In this service, "personal information" refers to information that can identify a specific individual, such as name, email address, device identification information (UUID), and payment information. This also includes information that can identify an individual when easily combined with other information, as well as message content created by users within the service, uploaded images, and activity logs, all of which are managed strictly.
The company collects the following information to provide smooth service.
1. Items Collected
• Required information: UUID (device unique identifier), email address, device OS information, payment records
• Service usage information: Service usage logs (visit history, misuse records, etc.), chat text messages, uploaded image files
2. Collection Methods
Automatic collection upon service installation and execution, system-linked collection during paid billing, collection when uploading content (posts, chats, albums, etc.), provided by users during customer inquiries.
※ Currently, this service does not collect precise location information (latitude/longitude) from users.
Collected information is used for the following purposes.
• Service provision and identity verification (UUID authentication).
• Payment processing for paid services and fraud prevention.
• Record keeping for customer support and dispute resolution.
• Personalized content recommendations and advertising (Google AdMob) optimization.
• Statistical analysis for new feature development and service improvement.
The company has established the highest level of cloud security environment to safely manage images and data uploaded by users.
• Storage and access control: All images are stored in AWS cloud storage (Amazon S3) and delivered via CloudFront CDN.
• Signed URLs: Uploaded images are only provided through signed temporary URLs, making it impossible to view or access them without an authorized signature, even if the direct URL is known.
• Removal of personal identifying information (pseudonymization): Image file names contain no personal information of users (ID, name, timestamp, etc.) and are converted to random identifiers (UUID) for storage.
In principle, the company destroys personal information without delay when the purpose of collection and use is achieved or when a user withdraws. In particular, chat and image data are destroyed according to the following detailed policies to prevent server load and protect user privacy.
1. Chat message (text) retention and disposal
• Server retention: Chat messages are retained and viewable on the server for 3 days after sending. Data older than 3 days is permanently and physically deleted (DROP) from the database through a daily system batch script and cannot be recovered.
• Device (local) retention: Received messages are stored in the user's local database (SQLite) on their device and are deleted when the app is deleted or data is reset. Messages older than 3 days are not re-synced from the server, so users must save important information separately.
• Message deletion authority: Messages can only be deleted by the 'sender' themselves; others, including administrators, cannot delete them. Deleted messages are processed with a soft delete method where they are replaced with "This message has been deleted."
2. Image retention and disposal by feature
• Chat images: Images uploaded to chat rooms are automatically permanently deleted from S3 storage by the system 7 days after server transmission.
• Post and album images: Images uploaded to group/community posts and albums are retained while the relevant post exists. Upon deletion of a post or when the author/administrator deletes an image, the linked original and thumbnail files are immediately permanently deleted from S3.
• Profile/cover images: Profile photos, group covers, event covers, etc., are retained while the service or relevant group is maintained. Upon replacement of an image or deletion of the group (including account withdrawal), existing images are immediately destroyed from S3.
3. Exceptional retention upon account withdrawal
In principle, all content is immediately deleted when a user requests account withdrawal. However, to prevent malicious misuse, restrict re-registration, and respond to disputes between users, only the user's identifying information (minimum registration history such as UUID) is safely retained for 3 months from the withdrawal date before being destroyed in an irrecoverable manner.
In principle, the company does not provide personal information to third parties without the user's consent. However, the following cases are exceptions.
• When there is a lawful request from investigative agencies in accordance with legal provisions or procedures defined by law for investigative purposes.
• When providing minimum necessary data to essential partners (Google Firebase, AdMob, App Store/Google Play billing systems) for service operation and payment processing.
When minors use the service, the company may verify parental consent for child safety and manages minors' personal information with stricter security standards than adult users. If inappropriate group creation or operation is detected, the company has the authority to immediately block and delete the relevant data.