Privacy Policy

The Company processes only the minimum personal information needed to provide the Service. Member information is received from the provider of the external account the user signs in with; other information is entered by the user or generated automatically in the course of using the Service.

The Company processes personal information only for the following purposes. If a purpose changes, the Company takes the necessary measures, such as obtaining separate consent under Article 18 of the Personal Information Protection Act.

The Company destroys personal information without delay once the purpose of its collection and use has been achieved. Member information and works are retained until account deletion (when the 7-day grace period in Article 7 has passed).

However, the following information is kept for the periods below under the relevant laws and then destroyed.

The Company does not provide users' personal information to third parties beyond the scope of the purposes in Article 2, except in the following cases.

The Company outsources the processing of personal information as follows in order to provide the Service. Under Article 26 of the Personal Information Protection Act, the outsourcing contracts set out, among other things, the prohibition on processing for purposes other than those outsourced, measures to ensure security, restrictions on re-outsourcing, and management and supervision. If the Company changes or adds a processor, it discloses this in this Policy under Article 14.

For the operation of the Service, the Company transfers personal information overseas (storage, processing and provision) as follows under Article 28-8 of the Personal Information Protection Act. Transfers take place over the network when the Service is used. Users may refuse the overseas transfer, but because the Service is stored and operated overseas, a user who refuses cannot use the Service (the collection of usage statistics can be refused separately in the way described in Article 10). Users may notify their refusal by email to the Chief Privacy Officer.

The Company destroys personal information without delay once its retention period has passed or the purpose of processing has been achieved. Electronic files are deleted in a way that cannot be recovered, and paper documents are shredded or incinerated.

When a user requests account deletion, a 7-day grace period begins, during which the user can withdraw the request on the Settings screen. When the grace period has passed, the Company deletes the member information, works and usage records, and deletes the sign-in account. Only the items retained under the law in Article 3 and the pseudonymized email address remain.

When a user deletes a note, event, chapter or relationship in the Service, it is kept in a marked-as-deleted state for 30 days so that the deletion can be undone, and is then deleted completely. Content marked as deleted is excluded from subsequent screens and from what a connected AI reads.

When a user permanently deletes a work, the Company deletes the entire work without delay. Works moved to the trash are permanently deleted after 30 days.

The Company backs up its database regularly for recovery from failures, and keeps backups for up to 30 days before deleting them automatically. Information deleted through account deletion or by the user may remain in backups made before the deletion; these copies are deleted when their retention period ends. If data is restored from a backup in the meantime, information that had already been deleted is deleted again immediately after the restoration.

Users may at any time request from the Company access to, correction or deletion of, or suspension of processing of their personal information, or withdraw their consent (delete their account).

Users can check their member information and delete their account themselves on the account settings screen of the Service, and can request the exercise of other rights by email to the Chief Privacy Officer. The Company takes action within 10 days of the day it receives a request and notifies the user of the outcome.

Rights may also be exercised through the user's legal representative or a person the user has authorized. In that case, a power of attorney in the form annexed to the Notice on Personal Information Processing Methods (개인정보 처리 방법에 관한 고시) must be submitted.

Requests for access or for suspension of processing may be restricted under Article 35(4) and Article 37(2) of the Personal Information Protection Act, and deletion cannot be requested for information that other laws designate as subject to collection.

The Service is intended for people aged 14 or older, and the Company does not collect the personal information of children under 14. If the Company learns that a child under 14 has signed up, it deletes the account and information without delay.

The Company uses a session cookie to keep users signed in. This cookie lasts for 5 days after sign-in and is deleted when the user signs out. If this cookie is refused, the user cannot stay signed in.

The Company uses Google Analytics to collect information on usage behavior. The items collected are pages visited, feature-use events (creating a note, creating a work and so on), browser and device information, and internal service identifiers; email addresses, names and the content of works are not among the items collected. The Company does not use the behavioral information it collects for personalized advertising.

Users can refuse statistics collection by refusing cookie storage in their browser settings, or by installing the Google Analytics opt-out browser add-on provided by Google.

The Company takes the following measures under Article 29 of the Personal Information Protection Act and the Standards for Measures to Ensure the Security of Personal Information (개인정보의 안전성 확보조치 기준).

To oversee work related to the processing of personal information and to handle user complaints and provide remedies for damage, the Company designates the Chief Privacy Officer below. Users may direct all inquiries, complaints and requests for remedies related to personal information to the Chief Privacy Officer, and the Company will respond without delay.

Users who need to report or seek advice about an infringement of personal information may contact the following institutions. Users who object to the Company's handling, or to the Company's disposition on the exercise of rights under Articles 35, 36 and 37 of the Personal Information Protection Act, may file an administrative appeal under the Administrative Appeals Act (행정심판법).

This Policy applies from October 15, 2026. If content is added, deleted or modified because of changes in the law or the Service, the Company announces it in the Service from 7 days before the effective date; changes that significantly affect users' rights, such as changes to the items collected or the purposes, are announced from 30 days before the effective date and notified to users individually by email or other means.

The same procedure is followed when the table in Article 1 is updated, for example when an external account provider is added.

If the Company replaces or adds a processor (Article 5) or a recipient of personal information overseas (Article 6) with another business that performs the same work, it reflects the change in this Policy and discloses it before the change, as long as the items and purposes of the personal information processed do not increase. Where there is a reason the Company could not foresee, or a reason that requires an immediate change in order to keep providing the Service — such as the end of that business's service, termination of the contract, an outage, or a requirement of law or of a supervisory authority — the Company reflects the change without delay after making it and announces it in the Service.

Changes that increase the items or purposes of the personal information processed, or that require users' consent under the law, follow the procedure in paragraph 1, and the necessary consent is obtained. Previous versions of this Policy are provided on request by email to the Chief Privacy Officer.