Privacy Policy

Purpose of Processing

Personal data is processed for account authentication, storing and displaying emotion records, and service operation.

Retention and Use Period

Data is retained until account withdrawal and destroyed without delay upon withdrawal (except where law requires retention).

Provision to Third Parties

We do not provide usersʼ personal data to third parties (not applicable).

Destruction Procedure and Method

Upon expiry of the retention period or fulfillment of purpose, data is destroyed without delay by irrecoverable means.

Processing of Sensitive Information

The operator protects usersʼ emotion records as sensitive information and processes them under a separate consent, distinct from other consents, obtained at sign-up.

Emotion records are visible only to the owner through row-level access control (RLS) and are not disclosed externally. Children under 14 may not sign up.

Consignment of Processing

To provide the service smoothly, the operator consigns the processing of personal data as set out below and stipulates safeguards in the consignment agreements.

· Supabase, Inc. — database storage and authentication (Auth) processing

· Vercel, Inc. — application hosting and server processing

Pseudonymized Information

We do not separately process pseudonymized information (not applicable).

Rights of Data Subjects and Legal Representatives

Users may request access, correction, deletion, and suspension of processing via the settings screen or by email. The right to data portability is guaranteed to the extent provided by applicable law.

Privacy Officer

Privacy Officer: Heungje Jeon (byeoril operator, Jumeoni Sanghoe) · Email: gmdwp852@gmail.com

Automatic Collection Devices (Cookies)

We use essential cookies to maintain login sessions and do not use advertising or tracking cookies.

Personal Information Items Processed

We process email (account identifier), emotion records and notes, access logs, and consent records. We do not collect location (GPS) or device identifiers.

Overseas Transfer of Personal Information

The operator consigns the data storage and hosting necessary for service provision (performance of the contract) to overseas providers, and provides notice by disclosing the following under Article 28-8(1)3(a) of the Personal Information Protection Act.

· Recipient / contact: Supabase, Inc. (USA) privacy@supabase.com · Vercel, Inc. (USA) privacy@vercel.com

· Transfer country / processing location: Database storage and application server processing are set to the Republic of Korea (Seoul region). However, edge processing (request routing and public preview image generation) runs on a globally distributed network and may be processed in an overseas region close to the user.

· Time / method of transfer: transmission over the network during service use (ongoing)

· Items transferred: email (account identifier), emotion records and notes, access logs, consent records

· Purpose: data storage, hosting, and application processing (within the scope of consignment)

· Retention / use period: until the purpose of consignment is achieved or account withdrawal

· How to refuse and its effect: users may refuse by withdrawing their account, in which case service use will be restricted.

Security Measures

We apply security measures including transport encryption, row-level access control (RLS), and least-privilege access.

Direct Collection from Overseas

We do not collect personal data directly from overseas (not applicable).

Remedies for Infringement

Remedies are available through the Personal Information Infringement Report Center (118), the Dispute Mediation Committee, and law enforcement.

Changes to This Policy

Changes to this policy are announced with their effective date. Current version: 2026-06-18.