Privacy Policy

1. Information We Collect

• Sign-up and sign-in: email address, nickname. If you sign in with an Apple or Google account, the account identifier and email address provided by that account.
• While using the Service: content you write, such as letters and time capsules (including translations made for readers of other languages and keywords picked from letters), and usage records (commemorative stamps, postmarks, etc.).
• Collected automatically: IP address, device information (model, OS), app usage records, push notification token, advertising identifier (ADID/IDFA).
• Paid features: purchase receipt information processed by the stores (Apple App Store / Google Play). The Company does not collect payment-method details such as card numbers.

2. How We Collect Information

• Information you enter directly at sign-up or while using the Service
• Information generated and collected automatically during use of the Service
• Information you provide through email inquiries and customer support

3. How We Use Information

The Company uses the information you provide in accordance with this Policy. If you provide information for a specific purpose, we use it in connection with that purpose.

• Providing and operating the Service: account management, letter delivery, translation and title suggestions, letter keywords ("Often talked about"), notifications
• Providing the paid Subscription Pass and managing subscription status
• Responding to inquiries, handling disputes, and delivering notices
• Improving the Service and statistical analysis (including aggregated statistics that cannot identify individuals)
• Preventing misuse and protecting users (including checking letters for contact details and other personal information or inappropriate content before they are sent)
• Complying with legal obligations

4. Legal Bases for Processing

The laws of some jurisdictions require that we inform you of the legal bases for using or disclosing your personal information. To the extent those laws apply, our legal bases are:

• Performance of a contract: processing needed to create your account and provide the Service
• Legitimate interests: providing a safe and enjoyable user experience, analyzing and improving the Service, and protecting our users, staff, and assets — in ways that do not override your interests and fundamental rights
• Compliance with legal obligations
• Consent: where required by law, we process personal information based on your consent

5. Disclosure to Third Parties

The Company does not sell your information, and as a rule does not provide it to third parties without your consent, except in the following cases:

• You have given prior consent
• Disclosure is required by law, or needed to comply with a lawful request, order, or subpoena from a court or investigative authority
• Disclosure is necessary to protect the rights, property, or safety of the Company or third parties
• A business transfer occurs, such as a sale, merger, or reorganization (your information may be part of the transferred assets; we will notify you in advance)
• Information is provided in a form that cannot identify individuals, such as aggregated statistics

6. Processors and International Transfers

The Company entrusts the following processing to the extent necessary to provide the Service. Each processor is responsible for protecting information under its own privacy policy. Where a processor’s servers are located abroad, personal information may be transferred internationally.

You may refuse the international transfer of your personal information; in that case, use of all or part of the Service may be limited.

AI Processing of Letters

(1) Letter checks, title suggestions, translation and letter keyword extraction are processed by Vertex AI (Gemini models) provided by Google LLC. The letter text is sent to Google's servers when the app checks a letter for contact details and other personal information or inappropriate content and suggests a title before you send it, and when you reply to a pen pal who uses another language or open a letter written in another language.

(2) Letter topic suggestions send only your app language setting; nothing you have written is included.

(3) Data is sent directly from your device to Google's servers without passing through a separate Company server, and each request is checked to confirm it comes from a genuine installation of the app (Firebase App Check).

(4) The Company does not use your letters to train AI models. Google states that, under Google Cloud's data processing terms, it does not use customer input to train its models, and it may temporarily store (cache) inputs and outputs for up to 24 hours to process requests faster. See Google Cloud's data governance documentation for details.

(5) When you send a letter, the letter text and the keywords already picked from your letters in that conversation are sent in the same way to build "Often talked about", which your pen pal sees, and up to three words used in the letter are picked as keywords. The processing is designed not to pick personal names, ages, where you live, schools, workplaces, contact details, health or other information that could identify you or is sensitive, but AI can pick wrongly, and you can remove or edit words on your own screen. When keywords from a pen pal who uses another language are shown in your language, only the keywords are sent. Keywords are not picked from time capsules.

7. Retention and Destruction

(1) The Company processes and retains personal information within the retention period agreed at collection or required by law. As a rule, when you request account deletion, your personal information is destroyed without delay.

(2) The following records are retained for the periods required by Korean law and then destroyed:

• Records on contracts, withdrawal of offers, payments, and supply of goods in e-commerce: 5 years
• Records on consumer complaints and dispute handling in e-commerce: 3 years
• Service log records under the Protection of Communications Secrets Act: 3 months

(3) Electronic files are deleted using methods that prevent recovery; other records are shredded or incinerated. Information retained under law is stored separately and is not used for any other purpose except as required by law.

(4) Letter text sent to Google for AI processing is handled under Google Cloud's data processing terms, and the Company does not keep a separate copy. Translations are stored with the letter so that the same letter is not translated again, and are destroyed on the same basis as the letter.

(5) Keywords picked from a letter are stored with that letter (including your pen pal's copy) and destroyed on the same basis as the letter. Your edits in "Often talked about" and translated keywords are stored only on your device and are deleted when you delete the conversation or sign out.

8. Advertising Identifiers and Similar Technologies

(1) The app uses on-device storage to keep your settings, such as sign-in state and notification preferences.

(2) For ad serving, the Google AdMob SDK may collect advertising identifiers (ADID/IDFA) and device information. You can limit personalized ads or reset the identifier in your device settings (iOS: tracking permission; Android: reset or delete advertising ID).

This website (the official web)

(3) This website uses no cookies and no analytics tools.

(4) This website uses external font services to display text. The body font is loaded from jsDelivr (a CDN), and fonts for some languages (such as Japanese, Chinese and Hindi) and the handwriting fonts of "A letter for that day" are loaded from Google Fonts. In the process, standard connection information such as your IP address may be sent to those services.

(5) A letter written in "A letter for that day" is encrypted in your browser and carried only in the part of the link after "#". Browsers do not send that part to servers, so the letter is never transmitted to or stored on our servers, and we cannot read it. Once the opening date has passed, anyone who has the link can open the letter.

(6) A letter you are still writing is saved temporarily only in your browser storage (localStorage) on your device, in case the page reloads, and is deleted once you seal it.

(7) When a letter is opened (and when the device clock is checked from one day before the opening date), your browser sends requests to the servers of drand, a public time-beacon service (for example, drand.cloudflare.com and api.drand.sh). Standard connection information such as your IP address may be sent to their operators in the process. We do not collect or keep these requests.

9. Security

The Company takes reasonable measures — such as access control and encryption in transit — to protect information provided through the Service from loss, misuse, unauthorized access, disclosure, alteration, or destruction. However, no internet or email transmission is perfectly secure or error-free, so please take special care in deciding what information you send us by email.

10. Your Rights and How to Exercise Them

(1) You may request access to, correction of, deletion of, or suspension of processing of your personal information. You can use in-app features (editing your nickname, deleting your account) or contact the Company directly.

(2) To exercise your rights by email, write "Personal data rights request" in the subject or body, describe the right you wish to exercise, and send it to huurray@gmail.com. To protect you, we may verify your identity before responding.

(3) Depending on your jurisdiction (for example, the European Economic Area), you may also have the right to object to processing, request restriction of processing, withdraw consent, and lodge a complaint with a supervisory authority, subject to limitations and exceptions under applicable law. We would appreciate the chance to address your concerns first — please contact us.

11. Account and Data Deletion

You can delete your account and data in the app: Settings → Account → Delete account. See the "Account Deletion" page on this website for the full procedure and scope of deletion.

12. Changes to This Policy

This Policy may be revised to reflect changes in law or the Service. Revisions are posted on this page, and material changes are announced in the Service. Continued use of the Service after a revised Policy is posted constitutes agreement to it. This Policy was last updated on the effective date shown above.

13. Contact

If you have any questions about this Policy or how the Service handles information, please contact us at any time. Operator: Midnightplan / Email: huurray@gmail.com

Addendum

(1) This Policy takes effect on 2026-10-30; however, the statements on letter keywords ("Often talked about") (Articles 1 and 3, the table and (1) and (5) of Article 6, and Article 7 (5)) take effect on 2026-10-23, the date this Policy was posted. It adds to the policy effective 2026-10-04 "Often talked about", which picks keywords from letters and shows them in the conversation, the related processing by Google Vertex AI (Gemini), and the retention and destruction of keywords.

(2) The policy effective 2026-10-04 (posted 2026-09-27) added to the policy effective 2026-07-23 the entrustment of letter checks, title suggestions and translation to Google Vertex AI (Gemini) and related statements (Articles 1, 3 and 6, and Article 7 (4)), and the statements on this website's cookies, analytics tools, external font services and "A letter for that day" (Article 8, (3)–(7), effective from the posting date).

(3) The policy effective 2026-07-23 replaced the previous policy posted on 2022-03-22, updating its descriptions of social-network sign-in (Facebook, etc.) and ad platforms (Twitter/Facebook SDKs) to match the current composition of the Service.

(4) This English version is a reference translation; the Korean version prevails in case of conflict.