• Ray is an AI that remembers you. To do that, Ray stores your conversations and builds its memory of you from them.
• To write replies, Ray sends your conversations to OpenAI (United States), and when Ray double-checks a reply, it also sends them to Google (Gemini, United States). Neither company uses these conversations to train its models.
• To make Ray better, we analyze conversations with account details such as your name and email removed to find where Ray misunderstood you and fix its tone and features. We also use outside AI tools for this analysis, and account details are removed for those too (section 5). Conversations from the beta period, before this policy took effect, are not used for improvement analysis.
• We don't sell your conversations, use them for advertising, or use them to train AI models.
• Ray doesn't ask about sensitive topics such as health or sex life. But if you bring them up, they're stored with your conversations and used only for the purposes of the service.
• You can withdraw your consent to sending data to AI providers at any time (section 7).
• You can delete your account in the app at any time. Your conversations and Ray's memory are erased 30 days later. If you sign in again within those 30 days, your account is restored.
• Ray is for people 18 and older.

Company	Corca, Inc. (registered in the Republic of Korea)
Business registration no.	271-86-02206
CEO	Young Hyun Chung
Address	6F, 11-8 Teheran-ro 77-gil, Gangnam-gu, Seoul, Republic of Korea

Contactjayho@corca.ai›

Purpose	Information	Legal basis
To reply to you, remember what you share, and help with your schedule and reminders	Conversations, photos, transcribed voice, information Ray creates, calendar and reminders, location	Our contract with you (Terms of Use). Sending to AI providers is based on your in-app consent ("How Ray replies" → "Agree and send")
To improve Ray and the service. We analyze conversations with account details removed to find where Ray misunderstood you and fix its tone and features	Conversations with account details removed, app usage records	Further use reasonably related to the original purpose (Korea's Personal Information Protection Act, Art. 15(3)). The criteria are below
To create your account and keep you signed in	Account information	Performance of contract
Safety: if Ray notices signs of risk of self-harm or suicide, it points you to crisis support	Conversations	Protecting your life and physical safety
To process subscription payments (if you use paid features)	Payment records	Performance of contract; Korean e-commerce law
To comply with the law and prevent abuse	Records as needed	Legal obligations

We don't use your conversations for advertising or marketing, we don't analyze or categorize you for marketing, and we don't sell them. We also don't use your conversations to train AI models.

How we judged that improvement analysis is a compatible further use (PIPA Enforcement Decree Art. 14-2)

• Relation: Conversations you have to use Ray are used only to improve Ray's own replies and features, not to build other services.
• Predictability: We tell you in advance in this policy and through the policy link on the in-app consent screen.
• No undue harm: We don't use them for advertising or sale, and we don't make decisions that disadvantage you based on the analysis.
• Safeguards: We remove account details such as your name and email and handle conversations only under a random account ID. Access to analysis data is limited to designated accounts. If you withdraw consent or delete your account, we exclude your conversations from analysis. Conversations from the beta period, before this policy took effect, are not used for analysis.

Our Chief Privacy Officer checks that improvement analysis follows these criteria.

When you sign up

• Sign in with Apple: the user identifier Apple provides, your email (or Apple's relay address if you choose Hide My Email), and your name, which we receive once when you first sign up
• Sign in with Google (Android app): name, email, profile photo, and birthday and gender if they're in your Google account
• Records of your in-app consent and of any withdrawal (policy version, language, country, time)
• Your answer to the 18+ check (answer, language, country, time), kept as long as consent records (section 4)

While you use Ray

• Conversations: what you write, Ray's replies, photos you attach, and text transcribed from voice input. Your device's speech recognition (Apple on iPhone, Google on Android) turns voice into text; the audio itself doesn't reach Ray's servers.
• Information Ray creates from conversations: memories, a profile and interpretation Ray puts together to understand you, daily entries, and safety assessments (Ray's check of whether a conversation shows signs of risk of self-harm or suicide)
• Only if you grant permission: calendar events and reminders on your device, location coordinates, and the device identifier needed to receive notifications (push token)
• Automatically: device model, OS and app version, language, region and time zone settings, IP address and the country estimated from it, and app usage records (screens, buttons, responses to notifications)
• If you use paid features: Apple transaction ID, product, and subscription status

Information we don't process: Health app (HealthKit) data, contacts, and motion and fitness data.

Ray doesn't ask about sensitive information such as health (including mental health), sex life, or political views. But Ray is someone you can open up to, so you may bring these topics up. When you do, they're stored with your conversations and used only for the purposes in section 1, never for advertising, sale, or any other purpose.

Ray checks conversations for signs of risk of self-harm or suicide, and if it sees them, it points you to crisis support (section 9).

You can delete saved records one at a time in the app. If you delete your account, everything including your conversations and Ray's memory is erased 30 days later (sections 4 and 7).

Information	Retention
Account, conversations, memories, photos, information Ray creates	Until you delete your account. When you request deletion, we keep it for 30 days and then erase it. If you sign in again during those 30 days, your account is restored
Notification delivery records	Same as above
App usage records (Amplitude)	When you delete your account, we ask Amplitude to delete them
Copies used for improvement analysis	Erased when your account deletion becomes final
Improvement analysis results	When you delete your account, we also erase analysis results tied to your account. Only statistics that can't identify you (such as counts by conversation type) may remain
OpenAI abuse-monitoring logs	Kept by OpenAI for up to 30 days
Google (Gemini) abuse-monitoring logs	Kept by Google for a limited period under its paid API terms
Payment records (if you use paid features)	5 years, as required by Korean e-commerce law
Consent records	[3 years] after account deletion, to prove consent

We erase information from our servers so that it can't be recovered. Copies in our hosting provider's (Cloudflare) disaster-recovery records disappear within 30 days.

We use the providers below to run Ray. Except for Microsoft (Azure Translator, Seoul region), they're all outside Korea, so your information is transferred internationally. Transfers happen whenever you use the service, over encrypted connections.

Recipient (privacy contact)	Country	Information	Purpose	Retention
OpenAI OpCo, LLC (privacy@openai.com)	United States	Conversations, memories, calendar events, photos, transcribed text, search queries, request IP	Writing replies, reading photos, memory search, web search	Up to 30 days (abuse monitoring). Not used for training
Google LLC: Gemini API (support.google.com/policies/contact/general_privacy_form)	United States and others (may be stored briefly in countries where Google has facilities)	Only when Ray double-checks a previous reply: that reply, your message it answered, and the tool results Ray used to write that reply (such as calendar events or memory search)	Checking replies	Not used to improve Google's products, including training. Logged for a limited period for abuse monitoring (Google's paid API terms)
Cloudflare, Inc. (privacyquestions@cloudflare.com)	United States and others (conversations and memories are set to the eastern US)	All information stored in Ray (account, conversations, memories, photos, and so on)	Hosting and storage	Until account deletion
Amplitude, Inc. (privacy@amplitude.com)	United States	App usage records, device information, IP, safety assessment results (the assessment for turns where a risk signal was detected), [parts of conversations as attributes during the beta]	Usage analytics, checking the quality of crisis support	Deletion requested at account deletion
Google LLC: Firebase (Google form above), Apple Inc. (apple.com/legal/privacy/contact)	United States	Push token, notification text	Sending notifications	Under each company's policy
OpenMeteo GmbH (info@open-meteo.com), Norwegian Meteorological Institute (post@met.no), OpenStreetMap Foundation (privacy@osmfoundation.org)	Switzerland, Norway, United Kingdom	Location coordinates, place names	Weather and place information	Under each provider's policy
Anthropic, PBC (privacy@anthropic.com)	United States	Conversations with account details removed	Improvement analysis	Not used for training (model training setting turned off). Kept up to 30 days
Microsoft Corporation: Azure Translator (microsoft.com/privacy contact form)	Korea (Seoul region)	Conversations with account details removed	Translation for improvement analysis	Not kept after translation

How to refuse, and what happens: If you don't want your information transferred, choose "Not now" on the first consent screen. If you've already agreed, email jayho@corca.ai to withdraw your consent, or delete your account. If you also don't want your information stored (Cloudflare), delete your account. Ray writes replies and stores information through these providers, so if you refuse, you won't be able to chat with Ray.

We don't share your information with third parties. We may disclose it to a court or law enforcement agency when the law requires it, only to the extent required.

• Delete your account and all data: In the app, go to Settings → Account → Delete account. If you can't use the app, email jayho@corca.ai from the address you signed up with and ask us to delete your account. Within 7 days after verifying it's you, we'll register the deletion, and as with deleting in the app, your data is erased 30 days later.
• Delete a single record: You can delete saved records one at a time in the app's Records tab.
• Withdraw consent: Deleting your account also withdraws your consent to sending data to AI providers. To keep your account and withdraw only your consent, email jayho@corca.ai. After you withdraw, Ray won't send your messages to AI providers, so it can't reply, and it also stops reaching out first and summing up your day overnight. Your conversations and memories stay, and Ray will ask for your consent again the next time you send a message.
• Access, copy, correction, restriction, or objection: Email jayho@corca.ai. We'll respond within 10 days. You can also ask us to exclude your conversations from improvement analysis while you keep using Ray. You can also make a request through a legal representative or someone you've authorized (with a power of attorney).

The app doesn't use cookies. App usage records (screens, buttons, responses to notifications) are sent to Amplitude. Right now there's no setting to turn off just this collection. If you don't want it, deleting your account stops the collection, and we ask Amplitude to delete the records. We don't collect advertising identifiers (IDFA on iOS, the advertising ID on Android), and we don't track you across other companies' apps or websites.

• Ray is an AI, not a person. Ray's replies can be wrong.
• Ray is not a substitute for a counselor or medical professional. In an emergency, contact your local emergency services or a crisis line. When Ray sees signs of risk, it points you to crisis support. Our crisis support page describes how.
• Ray (an AI) doesn't make decisions on its own that have legal or similarly significant effects on you.

• Data you send and receive travels over encrypted connections (TLS).
• Storage is separated per user.
• Only designated accounts can use administrator functions.
• Conversations used for improvement analysis are kept apart from account details such as your name and email.

Ray is only for people 18 and older. If we learn that we've received information from someone under 18, we delete that account.

• Chief Privacy Officer under Korean law: Young Hyun Chung, CEO, jayho@corca.ai
• Privacy and data protection contact (Data Protection Officer): Jaeho Chung, Product Owner, jayho@corca.ai. Jaeho Chung also serves as the data protection officer required in Singapore, the Philippines, New Zealand, Brazil, Malaysia, and elsewhere
• Users in Korea can also contact the Personal Information Infringement Report Center (privacy.kisa.or.kr, 118), the Personal Information Dispute Mediation Committee (www.kopico.go.kr, 1833-6972), the Supreme Prosecutors' Office (www.spo.go.kr, 1301), or the Korean National Police Agency (ecrm.police.go.kr, 182).

We'll tell you in the app and on this page 7 days before a change takes effect. For important changes, such as collecting more information or using it for new purposes, we'll tell you 30 days in advance and ask for your consent again if needed. You can get earlier versions of this policy by emailing jayho@corca.ai.

You can request access, copies, correction, restriction, or deletion under the Personal Data Protection Act at jayho@corca.ai.

Under Article 28 of the Act on the Protection of Personal Information (APPI), here is information about provision to third parties in foreign countries.

Recipient	Country	That country's data protection system	Measures we take
Corca, Inc. (operator), Microsoft (Azure Translator, Seoul region)	Korea	Personal Information Protection Act. Japan's Personal Information Protection Commission publishes comparative information on Korea	Internal rules and access controls; provider terms
OpenAI, Google, Cloudflare, Amplitude, Apple, Anthropic	United States	No comprehensive federal privacy law; state laws such as the California Consumer Privacy Act apply	Data processing terms; no use beyond the stated purposes
OpenMeteo GmbH	Switzerland	Federal Act on Data Protection (nFADP)	Provider terms
MET Norway	Norway	GDPR (EEA)	Provider terms
OpenStreetMap Foundation	United Kingdom	UK GDPR	Provider terms

You can exercise your rights under the Law on Personal Data Protection (Law No. 91/2025/QH15), including access, correction, deletion, restriction, and withdrawal of consent, at jayho@corca.ai.

You can exercise your rights under the Personal Data Protection Law (UU No. 27 Tahun 2022), including requests for information, correction, deletion, suspension of processing, and withdrawal of consent, at jayho@corca.ai.

You can exercise your rights under the Data Privacy Act (RA 10173) through our Data Protection Officer, Jaeho Chung (jayho@corca.ai). You may also file a complaint with the National Privacy Commission (NPC).

You can exercise your rights under the Personal Data Protection Act (B.E. 2562) at jayho@corca.ai.

You can exercise your rights under the Personal Data Protection Act 2010, including access, correction, and withdrawal of consent, through our Data Protection Officer, Jaeho Chung (jayho@corca.ai).

Our Data Protection Officer under the Personal Data Protection Act 2012 is Jaeho Chung (jayho@corca.ai).

Our privacy officer under the Privacy Act 2020 is Jaeho Chung (jayho@corca.ai). You may also complain to the Office of the Privacy Commissioner.

You can exercise your rights under the General Data Protection Law (LGPD) through our data protection officer (encarregado), Jaeho Chung (jayho@corca.ai). International transfers rely on contractual safeguards under Article 33 of the LGPD. If you bring up sensitive personal data such as health information in your conversations after reading this notice, we treat that as your consent to process it for these purposes (LGPD Art. 11). You can withdraw it at any time by emailing jayho@corca.ai or by deleting your account.

You can exercise your ARCO rights (access, rectification, cancellation, and opposition) and withdraw consent under the Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP) at jayho@corca.ai. A Spanish version of this policy is available here.

You can exercise your rights under the UK GDPR (access, correction, erasure, restriction, objection, and portability) at jayho@corca.ai. You can also complain to the Information Commissioner's Office (ICO). Our legal basis depends on the purpose: performance of our contract with you for providing the service and your account, your consent for sending data to AI providers, our legitimate interests for improvement analysis, and vital interests for crisis support. If you bring up special category data such as health information in your conversations after reading this notice, we treat that as your explicit consent to process it (UK GDPR Art. 9(2)(a)). You can withdraw this consent at any time by emailing jayho@corca.ai or by deleting your account.

• California: We don't sell your personal information or share it for cross-context behavioral advertising (personalized ads based on your activity across apps and websites). You can request access, deletion, or correction at jayho@corca.ai.
• Crisis support: Our suicide and self-harm protocol under California SB 243 and New York General Business Law Article 47 is on our crisis support page.