GollaPrivacy Policy
This is a translation of the Korean original. If the two versions differ, the Korean version prevails.
Min Q Kim (김민규) (the “operator”), who runs Golla (골라듣기), https://stt.minq.kim (the “Service”), complies with the Personal Information Protection Act (「개인정보 보호법」) and other applicable laws, and processes users’ personal information only to the extent strictly necessary to provide the Service. This policy explains what information is processed, why, and for how long, and what rights users have.
1. At a glance
- The Service can be used without logging in. In that case, texts are stored only in the user’s browser and are not sent to the operator.
- Texts saved by logged-in members are stored on the server so that they can be accessed from other devices.
- Uploaded files are converted into text inside the user’s browser, and the original files are not sent to the server.
- When a sentence is played, the user’s browser sends that sentence directly to Microsoft’s speech server (see Section 7).
- There are no ads, no visitor analytics or tracking cookies, and no marketing emails, and personal information is never sold or provided to third parties.
2. Personal information processed and purposes of processing
The operator processes the following information to the extent necessary to perform the service agreement with users (Personal Information Protection Act, Article 15(1)(iv)). Because no information that is unnecessary for providing the Service is collected, there is no separate consent procedure.
| Category | Items | Purpose |
|---|---|---|
| Members who signed up with email | Email address, password (stored only as an irreversible hash), verification code (hashed, short validity period) | Identifying members, confirming the member’s own email address at sign-up, login, password reset, sending service-related emails |
| Members who log in with Google | Email address, unique Google account ID, name, profile picture URL | Identifying members, login, automatically linking accounts with the same email, displaying name and picture on screen |
| Texts saved by members | Title, body, format (typed in, pdf, etc.), original file name, time created and modified, last reading position | Saving and loading texts, syncing across devices, resuming listening |
| Generated in the course of using the Service | Login session information (session cookie, login and expiry times, browser information), language setting, account creation and modification times | Keeping users logged in, providing screens and emails in the selected language, account management |
| Security records (members and non-members) | IP address, number of requests per email address | Preventing abuse such as brute-force login attempts and email flooding |
Passwords are transformed once in the user’s browser (key stretching) before being sent, and on the server they are combined with a value unique to each user (a salt) and stored only as a one-way hash. Even the operator cannot know the original password.
Texts and settings created by non-members remain only in the user’s browser storage (localStorage), and the operator does not receive them. They may be lost if browser data is cleared.
3. Retention and use period
- Member information and saved texts: retained until the member withdraws (deletes the account), and deleted immediately upon withdrawal.
- Texts deleted by members: deleted without delay. However, for syncing with other devices, only the text’s identification number and deletion time may remain until the account is deleted.
- Verification codes: become invalid once used or once their validity period (about 10 minutes) after issuance expires, and are deleted afterwards.
- Login sessions: deleted upon logout or expiry.
- Security records (request counts): kept for up to 24 hours and then deleted.
- Database recovery records: under Cloudflare D1’s automatic recovery feature (Time Travel), deleted data may remain in recovery records for up to 30 days and then disappear automatically. These records are not used for any purpose other than recovering from failures.
4. Provision of personal information to third parties
The operator does not provide users’ personal information to third parties, except where specifically required by law or where an investigative agency requests it in accordance with procedures prescribed by law.
5. Outsourcing of personal information processing
To provide the Service, the operator outsources personal information processing tasks as follows. The operator ensures that the processors handle personal information securely through contractual terms (data processing agreements).
| Processor | Outsourced tasks |
|---|---|
| Cloudflare, Inc. | Website hosting, server operation, database storage (member information and texts), security (blocking attacks) |
| Resend (Plus Five Five, Inc.) | Sending verification codes and notification emails |
6. Transfer of personal information overseas
Because the Service uses facilities of overseas companies, personal information is transferred outside Korea. Transfers to Cloudflare and Resend are outsourcing and storage necessary to perform the service agreement and are made by disclosure in this policy (Personal Information Protection Act, Article 28-8(1)(iii)). The Google and Microsoft entries are transmissions between the user’s browser and those companies that occur when the user chooses to use the relevant feature; they are listed here as well so that users are informed.
| Recipient (contact) | Country | Items transferred | Timing and method | Purpose of use | Retention and use period |
|---|---|---|---|---|---|
| Cloudflare, Inc. (privacy@cloudflare.com) | United States (data centers worldwide) | Member information, saved texts, sessions and security records described in Section 2; access IP addresses and request logs | Transmitted over the network each time the Service is accessed or a text is saved | Hosting, database storage, security | Until the member withdraws (periods in Section 3 apply). Access logs are subject to Cloudflare’s policies |
| Resend (Plus Five Five, Inc.) (privacy@resend.com) | United States | Recipient email address, email content (verification codes, etc.) | Transmitted over the network each time an email is sent | Sending service emails | After sending, for the period Resend retains its sending logs |
| Google LLC (policies.google.com/privacy) | United States | Google login request information (IP address, browser information, the service being logged into). After login, Google passes the email, Google account ID, name and profile picture URL to the operator | Transmitted over the network between the user’s browser and Google when the user chooses Google login | Logging in with a Google account | Subject to Google’s privacy policy |
| Microsoft Corporation (aka.ms/privacyresponse) | United States | Text of the sentence being played, IP address, browser information | Transmitted over the network directly from the user’s browser each time the user plays a sentence | Speech synthesis (converting text into speech) | Subject to Microsoft’s privacy policy (the operator does not receive or store this content) |
How to refuse, and the effect of refusing: Users who do not want their information transferred overseas can choose not to sign up, or can delete their account. However, because the Service itself is delivered through Cloudflare, refusing the transfer means member features (such as saving texts) cannot be used. The transfer to Google can be avoided by signing up with email, and the transfer to Resend can be avoided by using only Google login (in which case email verification and password reset emails cannot be received). Users who do not want data sent to Microsoft can simply not play sentences, in which case the listening feature cannot be used.
7. About speech synthesis
The Service’s voices use the speech server behind Microsoft Edge’s “Read Aloud” feature (speech.platform.bing.com). When a sentence is played, the user’s browser sends that sentence directly to Microsoft and receives the audio (MP3). This process does not pass through the operator’s server, and the operator does not receive or store the audio or the transmitted content. Users are advised not to play texts that contain sensitive personal information.
8. Procedure and method of destruction
- Personal information is destroyed without delay once its retention period ends or the purpose of processing has been achieved.
- Electronic files are deleted from the database so that they cannot be recovered. Recovery records disappear automatically after the period stated in Section 3.
- The operator does not keep personal information in paper documents.
9. Users’ rights and how to exercise them
Users may exercise the following rights at any time.
- Access and download: Saved texts can be downloaded via “Download my texts” in the account menu. To access other information, please make a request using the contact details below.
- Correction: Texts can be edited directly in the Service, and corrections to other information can be requested using the contact details.
- Deletion, suspension of processing, and withdrawal of consent: Users can withdraw immediately via “Delete account” in the account menu, which deletes member information and saved texts.
Requests made using the contact details will be handled within 10 days after verifying the requester’s identity, and the result will be communicated to you. Requests may also be made through a legal representative or an authorized agent, in which case a power of attorney must be submitted. Requests may be limited where there are grounds such as a legal obligation to retain the information, in which case the reason will be given.
10. Children under 14
Only persons aged 14 or older may sign up, and the operator does not collect personal information of children under 14 as member information. If the operator learns that an account has been created by a child under 14, the account and its information will be deleted without delay.
11. Measures to ensure the security of personal information
- All communications are encrypted with HTTPS.
- Passwords are transformed in the browser and then stored on the server only as a salted one-way hash; verification codes and session values are also stored as hashes.
- Security attributes are applied to login cookies, and the number of login attempts and emails sent is limited.
- Only the operator can access the database, and strong authentication is used for administrative accounts.
- Personal information is handled by one person only: the operator.
12. Cookies and browser storage
- Login cookie: When a member logs in, a single cookie is stored to keep the member logged in. It is strictly necessary and is not used for advertising or tracking.
- Browser storage (localStorage): Non-members’ texts and settings such as the selected language, voice and speed are stored in the user’s browser. This information is not sent to the operator.
- No advertising, analytics or tracking cookies are used.
- Cookies and storage can be cleared or blocked in the browser settings. If cookies are blocked, logging in is not possible, and if storage is cleared, non-members’ texts and settings are lost.
13. Privacy officer
For inquiries, complaints or requests for remedies relating to the processing of personal information, please contact us below. We will respond and handle them promptly.
- Privacy officer: Min Q Kim (김민규) (operator of the Service)
- Contact: https://minq.kim
14. Remedies for infringement of rights
To obtain remedies for infringement of personal information, users may apply for dispute resolution or counseling with the following organizations.
- Personal Information Dispute Mediation Committee: (in Korea) 1833-6972, www.kopico.go.kr
- Personal Information Infringement Report Center (KISA): (in Korea) 118, privacy.kisa.or.kr
- Supreme Prosecutors’ Office: (in Korea) 1301, www.spo.go.kr
- Korean National Police Agency cyber crime reporting: (in Korea) 182, ecrm.police.go.kr
15. Changes to this policy
This policy applies from 2026-10-16. If it changes, the change will be announced on the Service 7 days before it takes effect; changes that are unfavorable to users or otherwise significant will be announced 30 days in advance, and members will also be notified by email.