Privacy Policy (Diary Box)

Effective date: {{launch date}} · Last updated: 2026-05-22

Hyeongjo Lim ("Operator") operates the mobile application Diary Box ("Service") and is committed to protecting your privacy in accordance with applicable laws, including the Korean Personal Information Protection Act (PIPA), the EU/UK GDPR, and the California CCPA where applicable.

1. Information We Collect

We collect the minimum data necessary to provide the Service.

Category	Items	Source
Account	Social login identifier, email address, display name	Provided via Apple / Google sign-in
User content	Messages (text), images, links, and boxes (folders) you create	Entered/uploaded by you
Device permissions	Photo library / camera access (for image attachments), notifications	When you grant permission and use the feature
Usage data	Timestamps such as message creation/edit time	Generated automatically

We do not collect payment information, location, or contacts. Photos/camera are processed only for images you choose to attach.

2. How We Use Information

Account identification and social-login authentication
Providing core features (messages, boxes) and cross-device sync
Image attachments and link previews
Service operation, support, and abuse prevention

3. Retention and Deletion

We retain personal data until you delete your account, after which it is destroyed without delay.
Account deletion permanently and immediately erases all data linked to your account (account info, boxes, messages, and attached image files). Deleted data cannot be recovered.
Individually deleted messages/boxes may be retained for up to 30 days for recovery/error handling before permanent deletion.
We retain data longer only where required by law.

4. Sharing with Third Parties

We do not sell or share your personal data with third parties, except where required by law or a lawful request by authorities.

5. Processors (Sub-processors)

Processor	Purpose
Supabase, Inc.	Authentication, database storage, realtime sync
Cloudflare, Inc. (R2)	Storage and delivery of attached images
Apple Inc. / Google LLC	Social-login authentication

6. International Data Transfers

Due to our processors' infrastructure, your data may be stored and processed on servers outside your country (including outside Korea). By using the Service you consent to such transfers. Where required, we rely on appropriate safeguards for cross-border transfers.

7. Your Rights

Depending on your jurisdiction (e.g., GDPR/CCPA/PIPA), you may have the right to access, correct, delete, restrict or object to processing, and data portability, as well as to withdraw consent.

Access/correct: directly within the app
Delete: delete individual messages/boxes, or More → Settings → Delete account to erase all data
Other requests: contact us at the email below
You will not be discriminated against for exercising your rights.

8. Security

Encryption in transit (HTTPS/TLS)
Token-based access control and row-level security so you can access only your own data
Data minimization

9. Children

The Service is not directed to children under 14, and we do not knowingly collect personal data from them.

10. Contact

Data Protection Officer: Hyeongjo Lim
Email: vision.in.you.2026@gmail.com

11. Changes

We will announce material changes at least 7 days (30 days for significant changes) before they take effect, via the app or this page.

This is a draft prepared for launch. Professional legal review is recommended before publication. In case of any conflict, the Korean version prevails for users in Korea.