What we hold, and for how long

• Account & sign-in — email, display name; if you use Google sign-in: name, profile photo, Google account ID. Purpose: identify you, authenticate, manage your account. Legal basis (GDPR): contract
• Age check — self-attestation that you are 16 or older, and when. Purpose: enforce the minimum age. Legal basis: legal obligation / legitimate interest
• Coaching — videos you submit (including face and voice), audio files, diagnosis requests, trainer feedback, prescriptions and practice records. Purpose: free diagnosis and personalised coaching. Legal basis: contract
• Payments (once paid plans launch) — email, name, country, postcode, transaction ID, subscription status (card details are held only by our payment provider). Purpose: billing, refunds, tax. Legal basis: contract, legal obligation
• Collected automatically — IP address, access time, browser and device data, usage records, essential cookies. Purpose: security, abuse prevention, error handling. Legal basis: legitimate interest
• Consent records — whether and when you accepted the Terms and this Policy. Purpose: proof of consent. Legal basis: legal obligation

We do not use your data for any other purpose, and we will ask for your consent before any change of purpose.

• While subscribed and after cancellation: your account and submissions are kept while your account exists. Cancelling a subscription does not delete your data; it only limits paid features.
• Submitted videos and audio: deleted automatically 30 days after you receive your trainer's feedback.
• Account deletion: your account, videos and audio are erased 30 days after you request deletion. You may withdraw the request within those 30 days.
• Trainer feedback: the text of the feedback is deleted when you delete your account. For service-quality statistics we keep only items that cannot identify you (diagnosis category, practice module, time spent).

Under statute or our own retention standard, the following are kept for the periods below even after account deletion, and then erased. For EU users this retention relies on GDPR Art. 17(3)(b).

• Contracts, withdrawals, payments and supply — 5 years, from the launch of paid subscriptions (Korean E-Commerce Act)
• Consumer complaints and disputes — 3 years, from the launch of paid subscriptions (Korean E-Commerce Act)
• Access and processing records (IP address etc.) — 1 year (our retention standard)
• Payment-related records (payment, failed payment, cancellation, refund) and the records underlying a sign-in block — 5 years (Korean E-Commerce Act for payment records; otherwise our retention standard)

Once the retention period ends or the purpose is met, we erase the data without undue delay. Electronic files are deleted by means that make them unrecoverable. Data we must keep by law is stored separately.

We operate the Service from the Republic of Korea, but we entrust processing to the companies below, all of which store or process data outside Korea.

Legal basis: these transfers are necessary to perform our contract with you. For EU/EEA users we rely on GDPR Art. 6(1)(b) (contract); for Korean users on PIPA Art. 28-8(1)(3) (processing entrusted or stored abroad where necessary to perform the contract with the data subject). The particulars required by PIPA Art. 28-8(2) — recipient, country, data, timing and method, purpose and retention — are disclosed below. We therefore do not ask for a separate overseas-transfer consent checkbox.

• Supabase Pte. Ltd (65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513 · privacy@supabase.io) — entity: Singapore / data stored in: Germany (Frankfurt). Data: account data, submission metadata, audio files, feedback, access logs. When and how: continuously while you use the Service, encrypted transfer. Purpose: database, authentication, file storage. Retention: until account deletion or the end of the processing contract
• Vercel Inc. (440 N Barranca Ave #4133, Covina, CA 91723, USA) — USA (function region: Germany, Frankfurt). Data: IP address, request logs. When and how: on each visit, network transfer. Purpose: web hosting. Retention: runtime logs 30 days; build logs for as long as the deployment is kept
• BunnyWay, informacijske storitve d.o.o. (Dunajska cesta 165, 1000 Ljubljana) — Slovenia (origin storage: Germany, Frankfurt). Data: submitted videos, video IDs, playback IP. When and how: on upload and playback, encrypted transfer. Purpose: video storage, encoding, playback. Retention: until erased 30 days after account deletion
• Plus Five Five, Inc. d/b/a Resend (2261 Market Street #5039, San Francisco, CA 94114, USA) — sending region EU. Data: email address, message content. When and how: when we send an email, network transfer. Purpose: sign-in links and notifications. Retention: sending logs 30 days
• Paddle.com Market Limited (England and Wales, company no. 8172165, 30 Old Bailey, London EC4M 7AU, UK); for US buyers, Paddle.com Inc. (3811 Ditmars Blvd. #1071, Astoria, NY 11105-1803, USA) — once paid plans launch. United Kingdom (non-US buyers) / USA (US buyers). Data: email, name, country, postcode, payment data. When and how: at checkout, encrypted transfer. Purpose: payment processing as Merchant of Record. Retention: as required by law
• Functional Software, Inc. d/b/a Sentry (45 Fremont St, 8th Floor, San Francisco, CA 94105, USA) — USA (ingest region: Germany). Data: internal user ID, error data, browser info. When and how: when an error occurs, network transfer. Purpose: error monitoring. Retention: 90 days

If you choose Google sign-in, we receive your email, name and profile photo from Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). Google's terms also name Google Ireland Limited for consumer services in the EU.

Korea benefits from an EU adequacy decision. Transfers to other countries are protected by Standard Contractual Clauses or equivalent safeguards. Data processing agreements are in place with the processors we currently use.

The transfer to Paddle begins when paid subscriptions launch; we will confirm its data processing agreement and update this Policy at that point.

We do not disclose your personal data to third parties without your consent or a legal basis, and we never share it for advertising or analytics.

We use no analytics or advertising cookies. We only use the following essential and functional storage.

• Sign-in session cookie (sb-*): keeps you signed in (essential)
• Language cookie (NEXT_LOCALE, 1 year): remembers the language you chose
• Browser storage: resumable uploads, and the email address you entered to request a sign-in link
• Video player (Bunny Stream) playback settings: the player keeps playback settings (such as volume) and a display cache in your browser storage (localStorage). It sets no cookies and stores nothing that identifies you.

You must be 16 or older to use the Service. We ask you to confirm this at sign-up, and we delete the data of anyone under 16 as soon as we become aware of it.

You may access, correct, delete, restrict, object, withdraw consent and download (port) your data at any time. Use the in-app settings (data export, account deletion) or the contact below; we respond without undue delay and within one month under the GDPR. EU users may lodge a complaint with their local supervisory authority.

Encryption in transit (HTTPS), row-level access control, least-privilege admin access, access logging and regular permission audits.

• Name: GU DOHYEON (구도현)
• Title: Representative
• Business name / registration no. / address: Geochinsori Yeonguhoe (거친소리 연구회) / 284-01-03960 / B1, 3 Nambusunhwan-ro 237-gil, Gwanak-gu, Seoul 08742, Republic of Korea / mail-order registration: exempt as a simplified taxpayer (Korean E-Commerce Act Art. 12(1), proviso)

Remedies: Korea Internet & Security Agency privacy report centre (118, privacy.kisa.or.kr), Personal Information Dispute Mediation Committee (1833-6972, www.kopico.go.kr)

We announce changes in the Service 7 days before they take effect, or 30 days in advance for changes unfavourable to you.