Privacy Policy

Sori stores the minimum needed to run your account and your flashcards. We don't sell data, we don't run third-party ad trackers, and the extension only reads the part of the page you deliberately point it at.

• Account data — your email address, an optional display name, and a salted hash of your password (we can never read the password itself). If you sign in with Google we store your Google account ID, email and name as provided by Google — never your Google password.
• Flashcard data — the words you save, their translations, example sentences, the source you noted (e.g. "Webtoon"), and your review history (intervals, ease, due dates) so scheduling works.
• Session & token data — hashed session identifiers and hashed API tokens, with creation and last-used timestamps.

The extension processes the image or text fragment you capture in order to recognise the Korean in it; the fragment itself is not kept once the word has been extracted.

Sori uses a single first-party, HttpOnly session cookie to keep you signed in (30 days), plus a short-lived cookie during Google sign-in to prevent CSRF. There are no advertising or cross-site tracking cookies.

Payments are processed by Stripe. Your card details go directly to Stripe and never touch our servers; we only receive a customer reference and the subscription status. Stripe's own privacy policy applies to the payment itself.

Your data is stored in our Postgres database and kept while your account exists. Expired sessions are deleted automatically. If you delete your account, your personal data and flashcards are deleted; residual copies in encrypted backups expire on the backup rotation schedule.

We share data only with the infrastructure providers needed to run Sori (hosting, database, payments) under data-processing agreements, or when the law requires it. We never sell your data.

Depending on where you live (e.g. GDPR in the EU), you may have the right to access, correct, export or delete your personal data, and to object to or restrict processing. Email us and we'll handle it — no forms, no dark patterns.

Privacy questions: privacy@sori.app (placeholder — will be updated at launch).