Gomsak Privacy Policy

SafeTag Co., Ltd., which operates Gomsak, handles personal information as follows, in accordance with the Korean Personal Information Protection Act. The Korean version is the governing text.

1. Personal information we process

• Sign-up and login: mobile phone number (login ID), nickname, password (stored with one-way encryption)
• Created while using the service: posts, notes, replies and reports, region/travel tags on posts, the version of the terms you agreed to and when
• Photos you attach to a post (if any): the image file. Capture location and device data (EXIF) is stripped on upload and never stored.
• Collected automatically: web server access logs (IP address, time, requested address, browser information)
• Only if you turn notifications on: the push address and keys your browser creates, and that device's display language (notification text never contains post or reply content)
• We do not collect names, email addresses, postal addresses or dates of birth.

2. Purposes

• Identifying members and logging in; one account per person (preventing fraudulent sign-ups)
• Providing the service: publishing posts, circle invitations, replies, translation
• Handling reports, preventing abuse, security checks

3. Retention and destruction

• Member data is destroyed as soon as you delete your account. The text of your posts, notes and replies is deleted too; a post's seal fingerprint (hash) remains only as a 'deleted' record without the text.
• Photos: deleting a post or your account deletes the files from the server (they may remain in backups for the backup retention period).
• Web server access logs are deleted automatically after 14 days.
• Push addresses are deleted as soon as you turn notifications off, or when a send fails because the device removed it.
• Disaster-recovery backups (daily automatic backups and backups made before service changes) are deleted automatically after 14 days, so data from a deleted account may remain in backups for up to 14 days.
• Monthly archive backups: once a month a copy is stored on a separate device managed by the operator; only the last 12 months are kept and older ones are deleted, so data from a deleted account may remain in these archives for up to 12 months.
• Where the law requires retention, data is kept separately for that period.
• Electronic files are deleted in a way that cannot be recovered.

4. Provision to third parties

• We do not provide personal information to third parties without your consent or a legal basis.
• Posts and nicknames you make public are published by you and may be shared or quoted under the Terms of Service.

5. Processing on our behalf

• Gabia - hosting the service's servers (data storage)
• Aligo - sending verification text messages (once real SMS sending is switched on)

6. Transfer abroad

• Recipient: Anthropic, PBC (contact privacy@anthropic.com)
• Country: United States
• Items: the text of public posts and their revisions (including anything written in them)
• When and how: when a post becomes public, or when a reader requests a translation, over an encrypted connection (HTTPS)
• Purpose: translation into 15 languages
• Retention: according to the recipient's policy
• How to refuse: posts kept private (Raw or Curing) are never sent.

7. Your rights

• You may request access, correction, deletion or suspension of processing at any time.
• You can delete posts or add revisions in the app, and delete your account under 'Delete account' at the bottom of My Library.
• For anything else, contact the privacy officer below and we will act without delay.

8. Automatic collection

• We do not use cookies.
• Your login state and language/colour settings are kept in your browser's storage (localStorage); you can clear them in your browser settings (this logs you out).

9. Security measures

• Passwords are stored with one-way encryption (PBKDF2).
• All traffic is encrypted with HTTPS.
• Server configuration and data are accessible only to the operating account.
• Administrative functions are available only through a separate admin account.

10. Children under 14

• People under 14 cannot sign up.

11. Privacy officer

• Operator: SafeTag Co., Ltd.
• Officer: Hyeongseok Kwon, CEO
• Contact: +82-2-856-1138

12. Remedies (Korea)

• Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
• Personal Information Infringement Report Center: 118 (privacy.kisa.or.kr)
• Supreme Prosecutors' Office: 1301 (www.spo.go.kr)
• Korean National Police Agency: 182 (ecrm.police.go.kr)

13. Effective date

• This policy applies from 2026-09-12. We will announce changes in the service in advance.