한국어 · English

Alleydex Privacy Policy

Effective: 2026-07-29 · Last updated: 2026-07-29 · The previous version (2026-07-06) is superseded by this one.
This is an English translation provided for your convenience. The Korean version is the authoritative text and prevails in case of any discrepancy.

Alleydex (Korean name 줍냥이, “Jupnyangi”; the “App”) is operated by an individual developer in the Republic of Korea and complies with the Korean Personal Information Protection Act (“PIPA”), the Act on the Protection and Use of Location Information (“Location Information Act”) and other applicable laws. This policy describes, factually, what the App actually collects, where it is sent, how long it is kept, and how you can control it.

0. At a glance

• Most of the App works without signing in. Sign-in (Apple / Google) is required only for backup, friends and gifting.
• If you do not sign in, your cards, photos and location stay on your device and are not uploaded to our server. Photos are still sent to the AI (Google Gemini, United States) to generate a card — this happens whether or not you are signed in.
• If you sign in and use backup, a copy of the photo, the card artwork and the card data (including the coarse location) are stored linked to your account on the developer-operated server (Supabase, Seoul region).
• Using the in-app support form sends your message to the operator's messenger (Telegram, abroad) and to Anthropic (United States) to draft a reply.
• Deleting your account deletes your cards, photos, profile, nickname and friendships — but support tickets, abuse reports and the statutory location-use records are not deleted immediately. Gift and trade history also remains, with your account identifier removed, so that the other party keeps their own record (see §8 for the reasons and periods).

1. What we process, why, and for how long

The App processes the items below. Items marked as account-linked are stored on our server together with the identifier of your signed-in account.

① Processed even if you never sign in or use backup

② Stored on our server and linked to your account when you sign in and use backup

The items below are stored on the developer-operated server (Supabase, Seoul ap-northeast-2 region) linked to your account identifier, only once you have signed in with Apple or Google and use backup. If you do not sign in, none of it is sent to the server.

③ Statutory records created when you use the location feature

The coordinate values themselves are not included in these records. You may request access to, and notification of, these records (Article 7 of the Location-Based Service Terms).

④ Processed when you contact support or report content

⑤ Payments

In-app purchases are processed by Apple's App Store billing (StoreKit) on iOS and Google Play Billing on Android. The App does not collect payment-method details such as card numbers, and does not validate or store receipts on its own server. Payment data is processed under the privacy policy of the relevant store operator (Apple or Google).

2. Important — how photos are handled before they are sent

• The step that checks “is this an animal?” with the camera runs entirely on your device (Apple Vision on iOS, Google ML Kit on Android — in both cases a model built into the device) and is never transmitted.
• Before sending a photo anywhere, the App strips metadata (EXIF, including GPS) on your device and downscales the image to make the copy that is transmitted.
• 🔴 Blurring of human faces and vehicle licence plates was discontinued on 30 August 2026. Faces and licence plates in the transmitted photo are not obscured. We recommend that you do not photograph or select images containing people's faces or other personally identifiable information.
• Metadata stripping is not guaranteed to succeed either. If the processing module is unavailable on your device, if it times out (about 6 seconds), or if an error occurs, the original photo may be transmitted as it is so that card generation can continue.
• By contrast, a photo copy is uploaded to the backup server (Supabase) only when metadata stripping has succeeded; if it fails, no upload takes place at all.
• ⚠️ Disclosure of a past issue: on iOS versions released before 30 August 2026, metadata (EXIF) stripping did not actually take effect. As a result, some photos stored on the backup server up to that point still contain capture coordinates. We are deleting those coordinates progressively; if you would like to know the status of your own photos, please contact tsetse012@gmail.com.

3. Transfer of personal data abroad

Personal data is transferred outside the Republic of Korea in the cases below. In accordance with Article 28-8 of PIPA we disclose the following and obtain your consent. You may decline to consent to a cross-border transfer, but in that case the corresponding features (card generation, map display, support, notifications) cannot be used.

① Photo → AI card generation

② Coarse location → map display (card-back minimap)

③ Support conversation → AI draft reply

④ Support notification → operator's messenger

⑤ Push notification delivery

The table above applies to iOS (APNs); the table below applies to Android (FCM).

⑥ Advertising

For matters concerning the use of location information, please also see the Location-Based Service Terms.

4. Entrustment of personal data processing

To provide the service, the App entrusts personal data processing as set out below. Each processor handles personal data only within the scope of the entrusted purpose.

5. Provision of personal data to third parties

Apart from the cross-border transfers and the entrusted processing described in §3 and §4, the App does not provide your personal data to third parties. We may, however, comply where there is a specific provision of law or where an investigative authority makes a request in accordance with the procedures and methods prescribed by law.

If you use the friends and gifting features, the nickname you set and the card data you exchange are displayed in the App to the friends you have connected with. This is a disclosure that results from your own use of the feature; if you do not want it, you can choose not to use the friends feature, or remove a friend.

6. Destruction of personal data

Personal data whose retention period has expired or whose processing purpose has been achieved is destroyed without delay. Electronic files are deleted in a manner that makes them unrecoverable. As set out in §8 below, however, certain items are retained separately after account deletion for dispute handling and abuse prevention.

7. Your rights, and those of a legal representative, and how to exercise them

• Access and correction: you can view and edit your stored card and profile data on the collection and settings screens in the App.
• Deletion: deleting an individual card removes it from your device, and — if backup was on — also deletes that card's photo copy, artwork and card data stored on the server.
• Suspension of processing: if you stop using backup (sign out), no further uploads to the server take place. Anonymous usage analytics can be turned off at any time in Collection > Privacy & Consent.
• Withdrawing location consent: you can turn off the App's location permission under Settings > Privacy & Security > Location Services on iOS, or Settings > Apps > Alleydex > Permissions > Location on Android. All other features work normally without the location permission.
• Withdrawing cross-border transfer consent: you can withdraw at any time on the Collection > Privacy & Consent screen in the App. After withdrawal the consent screen is shown again on the next launch, and the App cannot be used until you consent again — this covers the whole App, including the yard and the collection, not only card generation. Cards stored on your device are not deleted and can be viewed again once you consent.
• Opting out of notifications: turning off the notification toggle in the App or signing out deletes the push token from the server.
• Account deletion: you can delete your account yourself under Settings > Account > Delete account in the App. You may also request it by email (tsetse012@gmail.com).
• You may also exercise the rights above by email, and you may exercise them through a legal representative or a duly authorised agent.

8. What account deletion actually removes — and what it does not

Stated factually, so that you know exactly where you stand.

9. Personal data of children under 14

The App is not directed at children under the age of 14, and only users who have confirmed that they are 14 or older may use it. If we learn that the personal data of a child under 14 has been collected without the consent of a legal representative, we destroy that data without delay. In addition, under the Location Information Act, the consent of a guardian is required to use the location information of a child aged 8 or under and certain other protected persons (see the Location-Based Service Terms).

10. Measures to secure personal data

• All external communication is encrypted with HTTPS.
• Server data is separated by an account-level access control policy (Row Level Security) so that one user cannot access another user's data.
• Photos are uploaded to the backup server only when on-device stripping of metadata (EXIF, GPS) has succeeded (see §2).
• The number of people who handle personal data is limited to one: the individual developer.

11. Data controller, privacy officer and contact

Data controller: Nunchi (눈치) — a sole proprietorship registered in the Republic of Korea, business registration no. 640-51-00912
Privacy officer: Subin Kim (김수빈), proprietor
Privacy enquiries, access and deletion requests: tsetse012@gmail.com

You may report or seek advice about an infringement of your personal data with the following Korean authorities: Personal Information Dispute Mediation Committee (1833-6972, kopico.go.kr) · Privacy Infringement Report Centre (118, privacy.kisa.or.kr) · Supreme Prosecutors' Office Cybercrime Investigation Division (1301) · National Police Agency Cyber Bureau (182).

12. Changes to this policy

This policy applies from 29 July 2026. The previous policy (effective 6 July 2026) is superseded by this one. Where content is added, removed or amended, the changes are posted on this page, and changes that materially affect your rights are additionally announced within the App.

한국어 원문 보기 · Read the authoritative Korean version