개인정보처리방침 Privacy Policy

Woohoo Studio (the "Company") establishes and discloses the following Privacy Policy to protect users' personal information in accordance with the Korean Personal Information Protection Act and to promptly address related grievances.

1. Purposes of Collection and Use of Personal Information

The Company processes personal information for the following purposes:

• Member Management: Identity verification, member identification, confirmation of intent to subscribe, and prevention of fraudulent use by unauthorized members.
• Service Provision: Core features including Gathering creation/management (invite codes, host transfer, member roles), votes, checklists, real-time chat, ledger (expenses, dues, transfers, reimbursements), schedule coordination, AI travel itinerary generation, receipt OCR, media upload/sharing, and place reviews.
• Notifications: In-app and push notifications for Gathering activities. Users can disable notifications per Gathering or per category.
• Payments and Refunds: Processing one-time in-app purchases (AI credit packs, photo storage packs), validating receipts, managing per-Gathering balances and usage history, and handling disputes per store refund policies.
• Service Improvement: Service usage analytics, new feature development, and operating recommendation infrastructure using place reviews and Gathering satisfaction (only when the user has enabled sharing at the Gathering level).
• Safety: Detecting and preventing fraudulent use, maintaining account security, and diagnosing errors via debug logs (only when the user has explicitly consented).

2. Personal Information Collected

Required Items

• Email address, nickname.
• For social login (Google · Apple · Kakao): user identifier and email provided by the provider.

Optional Items (only if entered by the user)

• Profile photo, phone number.
• Bank name and account number for settlement (stored in personal profile or per-Gathering member profile).
• Per-Gathering custom member profile: nickname, avatar, contact, and account number used only within that Gathering.
• App preferences such as travel style tags, language, theme, and font scale. (Region is automatically determined by the App Store country and is not stored separately.)

Permission-Based Items (only when OS permission is granted)

• Location: for Gathering/vote place search, showing your current position on the map, and adjusting the domestic/overseas map provider based on your current location during place search.
• Device calendar events (read-only): the app accesses OS calendars (including Google · Outlook · Apple and any other calendars linked to iOS/Android) to recommend the user's busy times during schedule coordination. Events read this way are kept only in device memory; they are never transmitted to or stored on the Company's servers and are not visible to other members.
• Photo library: access only to photos selected by the user at the moment of upload.
• Notifications: issuing a device token for push notifications.

Automatically Collected Items

• Device name, push notification token, service usage records, app version and build number (device model and OS version are also collected for error diagnosis only when the user consents to debug log collection).
• Login and token refresh history (generated during the authentication process and retained by the authentication provider, Supabase Auth).
• Debug logs (app errors and event logs): collected only when the user explicitly consents on the sign-up (onboarding) consent screen or in Settings → Privacy → "Debug Logs". Withdrawal of consent immediately deletes the user's debug logs from the server. Even when collected, logs are auto-deleted after 30 days.

Payment Information

• All payments are processed exclusively through Apple App Store or Google Play in-app purchase (IAP). The Company does not directly collect or store payment instrument information such as card numbers or account details.
• Information stored by the Company: in-app purchase transaction identifier (transaction_id), purchased product ID, time of purchase, payment amount, payer (Gathering member identifier).
• Transaction identifier validation and purchase history synchronization is performed via RevenueCat.
• Refunds are processed through the App Store / Google Play, and refund records are retained by each store. However, to reclaim credits and storage charged to the Gathering and to prevent abuse such as repeated refunds, the Company records the refund status (time of refund) and reclamation details for that transaction.

Information Created or Stored During Service Use

• Gathering information: name, description, category, confirmed date, duration, domestic/overseas designation, currency, default image quality, member relationship info, recurring sessions.
• Invitations and membership: invite codes, join/leave times, member roles (host, co_host, treasurer, photographer, member), leave reason (self, kicked, account_deleted).
• Votes and responses (date, location, attendance, general), checklist items and completion status.
• Chat messages (text, image, mentions, replies, emoji reactions, read receipts).
• Ledger entries: expenses, dues, transfers, reimbursements, dues payments, per-member shares and settlement completion, Gathering wallet account (bank name, account number, initial balance), receipt images and OCR results (store name, amount, items, tags).
• Schedule coordination: candidate date ranges, your own blockers, attendance intent (available / unavailable / undecided), reason memos.
• Personal availability: events you directly entered in the app's in-app calendar. External events read from device OS calendars (Google · Outlook · Apple, etc.) are not stored on the Company's servers and are visible only on your own device.
• Itinerary: slots (day, time, place, description), A/B plan groups, slot role assignments, slot comments, likes, attached photos, AI itinerary generation sessions and user prompts. Place data stored in a slot is limited to the place name entered by the user, Momo's own category, the pin coordinates the user confirmed on the map, and a place identifier (place_id/URL).
• Place reviews: ratings, text, photos, and Gathering satisfaction responses.
• Uploaded media files (originals and thumbnails) and metadata: category (gallery, chat, slot, checklist, receipt), file size, width/height, video length, captions. EXIF metadata is removed depending on user settings (default: removed).
• Notification data: in-app notification logs, per-Gathering mute settings, per-category on/off settings.
• Free credit grant history: grant, use, and expiration information.

3. Retention and Use Period

The Company destroys personal information without delay once the purposes of collection and use have been achieved. Upon membership withdrawal, your account, profile, and authentication tokens are immediately destroyed, while records that affect other members' Gathering activity (such as chat messages, photos, and ledger entries) are anonymized (e.g., as "Withdrawn User") and retained. For a Gathering you hosted, host rights are automatically transferred to another member if one exists and the Gathering is retained; a Gathering with no other members is deleted together with your withdrawal.

When a host deletes a Gathering, it can be restored from the trash for 30 days, after which the Gathering data is completely deleted. A Gathering that the host permanently deletes from the trash, or that has no remaining members due to membership withdrawal, is deleted immediately. Media files such as photos (originals in Cloudflare R2, thumbnails in private Supabase storage) are permanently deleted at the same time.

However, the following information is retained for the periods specified by applicable laws:

Retained Items	Basis	Retention Period
Records of contracts or withdrawal of subscription	Act on Consumer Protection in Electronic Commerce, Etc.	5 years
Records of payment and supply of goods	Act on Consumer Protection in Electronic Commerce, Etc.	5 years
Records of consumer complaints or dispute handling	Act on Consumer Protection in Electronic Commerce, Etc.	3 years
Login records	Protection of Communications Secrets Act	3 months
Debug logs (consenting users only)	Error diagnosis and service quality improvement	30 days (auto-delete) or immediately upon withdrawal of consent

4. Entrustment of Processing and Overseas Transfers

The Company does not, in principle, provide users' personal information to external parties. However, for smooth service operation, the Company entrusts processing as follows. Some entrusted parties are located overseas.

Entrustee	Purpose	Items
Supabase Inc. (USA)	Database (Postgres), authentication, real-time sync, file storage (private buckets for media thumbnails, etc., accessed via signed URLs), Edge Functions.	All data necessary to operate the Service (profiles, Gatherings, messages, ledger, media, etc.).
Cloudflare, Inc. (USA)	Object storage (Cloudflare R2) of media file originals and display versions (photos, receipt images, etc.) and access via temporary signed URLs.	Media files uploaded by the user (photos, receipt images, etc.).
Google LLC (USA)	Google OAuth, Google Maps (overseas regions), Firebase Hosting (deep links and this policy page).	User identifier and email provided by the provider, location search queries.
Apple Inc. (USA)	Apple Sign In, App Store in-app purchase processing.	User identifier and email provided by the provider, receipt identifier (transaction_id).
Kakao Corp. (Republic of Korea)	Kakao social login, Kakao Map (domestic regions).	User identifier and email provided by the provider, location search queries.
Anthropic, PBC · OpenAI, L.L.C. · Google LLC (USA)	Receipt OCR, AI itinerary generation, chat summaries, and other AI features — the Company selects and uses providers such as Claude and Gemini depending on service quality and cost, and may expand to other providers such as GPT in the future.	Gathering context, receipt images, user prompts.
RevenueCat, Inc. (USA)	Validation of App Store / Google Play receipts and purchase history synchronization.	Receipt identifier (transaction_id), purchased product ID, user identifier.
Expo, Inc. (USA)	Sending push notifications via Expo Push Service.	Expo push token, notification title and body (both the title and body are replaced with a generic message when the user disables lock-screen previews).
Functional Software, Inc. (Sentry, USA)	App error diagnostics (crash and exception collection) — active only when the user has consented to "Debug Logs" collection.	Error stack traces, device/OS metadata, app version, and an anonymous user ID (UUID). Email, name, IP address, and screen captures are not transmitted.

For incidental external services such as exchange rate lookup (Frankfurter, EU) and weather forecasts (KMA for domestic Korea, WeatherAPI for overseas), only data not containing personally identifiable information (currency codes, coordinates, etc.) is transmitted.

The Company's entrustment contracts or service terms with the above parties require compliance with applicable privacy laws, confidentiality, prohibition of third-party provision, and liability for incidents.

For the map services, each provider's privacy policy is available here: Google — policies.google.com/privacy, Kakao — kakao.com/policy/privacy.

5. Advertising, Marketing, and Recommendation System

Advertising and Marketing

The Company does not use users' personal information to send advertising materials or for external marketing. Push notifications are sent only for Gathering activities (votes, chat, ledger, etc.).

Use for Recommendation System (Per-Gathering Opt-In)

To provide better recommendations for schedules, places, and shops, the Company uses data from Gatherings whose hosts have explicitly enabled the sharing option, in an anonymized and aggregated form.

• Scope: Gathering satisfaction responses, place reviews, and itinerary flow patterns — only when the Gathering host has enabled the sharing option in Gathering settings.
• Anonymization: Personally identifiable information such as Gathering name, member nicknames, and author identifiers is removed. Recommendation results do not display author information.
• Withdrawal: The Gathering host may turn off the sharing option at any time in Gathering settings. The Gathering's data is excluded from recommendation use immediately upon the change.
• Legal basis: User consent under Article 17 of the Personal Information Protection Act (Gathering host's sharing option setting).

6. Users' Rights and How to Exercise Them

Users may exercise the following rights at any time:

• Request access to personal information.
• Request correction in case of errors.
• Request deletion.
• Request suspension of processing.
• Withdraw consent to debug log collection (Settings → Privacy → Debug Logs toggle in the app).
• Delete account (Settings → Account → Delete Account in the app).

Rights may be exercised through the in-app Settings menu or via the email below. The Company will act on requests without delay.

• Email: woohoo.studio.official@gmail.com

7. Destruction of Personal Information

When personal information is no longer needed because the retention period has elapsed or the processing purposes have been achieved, the Company destroys it without delay.

• Electronic files: Securely deleted to prevent recovery or reproduction (row deletion in Supabase Postgres, permanent deletion of Cloudflare R2 and Supabase Storage objects).
• Documents and printouts: Shredded or incinerated.

8. Measures to Ensure the Security of Personal Information

The Company takes the following measures to ensure the security of personal information:

• Access control: Database Row-Level Security (RLS) policies restrict access to data so that only the user or members of the relevant Gathering can access it.
• Encryption in transit: All communication between the app and the server is encrypted via HTTPS (TLS).
• Data at rest protection: Encryption at rest is applied by the cloud providers.
• Private media storage: Originals of uploaded photos and receipt images are kept in Cloudflare R2 and thumbnails in Supabase, both in private storage accessible only through temporary signed URLs with a limited validity period.
• Auth token protection: Authentication tokens are stored securely in the device secure storage (iOS Keychain / Android Keystore), and the PKCE flow is enforced to prevent authorization code interception.
• Local chat cache encryption: The recent chat cache kept on device for fast re-entry is protected with strong standard encryption, and the encryption key is stored separately in the device secure storage.
• Principle of least privilege: Operators access only the minimum data necessary for their work.

9. Personal Information of Children Under 14

The Company does not accept sign-ups from children under 14 years of age. If personal information of a child under 14 is found to have been collected, the Company immediately deletes such information and blocks the account.

10. Handling of Location Information

The Company complies with the Korean Act on the Protection, Use, Etc. of Location Information and processes users' location data minimally as follows.

Items and Method of Collection

• Items collected: GPS coordinates (latitude, longitude) temporarily measured on the device.
• Method: Only when the user explicitly grants OS location permission (while-in-use), collected via the device SDK (expo-location) at the moment the location feature is invoked.
• When collected: ① when using "Move to My Location" on a map screen (including the itinerary map), ② when using "Search Nearby" in Gathering/vote location search, ③ when entering a place search screen, to adjust the map provider based on whether your current location is domestic or overseas. Location data is not collected outside these cases. (A Gathering's domestic/overseas region default is determined by the App Store country, while the map provider on the place search screen may vary based on the GPS adjustment above.)

Purposes of Use

• Displaying the current location on the map and sorting nearby place search results.

Retention and Use Period (Important)

• The Company does not store users' location information on its own servers. Collected GPS coordinates are discarded from device memory immediately after being used for the purposes above and are not recorded in the Company database (Supabase).
• Coordinates of POIs you yourself select from the map/search may be saved as Gathering schedules or vote options, but these are coordinates of places you selected, not your own location.

Third-Party Provision (One-Time Processing Entrustment)

Location information is not separately stored or used by the Company; it is provided once to the following search API providers to receive search results. Provided coordinates are not received back or stored by the Company.

Recipient	Purpose	Items
Kakao Corp. (Republic of Korea)	Domestic map display and nearby place search.	One-time GPS coordinates (lat/long).
Google LLC (USA)	Overseas map display and nearby place search.	One-time GPS coordinates (lat/long).

Users' Rights

• Users can deny or withdraw location permission at any time in OS settings (Settings → Momo → Location).
• Even if location permission is denied, core features (Gathering creation, voting, ledger, chat, etc.) still work normally; only location-based features ("Search Nearby", "Move to My Location") are limited.

11. Personal Information Protection Officer

The Company designates the following Personal Information Protection Officer to oversee personal information processing and to handle user complaints and remedies.

Field	Detail
Business Name	Woohoo Studio
Representative · Data Protection Officer	Junhyuk Kim
Business Registration Number	278-05-03740
Phone	+82-10-8069-4304
Email	woohoo.studio.official@gmail.com

For reporting or consultation on personal information infringement, you may contact the following organizations:

• Personal Information Infringement Report Center (privacy.kisa.or.kr / 118)
• Supreme Prosecutors' Office Cybercrime Investigation Division (spo.go.kr / 1301)
• Korean National Police Agency Cyber Bureau (ecrm.police.go.kr / 182)

12. Changes to This Privacy Policy

This Privacy Policy applies from its effective date. In the event of additions, deletions, or amendments based on changes in applicable laws and Company policy, the Company will provide notice via in-app announcements at least 7 days before the changes take effect.

In case of any discrepancy between the Korean and English versions of this Privacy Policy, the Korean version shall prevail.