Guides and support
Privacy Policy
This is the OWOO privacy policy of Refactory (the company). OWOO: Our day complies with the Personal Information Protection Act and other applicable laws of the Republic of Korea and processes only the personal information needed to provide the service. This policy explains the purposes, categories, retention, sharing and deletion of information processed in the app, and how users can exercise their rights. Local testing and remote preview are distinct modes. Remote preview actually uses Firebase Authentication, Cloudflare APIs and storage, and Android FCM notifications. Live iOS APNs delivery is disabled pending key preparation; operational integration of live store payments and commercial advertising is not complete. Before introducing external integrations, we will determine and disclose recipients, processing countries, data categories, purposes, periods and legal bases.
On this page
- 1. Information collected and purposes
- 2. Relationships, profiles and service records
- 3. Processing purposes
- 4. Sharing between partners
- 5. Disclosure to third parties
- 6. Retention and statutory preservation
- 7. Processors, Cloudflare backend and overseas processing
- 8. Advertising and payment information
- 9. Deletion procedures and methods
- 10. Your rights
- 11. Security measures
- 12. Protection of children
- 13. Cookies and automatic collection
- 14. Privacy officer
- 15. Policy changes and inquiries
1. Information collected and purposes
Accounts and authentication: We process the selected authentication provider, provider identifiers, internal account ID, necessary authentication and session data, confirmation of age 14 or older, and consent items and timestamps to confirm registration intent, maintain login, verify age eligibility, manage consent and prevent misuse. We do not request unnecessary social profile details such as names, photos or friend lists, or passwords. Service use: We process selections, text, notes, notification settings and device-generated state to provide user guides, heart actions, evening reflections, comic notes, notifications and home features. Access logs and IP information may be processed for reliability. Paid features: When real payments are introduced, we will process only the minimum verification data, including product IDs, transaction and purchase status, periods, renewals, refunds and restoration results. The operator does not collect raw payment credentials such as card numbers or account passwords. Legal bases: Registration and service delivery may rely on performance of the service agreement or consent; statutory retention on legal obligations; and security and misuse prevention on legitimate service interests. Declining optional consent does not restrict basic service use. Data is retained until its purpose is fulfilled or the user withdraws, with data subject to statutory retention kept separately for the prescribed period. Registration and account protection involve Firebase UIDs, internal account IDs, authentication and session information, age confirmation and required and optional consent records. Profiles, relationships, responses, notes and settings are stored for the service. Android notifications involve device identifiers, FCM tokens and notification job and delivery states. Server tokens are encrypted. Banners show generic updates; account and job identifiers and feature-specific notification data may pass through FCM. Profiles separately requested for service features are distinct from basic account information, such as email, processed by the Firebase SDK within the selected authentication provider’s authorization scope. If supplied within the provider’s authorization scope, basic account data such as email, display name and photo URL may be processed by Firebase authentication.
2. Relationships, profiles and service records
We may process relationship IDs, both account IDs, connection and disconnection states and times, names or nicknames, birthdays, guide selections and text, exchanged heart actions and replies, evening reflections, comic notes, postcard composition, home decorations and notification settings. Sharing with a connected partner is limited to records described for each feature. We do not collect unnecessary location information such as birthplace or current location. This is distinct from requesting a birth city or GPS location. Enabled SDKs may derive country/city-level approximate location from IP according to actual settings; it is not precise GPS coordinates.
3. Processing purposes
Information is processed to identify users and maintain login, verify age eligibility, connect relationships, disclose authorized records to partners, deliver heart actions and replies, create reflections and postcards, send notifications, verify purchases, handle inquiries and maintain service reliability.
4. Sharing between partners
Connected partners can see only guides for which both users have met the writing requirements, heart actions sent to them, and records agreed to be saved together. Drafts made before connection are not shared, and new access by a former partner is restricted after disconnection.
5. Disclosure to third parties
As a rule, the company does not disclose personal information to third parties. Disclosure is limited to what is necessary with separate consent, to meet a legal obligation, or in an emergency to protect life, health or property. Recipients, purposes, data categories, retention periods and refusal methods are disclosed in advance. Where external login, payment or cloud providers process data on the company's behalf, the scope and processor details are disclosed separately from third-party disclosure, along with processing countries and legal bases before integration. Records shared with a partner follow section 5 rather than third-party disclosure rules.
6. Retention and statutory preservation
Personal information is deleted without delay when its purpose is fulfilled, consent is withdrawn or the account is deleted. After disconnection, records are retained only for the recovery period shown in the app and then deleted. Actual transaction records subject to the Act on Consumer Protection in Electronic Commerce may be retained separately: contracts and withdrawals for 5 years, payment and supply records for 5 years, consumer complaints and disputes for 3 years, and advertising records for 6 months. Access logs and IP information required by other laws, including the Protection of Communications Secrets Act, are kept only for the legally prescribed period. These periods do not apply to all profiles and notes. Account and service information is processed while its purpose continues. Account withdrawal and deletion requests end account access and start deletion work. Legally required records are separated; notes are not all retained long term. Failed deletion is retried with access blocked. Sign-out revokes the device's server token and requests SDK token deletion. Token deletion is distinct from Firebase installation ID deletion. Provider guidance governs processing and deletion periods for Firebase accounts and installation IDs.
7. Processors, Cloudflare backend and overseas processing
Local testing and remote preview are distinct modes. Remote preview actually uses Firebase Authentication, Cloudflare APIs and storage, and Android FCM notifications. Live iOS APNs delivery is disabled pending key preparation; operational integration of live store payments and commercial advertising is not complete. Processor: Cloudflare, Inc. Processing countries: Cloudflare global service infrastructure; actual countries and storage locations for this account remain confirmation items. Korea-only storage is not guaranteed. Data: Account IDs, authentication and session information, profiles such as names and birthdays, relationship data, notes, answers, notifications, home settings, purchase status, and technical API request data such as IP addresses, timestamps, traffic and errors. Purpose: Production backend, storage and restoration, API processing, security, incident response and performance improvements. Transfer timing and method: Encrypted network transfers when registering, logging in, saving or viewing records and using other features. Retention: The retention periods set by OWOO and applicable law. OWOO data held by Cloudflare will be deleted or access blocked when the purpose is fulfilled, the user withdraws or the contract ends. Cloudflare's processor role and safeguards follow its Privacy Policy and Data Processing Addendum. Before deployment, we will establish and disclose the legal basis for overseas transfers, required consent and detailed processing scope. Privacy Policy: https://www.cloudflare.com/privacypolicy/ · Data Processing Addendum: https://www.cloudflare.com/cloudflare-customer-dpa/ · Contact: privacyquestions@cloudflare.com. Before adding Kakao, Google or Apple login, app store payments, rewarded ads or notification services, we will separately disclose processors and recipients, countries, data categories, purposes, retention periods, legal bases and refusal methods. Recipient: Google LLC — Firebase Authentication / FCM / Google Analytics / Firebase Crashlytics / AdMob / Gmail Transfer countries: Authentication is processed in the United States; actual countries and contract terms for other SDKs and Gmail require confirmation. Transferred information: Provider identifiers, authentication/installation/device/delivery information, enabled telemetry technical data, and support email addresses, content and attachments. Sending service-record text as analytics events is not included. Tasks and purposes: Authentication, Android delivery, enabled analytics/crash diagnostics, test ads and support email Provider contact: https://firebase.google.com/support/privacy ; https://policies.google.com/privacy Transfer timing: When the corresponding feature is used or an enabled SDK collects information Transfer method: Encrypted network requests to the corresponding Google service and email transmission Retention and use period: Firebase authentication/installation and diagnostic data follow provider processing/deletion periods. Actual Analytics retention settings and advertising/Gmail terms remain confirmation items. Company retention/deletion duties follow sections 7 and 10.
8. Advertising and payment information
A test integration uses Google sample rewarded-ad units. SDK requests can occur according to verification-build settings and advertising privacy choices. Test ads may process device, network and consent information and differ from an on-device simulation. Operational integration of live store payments and commercial ads is not complete. Advertising privacy choices and device permissions may permit standard SDK data such as advertising identifiers to be processed. Even if rewarded ads are introduced, guides, reflections, partner information, comic notes and storybook records will in principle not be provided for ad targeting. Advertising and marketing consent is separate from basic service consent, and basic features remain available if you decline.
9. Deletion procedures and methods
Information due for deletion because a retention period ends, a purpose is fulfilled, consent is withdrawn or an account is deleted is identified and destroyed automatically or after confirmation by the privacy officer. Electronic files are permanently deleted so they cannot be reproduced; paper documents are shredded or incinerated. Failed deletions are retried with access blocked. Deleted accounts and records are not automatically transferred to new relationships. Local test records and remote accounts and records are distinct. Removing app data alone does not delete remote account information. Account closure triggers server deletion through access termination, deletion and failure retries. Provider backups, recovery and deletion completion are handled separately; deletion-target records are not reused to restore new accounts or relationships.
10. Your rights
Users may request access, correction, deletion, suspension of processing and withdrawal of consent. Rights can be exercised through profile and notification settings, account deletion or the privacy email, including through a legal or authorized representative. The company verifies the identity or authority of the requester and responds within statutory deadlines. If a request is restricted by law, the reason and objection procedure are explained.
11. Security measures
We minimize personnel handling personal information, restrict access by role, and apply secure authentication and transmission, encryption where necessary, security updates, access-log reviews, staff training and incident-response procedures. If a leak, loss or damage is confirmed, we promptly explain the cause, impact, response and contact details and follow legal reporting and remedy procedures. Relationship data is provided only after checking the two connected accounts' permissions. Protection of information stored on the device may depend on device locks and operating-system or browser security settings.
12. Protection of children
Children under 14 may not register. If information about a child under 14 is identified, it will be deleted without delay unless there is a lawful basis for processing it. Registration currently uses the user’s confirmation of being at least 14. Parental verification and identity-document collection are not provided.
13. Cookies and automatic collection
The app itself does not use advertising-tracking cookies to store or retrieve usage information. Google Analytics and Firebase Crashlytics collection defaults on for mobile release builds and off for development/verification builds, with build-setting overrides. When active, screen and feature categories, language, build mode, app/device information, error types, stacks and installation identifiers may be processed for statistics and troubleshooting. Company instrumentation is configured not to add account/relationship IDs, nicknames, record text or authentication tokens to events, user IDs or custom logs. Analytics advertising-storage, ad-user-data and ad-personalization consent values are denied. SDK processing and retention/deletion follow each provider policy and actual settings; collection changes follow the existing notice and rights procedures. Before introducing additional cookies, access logs, analytics or advertising SDKs, or automatic collection tools, we will add the data categories, purposes, retention periods and refusal methods to this policy.
14. Privacy officer
The company appoints the following privacy officer to oversee personal information processing and handle complaints and remedies relating to it. Privacy officer Name: Park Hyunchen Position: Representative Contact: owoo-support@refactory.party (Support) Privacy department Name: Park Hyunchen Role: Privacy contact Contact: owoo-support@refactory.party (Support) Users may direct all privacy-related complaints arising from use of the service to the privacy officer or department. The company will respond and take action without delay.
15. Policy changes and inquiries
When this policy changes, the changes, reasons, effective date and previous policy will be made available in the app. Privacy infringement advice is also available from relevant bodies such as the Personal Information Infringement Report Center and Personal Information Dispute Mediation Committee. Contact owoo-support@refactory.party (Support) with privacy inquiries.
Document data and version
JSONSHA-256: cb7bead69823ff7affa9958e0c517c53341a24be2d13e02fddfa56d59f5bddc1