Privacy Policy

1. Personal Information Collected and Collection Methods

• Collected upon Google login: email address, name, profile photo
• Recorded at registration: the time of the declaration of being 14 years or older, and the time of agreement to the Terms of Service and this Privacy Policy
• Collected when the inquiry form is used: email address, inquiry type, subject and body, attachments, browser and device information, and, where the user is logged in, the member identifier (inquiries may also be submitted without logging in)
• Generated or collected during use of the Service: username (nickname), avatar image, chart and project data, user-written text such as memos and comments, like, bookmark, tag and report records, and notification records
• Collected automatically: access logs (IP address, date and time of access, browser and device information, requested page paths), cookies
• Collected automatically via Google Analytics: pages visited, session information, device and browser information, approximate location (country and city level), Google Analytics cookie identifiers
• The Service uses only Google account authentication and therefore does not collect passwords.
• The Service does not collect personal information from children under the age of 14. Users under 14 are not permitted to register.

2. Purposes of Processing

• Member identification and authentication, including login
• Provision and operation of the Service, and improvement of features
• Prevention of unauthorized use and action against violations of the Terms of Service
• Delivery of important service-related notices and announcements
• Compliance with legal obligations
• The Operator may access user-stored content (including private patterns) to the minimum extent necessary to handle reports, respond to inquiries and errors, and operate the Service.

3. Retention Period

Upon account withdrawal, personal information is destroyed after a 30-day recovery grace period. If a member requests restoration during the grace period, the data will be restored.

Access logs generated in the course of operating and securing the Service (IP address, date and time of access, browser information, and the like) are retained for a period determined by each processor listed in Section 5 under its own log retention policy and then deleted. The Operator does not copy them into a separate database of its own.

Inquiries submitted through the contact form, including attachments, are not stored in the Service. They are delivered only to the Operator's mailbox and are deleted three years after the date of the inquiry.

Where applicable laws require retention for a certain period, the information is retained for that period and then destroyed.

Personal information retained pursuant to applicable law is stored separately from other personal information and is not used for purposes other than those prescribed by law.

4. Provision to Third Parties

As a rule, the Operator does not provide users' personal information to third parties. Exceptions apply where specifically required by law or where a law enforcement authority requests information through procedures prescribed by law.

5. Outsourcing and Cross-Border Transfer

The Operator outsources the processing of personal information as set out below for the purpose of providing the Service. As the processors' servers are located outside Korea, personal information is transferred abroad. Cross-border transfers are based on Article 28-8(1)3 of the Personal Information Protection Act of Korea (outsourcing or storage necessary for the performance of a contract), and the details are disclosed below.

The error monitoring tool (Sentry) listed in the table below is configured not to include a user's email address or IP address in the data it transmits, and query strings are stripped from the page URLs contained in error reports. Page URLs may, however, appear in full in the sampled records transmitted for performance measurement.

Users who do not want their personal information transferred abroad may refuse such transfer by discontinuing use of the relevant feature or the Service. Supabase, Vercel, and Sentry are used to provide Service screens and data and to maintain stable operation, so users must not access the Service if they wish to refuse those transfers. If Google login is not used, OAuth authentication information is not transmitted to Google, but member features will not be available. Google Analytics may be rejected using the method described in Section 8 without affecting use of the Service. No information is transferred to Resend if the inquiry form is not used.

6. Destruction Procedure and Method

Personal information for which the retention period has expired or the processing purpose has been achieved is destroyed. Information in electronic file form is deleted by means that prevent recovery.

7. Rights of Data Subjects

• Users may at any time request access to, correction of, deletion of, or suspension of processing of their personal information.
• Users may withdraw consent to the processing of personal information. A legal representative or an authorized agent may also exercise these rights by submitting documents sufficient to verify the relationship or authorization.
• Profile information may be directly edited on the settings page, and account withdrawal may also be performed directly on the settings page.
• For all other requests, please contact [email protected] and action will be taken within the period prescribed by applicable law.
• A request may be restricted where retention is required by applicable law or where another law limits access, deletion, or suspension of processing; in such a case, the reason will be provided.

8. Cookies and Local Storage

• The Service uses cookies to maintain login sessions. Cookies may be refused through browser settings; however, in that case, features requiring login will not be available.
• Certain information such as language preferences and editor settings is stored only on the user's device in the browser's local storage (localStorage) and is not transmitted to the server.
• The Service uses Google Analytics 4 for usage analytics, and Google Analytics cookies are stored in the user's browser as part of this process. Users may opt out of Google Analytics collection using the Google Analytics opt-out browser add-on.
• Opting out of Google Analytics collection does not affect access to core Service features such as login or chart creation.

9. Security Measures

• Encryption of transmission channels (HTTPS)
• Database access control (row-level security policies)
• Collection of only the minimum personal information necessary for the provision of the Service

10. Privacy Officer

Name: Joowon Byun / Contact: [email protected]

Users may submit inquiries, complaints, or requests for remedies regarding personal information to the contact above. For reports of or consultation on infringement of personal information rights, users may contact the following organizations.

• Personal Information Dispute Mediation Committee — www.kopico.go.kr / 1833-6972
• Personal Information Infringement Report Center — privacy.kisa.or.kr / 118 (in Korea)
• Cybercrime Investigation Division, Supreme Prosecutors' Office — www.spo.go.kr / 1301 (in Korea)
• Cyber Investigation Bureau, Korean National Police Agency — ecrm.police.go.kr / 182 (in Korea)

11. Changes to This Policy

If the contents of this Policy are added to, deleted from, or modified, notice will be given on the Service screens at least 7 days before the effective date of the change.

This Policy applies from July 21, 2026.