Vocado Logo

Privacy Policy

Last updated: October 21, 2026

Vocado helps people learn Korean through K-pop lyrics. This policy explains what personal information Vocado collects when you use the website at voca.do and beta.voca.do (the "Service"), why we collect it, who we share it with, how long we keep it, and what you can ask us to do with it.

Vocado is run by an individual operator based in the Republic of Korea ("we", "us"). We handle personal information in line with the Personal Information Protection Act of Korea and other laws that apply to us. You can reach us at contact@voca.do.

1. Information we collect

We collect only what the Service needs. Depending on how you use it, that is:

  • Waitlist sign-up: your email address, and your name if you join with Google. We also keep how you signed up, the campaign tags and referral code in the link you arrived from (for example utm_source, or an ad click ID such as gclid), and the country your connection comes from. We don't store your IP address.
  • Waitlist survey and song votes (optional): the answers you choose to give, such as the artists you like, your Korean level, how you use lyrics and how many songs you learn, where you heard about Vocado, the services and apps you use, the features you want, the songs you vote for, and any note you write.
  • Beta survey (optional): the answers you give in the beta tester survey, and a tester code made from your account. The code lets us connect your answers to how you use the Service; it isn't your name, email address or account ID, and only we can tell which account it belongs to. The survey runs on Tally.
  • Your account: when we invite you to the beta, we create your account with your waitlist email address and keep it on the list of invited addresses, so we can check that you have access. When you sign in with Google, Google shares your email address, name, Google account ID and profile picture link, and our sign-in provider records when you sign in, with your IP address and browser. If email sign-in is offered, we use your email address to send you a sign-in link. If you sign in with a Google account that wasn't invited, you are signed out, but the sign-in record may remain until you ask us to delete it.
  • Your learning: the words you save, your review ratings and schedule, the songs you complete, and the answers you give when you start (your Korean level, your goals and up to five favorite artists).
  • Last.fm (optional): if you connect Last.fm, we keep your Last.fm username. While Vocado is open, we use it to read the song you are playing right now on Last.fm, so we can offer that song. We reuse that answer from memory for up to two minutes and never write it to a database, and we don't keep your listening history. Disconnecting Last.fm deletes your username.
  • Requests and reports you send: song or feature requests (title, artist, a YouTube link and a note), problem reports about a song or a lyric line, feedback you send us, and videos you suggest for a song. Reports, feedback and video suggestions are linked to your account. Requests are not linked to your account; to limit abuse, we link them to a random browser ID and to a one-way, keyed hash of your IP address, never to the address itself.
  • Technical information: your IP address, browser details and the pages you request, recorded in our hosting provider's request logs; your browser's language; the country your connection comes from (provided by our hosting provider); and error reports from pages that fail. Before we write an error report, we remove email addresses, search text, lyric text and other personal details from it.
  • Visit counts: on the landing page and the trial song you can open without signing in, we count how many visits reach each step (the page opening, a word tapped, a sign-in link pressed). We keep only a number per day, step and traffic source (YouTube, Google, Reddit, another site, or none), never anything that identifies you: no IP address, cookie, ID or link. Your browser keeps the steps it already counted and that source in its session storage (vocado_guest_steps), which is cleared when you close the tab.

We don't collect payment information. We don't record or analyze your voice; the Service blocks microphone access.

2. Why we use it

  • To run the waitlist and send you your beta invitation and news about the beta.
  • To sign you in and check that your account has beta access.
  • To provide the Service: show songs and lyrics, save your words, schedule your reviews and track your progress.
  • To show the song you are playing on Last.fm, if you connect it.
  • To answer your requests, reports and questions.
  • To understand which campaigns and links bring people to Vocado, and to improve the Service using page-view statistics (Vercel Web Analytics and Google Analytics) that we look at only in aggregate.
  • To keep the Service secure, prevent abuse and fix errors.
  • To meet our legal obligations.

We don't sell your personal information, and we don't build advertising profiles of our own. The only personalised ads are Google remarketing to people who joined our waitlist (section 3). To measure whether our ads on Google, Reddit and Meta work, we tell them when a waitlist or beta sign-up happens (section 3). We don't send your personal information to AI services.

3. Who we share it with

We don't give your personal information to third parties except: when you ask us to or agree to it; to the service providers below, who handle it for us; or when the law requires it.

These service providers process information on our behalf:

  • Supabase, Inc. (United States): our database and sign-in system. It stores the information in section 1. Our database is hosted in Seoul, Korea.
  • Vercel Inc. (United States): hosts the website. Its server functions run in Seoul, and requests may pass through Vercel's global network on the way. It keeps request logs and provides Vercel Web Analytics, which counts page views without cookies.
  • Google LLC (United States): lets you sign in or join the waitlist with your Google account. Google shares your name and email address with us when you choose to. On the landing and the beta sign-in page your browser loads Google's sign-in script, which can offer the Google accounts signed in on your device for one-tap sign-in and tells Google that the page was opened. Google handles this under its own privacy policy.
  • Reddit, Inc. (United States): measures our Reddit ads. On the waitlist and beta pages your browser loads the Reddit Pixel, which tells Reddit about page visits and a sign-up and uses Reddit's cookies. When you join the waitlist or start the beta we also send Reddit a one-way hashed (SHA-256) copy of your email address, the Reddit ad click ID in the link you arrived from, and your browser's user agent, so Reddit can match the sign-up to an ad click. When your connection comes from the European Economic Area, the UK or Switzerland, your browser doesn't load the Reddit Pixel and we send Reddit nothing about your sign-up. Reddit handles this under its own privacy policy.
  • Meta Platforms, Inc. (United States): measures our ads on Facebook and Instagram. On the landing, waitlist and beta pages your browser loads the Meta Pixel, which tells Meta about page visits and a waitlist or beta sign-up and uses Meta's cookies. The sign-up carries only a random ID, never your name or email address. When your connection comes from the European Economic Area, the UK or Switzerland, your browser doesn't load the Meta Pixel. Meta handles this under its own privacy policy.
  • Google LLC (United States), Google Ads: measures our Google ads. On the landing and beta pages your browser loads the Google tag, which tells Google about page visits and a beta sign-up and uses Google's advertising cookies. The sign-up carries only a random ID, never your name or email address. Ad personalisation is off on today's landing and beta pages, and in the European Economic Area, the UK and Switzerland the tag sets no advertising cookies. Remarketing: if you joined our waitlist, the waitlist pages' Google tag added your browser to an audience list Google keeps for us, so Google may show you Vocado ads on YouTube and Google's feeds for up to 540 days after you joined. We see only how many people are on the list, never who they are. You can turn off personalised ads from Google at myadcenter.google.com. Google handles this under its own privacy policy.
  • Google LLC (United States), Google Analytics: the same Google tag also tells Google Analytics which landing and beta pages are viewed, the campaign or link you arrived from, your device and browser type and your approximate location from your IP address, using Google Analytics cookies with a random ID. We use these statistics only in aggregate, ad personalisation is off, and in the European Economic Area, the UK and Switzerland the Google tag sets no cookies. Google handles this under its own privacy policy.
  • Tally BV (Belgium): runs the optional beta tester survey and stores its answers, with your tester code, in the European Union. When you open the survey you are on Tally's site, which also handles your IP address, browser information and its own cookies under Tally's privacy policy.

These companies may process information outside Korea, in the countries listed, to provide their services. The information is sent over encrypted connections when you use the Service, and kept for the periods in section 5. If you don't want your information transferred this way, you can choose not to use the Service, or ask us to delete your information (section 6).

If you connect Last.fm, we send your Last.fm username to Last.fm Ltd. (United Kingdom) when we read your now-playing song. Last.fm handles it under its own privacy policy.

Some content comes straight from other companies' servers to your browser. When it loads, that company receives your IP address and browser information under its own privacy policy:

  • Musixmatch: on pages that show lyrics licensed from Musixmatch, your browser loads a Musixmatch tracking script or image each time the lyrics are shown, which Musixmatch requires in order to count lyric views. We send Musixmatch your country so it can tell us which lyrics we may show, but no account information.
  • YouTube: only after you agree, as described in section 4.
  • Images: artist photos and album artwork may load from the servers of other services, such as Spotify or Apple.

4. YouTube

Vocado uses YouTube API Services and the embedded YouTube player to play song videos, and only after you agree to it on the song page. When the player loads, your browser exchanges information with YouTube and Google directly, such as information about your browser or device, to show the video, check whether it can be played and prevent abuse. More information is sent when you play the video, and YouTube may use cookies or similar browser and device storage.

During the private beta, the YouTube features are turned off in the European Economic Area, the United Kingdom and Switzerland, and wherever we can't reliably tell where a request comes from. Songs and lyrics you are allowed to view still work without them.

Vocado doesn't ask for or receive your private YouTube account information. Google's Privacy Policy explains how Google handles information.

Your YouTube choice, together with the notice and options you saw, is stored only in this browser's first-party localStorage. It is not saved to your account or to an audit database on our servers. If browser storage is cleared, unavailable or damaged, we don't restore your choice; we ask again. You can withdraw your agreement at any time with the button to revoke YouTube consent on the song page.

5. How long we keep it

  • Waitlist, survey and votes: until the beta waitlist is no longer needed, or until you ask us to remove them.
  • Beta survey: until the beta ends, or until you ask us to remove your answers. Deleting your account doesn't remove them from Tally; ask us and we delete them too.
  • Your account and learning data: until your account is deleted. Deleting your account deletes your saved words, reviews, progress, onboarding answers, Last.fm connection, reports and feedback. It doesn't remove your waitlist entry or your email on the invitation list; ask us and we delete those too.
  • Requests: until we have dealt with them and no longer need them to prevent abuse.
  • Server logs and error reports: for the periods set by our hosting providers.
  • Visit counts: they identify no one, so we keep them as statistics for as long as they are useful.

When we no longer need information, we delete it. Copies in our providers' backups are overwritten on their backup cycle. If a law requires us to keep something longer, we keep it only for that purpose and for the period the law sets.

6. Your rights

You can ask us at any time to:

  • show you the personal information we have about you;
  • correct it;
  • delete it, including deleting your account, your waitlist entry and your email on the beta invitation list;
  • stop or limit how we use it.

Email contact@voca.do from the address you use with Vocado, or use the option to delete your account in Settings. In the iOS app, it deletes your account and your saved words, reviews and other learning records at once. On the website, it opens an email to us, and we delete the account by request (section 5 says what deleting your account removes). We reply within 10 days. We may need to confirm that the request comes from you, and we may refuse a request where the law allows it, in which case we tell you why.

You can disconnect Last.fm and withdraw your YouTube agreement yourself at any time, and turn off personalised ads from Google, including our remarketing, at myadcenter.google.com. If you think we have handled your information wrongly, you can also contact the Personal Information Protection Commission of Korea (privacy.go.kr) or the data protection authority where you live.

7. Cookies and browser storage

Vocado sets its own cookies and browser storage to make the Service work. The only advertising cookies are the Google tag's, the Reddit Pixel's and the Meta Pixel's on the landing, waitlist and beta pages, used to measure our ads (section 3). The same Google tag also sets Google Analytics cookies to count page views (section 3). In the European Economic Area, the UK and Switzerland the Google tag sets no cookies, and your browser loads neither the Reddit Pixel nor the Meta Pixel. There we set a cookie that holds only that mark, never your country.

  • Sign-in: keeps you signed in. Where Google's one-tap sign-in is offered, Google's sign-in script also sets a cookie (g_state) that remembers whether you closed its prompt, so it isn't shown again too soon.
  • Settings: remember your language, light or dark mode, and reading and practice settings, for up to a year.
  • Waitlist: link your survey and votes to your sign-up (30 days), carry the campaign tags and ad click IDs from the link you arrived from (up to 30 days), and keep an unfinished survey while you fill it in.
  • Beta: carry the campaign tags and the Google or Reddit ad click ID from the link you arrived from (up to 30 days), which we keep with your account when you start the beta, so we can tell which ads bring people in.
  • Requests: a random browser ID that limits how many requests can be sent (180 days).
  • In your browser: your YouTube choice (section 4), your recent searches, the songs you opened recently, whether you have seen the song tips, and whether you have opened the beta survey. We don't store these on our servers. Your YouTube choice is sent with each video check so we can confirm it, and then discarded. Words saved in the browser by an earlier version of Vocado are moved to your account the first time you sign in.

You can block or delete cookies and site data in your browser settings. If you do, you may be signed out and some features may not work.

8. Security

  • All connections to the Service are encrypted (HTTPS/TLS).
  • Access to our database is limited to the operator, and each account can reach only its own data.
  • We keep secrets and admin keys on our servers only, never in your browser.
  • We remove personal details from the error reports we write. Our hosting provider's standard request logs are kept for its retention period.

No system is perfectly secure, but we work to protect your information and will tell you if a breach affects you, as the law requires.

9. Children

You must be 14 or older to use Vocado. We don't knowingly collect personal information from children under 14. If you believe a child under 14 has given us personal information, contact us and we will delete it.

10. Privacy contact

The operator of Vocado is responsible for protecting your personal information and handles all privacy questions and requests.

11. Changes to this policy

We may update this policy when the Service or the law changes. We will post the new version here with a new date. For important changes, we will also tell you in the Service or by email at least 7 days before they take effect.