Privacy Policy

Article 1 (Personal Information Collected and Collection Methods)

1. Items Collected

The Company collects the minimum personal information necessary to provide the Service.

2. Collection Methods

• Information provided by Google upon Google OAuth 2.0 social login
• Information entered directly by the user (e.g., nickname setting)
• Automatic collection via Firebase Analytics and Firebase Firestore during Service use
• Information provided via email when submitting a support inquiry

Note: The Company does not collect personal information from children under 14. Google social login follows Google's age restriction policy; users under 14 may be restricted from using the Service.

Article 2 (Purposes of Collecting and Using Personal Information)

The Company uses collected personal information for the following purposes:

Article 3 (Retention and Use Period)

The Company destroys personal information without delay once the purpose of collection and use has been achieved. The following information is retained for the periods specified below.

1. Retention Under Internal Policy

2. Retention Required by Law

Article 4 (Provision of Personal Information to Third Parties)

The Company does not, in principle, provide users' personal information to external parties, except in the following cases:

• The user has given prior consent
• Required by law or requested by investigative authorities following legally prescribed procedures
• Necessary for service fee settlement
• Provided in anonymized form for statistical, academic, or market research purposes

Article 5 (Consignment of Personal Information Processing)

To improve the Service, the Company entrusts personal information processing to the following third parties:

The Company specifies in contracts with processors the prohibition of processing personal information beyond the entrusted scope, technical and administrative safeguards, sub-contracting restrictions, and oversight of processors, and supervises their compliance.

Article 6 (Cross-Border Transfer of Personal Information)

To provide the Service, the Company transfers personal information internationally as described below:

If you do not wish to have your personal information transferred internationally, you may stop using the Service and withdraw your membership. Note that doing so will make the Service unavailable.

Article 7 (User Rights and How to Exercise Them)

1. Users may exercise the following privacy rights with the Company at any time:
   • Request to access personal information
   • Request correction of errors
   • Request deletion
   • Request suspension of processing
2. Rights may be exercised through the in-Service account settings or by emailing the Privacy Officer below. The Company will notify you of the outcome within 10 business days.
3. When a user requests correction or deletion of personal information, the Company will not use or provide that information until the correction or deletion is complete.
4. Account deletion may be requested through the in-Service feature or by emailing the Privacy Officer. Upon completion, personal information is immediately destroyed (except data required by law to be retained for a set period).

Article 8 (Destruction Procedures and Methods)

1. The Company destroys personal information without delay once it is no longer needed.
2. If personal information must continue to be retained by law despite the retention period expiring or the purpose being achieved, it is moved to a separate database or storage location.
3. Destruction procedures and methods are as follows:

• Procedure: The Company selects personal information for destruction and destroys it with approval from the Privacy Officer.
• Electronic files: Destroyed securely using technical methods (permanent deletion, Firebase Firestore document deletion, etc.) so that records cannot be reproduced.
• Paper documents: Where applicable, shredded or incinerated.

Article 9 (Security Measures)

The Company takes the following measures to ensure the security of personal information:

• Technical: Data is encrypted at rest via Google Firebase's security infrastructure; HTTPS encrypts data in transit. Firebase Security Rules block unauthorized data access.
• Administrative: Access to personal information is minimized and restricted. Staff handling personal data receive regular training.
• Physical: Systems storing personal information are managed in Google Cloud Platform (GCP) secure data centers.
• Incident Response: In the event of a data breach, the Company will promptly notify affected users and follow applicable legal reporting procedures.

Article 10 (Use of Cookies)

1. The Company uses cookies to provide a personalized Service experience. Cookies are small pieces of information sent from the server to the user's browser and stored on the user's device.
2. The Company uses cookies for the following purposes:
   • Maintaining login state and session management
   • Analyzing user behavior (Firebase Analytics)
   • Service performance improvement and optimization
3. Users may choose whether to allow cookies via their browser settings. Note that disabling cookies may restrict some Service features such as staying logged in.
4. To opt out of Firebase Analytics collection, you may use the Google Analytics opt-out browser add-on (https://tools.google.com/dlpage/gaoptout).

Article 11 (Privacy Officer and Complaints)

The Company designates a Privacy Officer to oversee all personal information processing and to handle user complaints and remedy damages related to personal information.

Article 12 (Changes to This Privacy Policy)

1. This Privacy Policy is effective from its effective date. Any additions, deletions, or corrections will be announced through Service notices at least 7 days before taking effect.
2. For changes that are material or unfavorable to users, at least 30 days advance notice will be given, and users may be notified directly by email if necessary.