law sets out.

5. Processors and transfers abroad

To provide the service we rely on the companies below, and your information is transferred abroad in the process. Transfers happen over encrypted connections each time you use the service, and the information is kept as in section 3 or under each company's own policy.

  • Google LLC (United States): sign-in (Firebase Authentication), database and server functions, web hosting. Your account and your whole learning record. The database and functions are in the Seoul region; sign-in and hosting may be processed in Google facilities elsewhere.
  • Anthropic (United States): answers, answers to follow-up questions, and review questions. Your questions, answers and node content, never your account details. Anthropic does not train its models on data sent through its API.
  • TypeSafe (United States): judgments such as where new knowledge joins your graph and what shape a review question takes. Your questions, node titles and tags, never your account details.
  • PostHog Inc. (United States): collecting and analysing usage statistics. Your account identifier, what you do in the service, your IP address and approximate location, and your device and browser details; never the content of your questions and answers or your email address.
  • OpenAI (United States): the embeddings that suggest connections. Your node content, never your account details. This feature is currently switched off. OpenAI does not train its models on data sent through its API, and may keep it for up to 30 days to monitor abuse.
  • Paddle.com Market Limited (United Kingdom): as the seller (Merchant of Record) of paid subscriptions, payments, working out and paying taxes, receipts and refunds. Your account identifier, and the email address, payment method and billing country it takes directly at checkout; never the content of your questions and answers.
  • Apple Inc. (United States): authentication, if you sign in with Apple.

If you do not want your information transferred, you can stop using the service or ask us to delete your account. These transfers are needed for the service's core functions, so the service cannot be used without them. Each company's privacy contact is in its own privacy policy.

6. Your rights

You can ask at any time to see, correct or delete your personal information, or to stop its processing. Write to support@nomadcarpenter.com; once we have confirmed it is you, we reply with the outcome within 10 days. You can delete the nodes you kept yourself, in the service.

7. Children

The service is for people aged 14 and over. We do not knowingly collect personal information from children under 14, and we delete it if we learn we have.

8. Security

  • All traffic is encrypted with HTTPS.
  • The database is closed to the app itself; server functions check your sign-in and access before touching your account's records, and only those.
  • API keys for the AI models are kept in Google Secret Manager.
  • Access to personal information is limited to the operator.

9. Google user data

What we receive from Google Sign-In (your email address, name and profile photo) is used only to sign you in and show your account. Aloom's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use it for advertising, sell it, send it to AI models or use it to train them.

10. Who is responsible

For questions, complaints or remedies about your personal information, contact:

11. Other remedies

To report or seek advice about a privacy violation, you can also contact these Korean authorities.

  • Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
  • Personal Information Infringement Report Center: 118 (privacy.kisa.or.kr)
  • Supreme Prosecutors' Office: 1301 (www.spo.go.kr)
  • Korean National Police Agency: 182 (ecrm.police.go.kr)

12. Changes

We announce changes to this policy on this page and in the service 7 days before they take effect, or 30 days before for changes that work against you.

  • October 24, 2026: first in effect
  • October 24, 2026: usage statistics (PostHog) added
  • October 25, 2026: IP address, approximate location and device details added to usage statistics
  • November 1, 2026: payments for paid subscriptions (Paddle) added, and checking that an account was invited removed

This document is provided in Korean and English. If the two differ, the Korean version governs.