Vision In You (비전인유; representative: Hyeongjo Lim) ("Operator") operates Diary Box — the iOS, Android, Mac and Windows apps, the web app (app.diarybox.kr) and the website (diarybox.kr) ("Service") — and is committed to protecting your privacy in accordance with applicable laws, including the Korean Personal Information Protection Act (PIPA), the EU/UK GDPR, and the California CCPA where applicable.
1. Information We Collect
We collect the minimum data necessary to provide the Service.
Category
Items
Source
Account
Social login identifier, email address, display name
Provided via Apple / Google / Kakao sign-in
User content
Memos (text), images, links, files, notes, to-dos, events and reminders, boxes (folders) you create, shared-box membership, and memos you share in from other apps or import from KakaoTalk/LINE chat files
Entered/uploaded by you
Paid service
Purchased product, purchase/renewal/expiration/refund dates, store transaction identifiers, and Pro plan status
Via the App Store / Google Play and RevenueCat when you make an in-app purchase
Referral
Your invite code, who invited you, and whether a referral reward was granted
When you sign up with an invite code or invite friends
Marketing consent
Date/time you opted in to "News & offers" notifications (cleared when you opt out) and a send log (notification type and time)
When you opt in/out; generated when a notification is sent
Device permissions
Photo library / camera access (for image attachments), microphone and speech recognition (when you record or transcribe in a note), calendar access (to add detected events to your device calendar, or to show your device calendar events in the app's calendar), notifications
When you grant permission and use the feature
Device & notifications
A random device identifier created by the app, platform (iOS/Android/Mac/Windows/web), device model, OS version, app version, language setting, push notification token (Firebase Cloud Messaging). We do not collect device names or user names.
Collected automatically when you open the app and when notifications are used
Analytics & diagnostics
App usage events/statistics, crash and performance logs, IP address
Collected automatically during use
Website visits & signup source
How you first arrived (campaign link tags, referring site, first page), where you installed the app (App Store, Google Play, Microsoft Store, or our website), page views and button clicks on the website and web app, a visitor identifier stored in a cookie, the device type you signed up on
Collected via cookies when you visit diarybox.kr or the web app; saved to your account once at signup
Feedback
What you write, app version, device model and OS version, language setting
When you send it from Settings > Report a problem / send feedback
Advertising
Device information including advertising identifiers (Android advertising ID, app set ID, device/OS info), ad interaction data (impressions, clicks), approximate location based on IP address, ad diagnostics, ad consent status (where applicable)
Collected automatically by the Google AdMob SDK when free-plan users view ads in the iOS/Android app
Recordings & transcripts
Recording files (when you choose to keep the recording), transcribed text and participant names
When you use recording in a note
Usage data
Timestamps such as message creation/edit time
Generated automatically
Photos/camera are processed only for images you choose to attach; we do not browse your photo library.
The microphone is used only while you are recording in a note. Transcription uses your device's speech recognition (provided by Apple or Google), and the transcript and any recording file are saved in your note.
Calendar access is used only to add the events you choose to your device calendar, to let you pick a calendar, and, if you allow it, to show your device calendar events next to your memos in the app's calendar screen. Device calendar events are read on your device only for display; we never send them to or store them on our servers.
Payment card details are handled directly by Apple / Google; we do not collect or store them. We process only the purchase records needed to provide and verify the Pro plan.
We do not collect precise location (e.g., GPS) or contacts. Our analytics provider (Mixpanel) may, however, infer an approximate region (country/city level) from your IP address for statistics, and our advertising provider (Google AdMob) may use approximate location based on your IP address to serve ads.
Ads: free-plan users see Google AdMob banner ads at the top of the Memo screen in the iOS/Android app. No ads are shown to Pro subscribers or in the Mac, Windows, or web versions. The iOS app does not request App Tracking Transparency (ATT) permission, so the iOS advertising identifier (IDFA) is not collected.
If you join a shared box, other members of that box can see your display name and the content you post in it. If you sign up through a friend's invite, the inviter may be notified that you joined, along with your display name.
2. How We Use Information
Account identification and social-login authentication
Providing core features (memos, notes, to-dos, events, reminders, boxes, shared boxes) and cross-device sync
Image attachments, link previews, adding detected events to your device calendar, and showing your device calendar events in the app
Providing the paid service (Pro), verifying and restoring purchases, and reflecting renewal, expiration, and refund status
Verifying referrals and granting/announcing referral rewards (an extra box)
Sending push notifications (when you have allowed notifications)
Sending marketing messages ("News & offers" notifications) — only if you have separately opted in
Serving personalized or non-personalized ads to free-plan users (including ad delivery, measurement, and prevention of invalid clicks)
Usage analytics and error/performance diagnostics to improve the Service
Service operation (including checking sign-in devices and signup source), support, and abuse prevention
3. Retention and Deletion
We retain personal data until you delete your account, after which it is destroyed without delay.
Account deletion immediately and permanently erases the data stored on our servers for your account (account info, boxes, messages, attached image files, push tokens, referral and consent data). Deleted data cannot be recovered. Copies remaining in system backups are deleted as the backups roll over.
Individually deleted messages/boxes disappear from the app immediately, are kept on the server for 30 days for recovery and error handling, and are then permanently erased together with their attached photos and files. Messages, photos and files you have not deleted are kept with no time limit until you delete them or your account. You can contact us to request permanent deletion before the 30 days are up.
Purchase records: even after you delete your account, purchase records held by the App Store / Google Play and RevenueCat may be retained for transaction verification, accounting, and dispute handling under their policies and applicable law.
Analytics & diagnostics: When you delete your account, we ask Mixpanel to delete that account's usage analytics, which Mixpanel deletes within its processing period. Error logs stored by Sentry are deleted when Sentry's retention period expires.
Sign in with Apple: If you signed up with Apple, deleting your account also asks Apple to revoke the app's sign-in tokens.
Advertising data collected by Google (AdMob) is retained according to Google's privacy policy.
We retain data longer only where required by law.
4. Sharing with Third Parties
We do not sell or share your personal data with third parties, except where required by law or a lawful request by authorities.
AI services you connect yourself (AI Connect): If you connect an AI app such as Claude or ChatGPT under Settings → AI Connect and choose boxes, that AI app can read and write only the memos, notes, and reminders in the boxes you chose, when you ask it to. This data is sent to the AI service you chose at your direction, and its handling after that is governed by that AI service's privacy policy. We do not collect your conversations with the AI service. You can disconnect at any time under Settings → AI Connect, after which the AI app can no longer access your boxes. See the AI Connect guide for details.
5. Processors (Sub-processors)
Processor
Purpose
Supabase, Inc.
Authentication, database storage, realtime sync
Cloudflare, Inc. (R2, Pages)
Storage and delivery of attached images, files, and recordings; hosting the website and web app
In-app purchase receipt validation, purchase history and Pro status management
Google LLC (Firebase Cloud Messaging)
Push notification delivery
Google LLC (AdMob)
Serving and measuring ads for free-plan users
Mixpanel, Inc.
Usage analytics
Functional Software, Inc. (Sentry)
Crash and performance diagnostics
6. International Data Transfers
Our processors' servers are located outside Korea, so your personal data is transferred abroad. These transfers are processing/storage outsourced as necessary to perform our contract with you, and are disclosed in this Policy in accordance with Article 28-8(1)(3) of the Korean PIPA.
When and how: transmitted over the network as you use the Service
Retention: unless stated otherwise, until you delete your account or the processing agreement ends (same as Section 3)
Recipient
Country
Contact
Data transferred
Purpose and retention
Supabase, Inc.
USA and other countries where Supabase data centers are located
supabase.com/privacy
Account info, user content, Pro status, referral data, marketing consent data, device & notification data, usage records
Authentication, storage, sync / until account deletion
Cloudflare, Inc.
USA and other countries where Cloudflare data centers are located
cloudflare.com/privacypolicy
Attached images, files, and recordings; website and web app access logs
File storage and delivery, hosting the website and web app / until account deletion
Apple Inc.
USA
apple.com/legal/privacy
Social login identifier, email address, payment information (collected directly by Apple)
Sign-in and in-app payments / per Apple's policy
Google LLC
USA
policies.google.com/privacy
Social login identifier, email address, payment information (collected directly by Google), push token
Sign-in, in-app payments, push delivery / until account deletion (payment information per Google's policy)
RevenueCat, Inc.
USA
revenuecat.com/privacy
Internal user ID, purchase history, Pro status
Purchase validation and subscription status / until account deletion (purchase records may be retained as described in Section 3)
Mixpanel, Inc.
USA
mixpanel.com/legal/privacy-policy
Internal user ID, app usage events, device info, IP address (approximate region)
Usage analytics / per Mixpanel's retention period
Functional Software, Inc. (Sentry)
USA
sentry.io/privacy
Crash and performance logs, device and app version info
Error/performance diagnostics / per Sentry's retention period
Google LLC (AdMob)
USA
policies.google.com/privacy
Device information including advertising identifiers (Android advertising ID, app set ID), ad interaction data (impressions, clicks), IP address (approximate location), ad diagnostics
Serving and measuring ads for free-plan users / per Google's policy
How to refuse and consequences: if you do not want your data transferred abroad, you may choose not to sign up, or delete your account via Settings tab → Delete account, or contact us. Because these transfers are essential to providing the Service, you will not be able to use the Service if you refuse them. However, you can limit the transfer of advertising data to Google (AdMob) as described in Section 8, or use the Pro plan so that no ads are shown.
Where required (e.g., under the GDPR), we rely on appropriate safeguards for cross-border transfers.
7. Marketing Messages
In accordance with Korea's Act on Promotion of Information and Communications Network Utilization and Information Protection, we send marketing messages (app tips, events, etc.) as push notifications ("News & offers") only if you have separately opted in.
Opt in: via "Receive news & offers (optional)" during onboarding, or Settings tab → News & offers notifications. Not opting in does not limit your use of the Service.
Opt out: at any time by turning off Settings tab → News & offers notifications. The app shows the result and the date whenever you opt in or out.
Format: marketing notifications are labeled "(광고)" (Advertisement) at the start of the title and include opt-out instructions.
No night-time sending: we do not send marketing notifications between 9:00 PM and 8:00 AM (Korea Standard Time).
Service-related notifications, such as a notice that you received a referral reward, are not marketing and may be sent to users who have allowed notifications.
8. Your Rights
Depending on your jurisdiction (e.g., GDPR/CCPA/PIPA), you may have the right to access, correct, delete, restrict or object to processing, and data portability, as well as to withdraw consent.
Access/correct: directly within the app
Delete: delete individual messages/boxes, or Settings tab → Delete account to erase all data
Withdraw consent: turn off News & offers notifications in Settings tab
Refusing or limiting ads:
Android: you can delete or reset your advertising ID in your device's Settings → Privacy (or Google) → Ads. If you delete it, ads based on the advertising ID will no longer be personalized.
iOS: the app does not request tracking permission (ATT) and does not collect the iOS advertising identifier (IDFA).
In regions where consent is legally required, such as the EEA and the UK, Google's consent form is shown before ads are displayed, and you may decline personalized ads.
With the Pro plan, no ads are shown.
Other requests: contact us at the email below
Subscriptions: deleting your account does not cancel an App Store / Google Play subscription. Please cancel it in your store's subscription settings before deleting your account.
You will not be discriminated against for exercising your rights.
9. Security
Encryption in transit (HTTPS/TLS)
Token-based access control and row-level security so you can view only your own data (and, for shared boxes, data of boxes you are a member of)
Attached image files are stored at random, hard-to-guess addresses. However, anyone who has an image's URL can view it without signing in, so please take care when attaching sensitive images.
Data minimization
10. Children
The Service is not directed to children under 14, and we do not knowingly collect personal data from them.
11. Contact
Data Protection Officer: Hyeongjo Lim (representative, Vision In You)
We will announce material changes at least 7 days (30 days for significant changes) before they take effect, via the app or this page.
Revision history
2026-11-13 (effective 2026-11-20): Stated that the policy covers the Mac, Windows, and web apps; listed to-dos, events, notes, files, and imported memos as user content; added device details (model, OS, app version, language) and install source; corrected the ad location (top of the Memo screen); added website and web app hosting to Cloudflare's processing
2026-10-12: Added showing device calendar events in the app's calendar screen (read on device only, never sent to our servers)
2026-10-08: Added note recording and transcription (microphone, speech recognition, recording files); corrected Settings menu paths
2026-10-06: Added website/web app visit statistics and signup source (cookies)
2026-10-01: Added disclosure of data sent to AI services you connect yourself (AI Connect); added Kakao sign-in
2026-10-04: Deleted messages/boxes and their attached photos and files are permanently erased after 30 days; data you keep has no time limit
2026-09-29: Added the paid service (Pro) and RevenueCat, referral data, marketing consent, and calendar permission; expanded the international transfer disclosure; clarified retention of individually deleted data
2026-09-29: Added in-app ads for free-plan users (Google AdMob): collected data, purposes, processor, international transfer, and how to refuse or limit ads
2026-09-29: Added Mixpanel analytics deletion requests and Sign in with Apple revocation on account deletion
2026-06-02: Initial version
In case of any conflict, the Korean version prevails for users in Korea.