ChimeMe — Privacy Policy

ChimeMe · Privacy Policy · v1
This is a translation of the Korean original. If there is any inconsistency, the Korean version prevails.
# ChimeMe Privacy Policy (v1)

**Effective Date**: 2026-07-04
**Last Revised**: 2026-07-04
**Version**: v1.0

---

ChimeMe (the "Company") complies with applicable laws, including the Personal Information Protection Act, and operates this Privacy Policy to protect the personal information of users of the ChimeMe service (the "Service").

---

## 1. Personal Information Collected

### 1.1 At sign-up (required)
- **Phone number** (for Firebase Phone Auth verification)
- **Nickname** (display name within Groups)
- **Date of birth** (to confirm sign-up eligibility for ages 14 and older — Q-12-03)
- **Consent history** (Terms of Service, Privacy Policy)

### 1.2 At sign-up (optional)
- **Profile photo**
- **Consent to receive marketing information**

### 1.3 Collected automatically during use of the Service
- **3-second videos (Content)** — for sharing within Groups
- **Chat messages** — for conversations within Groups
- **Group membership information** — Groups joined, date and time joined
- **Device information** — OS version, app version, device model (for monitoring Service stability)
- **FCM token** — for sending push notifications
- **Time zone** — for localizing slot display
- **Report / block history** — for maintaining Service safety

### 1.4 Information automatically generated and collected
- Access logs (IP address, access time)
- Service usage records
- Error logs (Firebase Crashlytics — anonymized)

## 2. Purposes of Collection and Use of Personal Information

| Purpose | Items collected |
|---|---|
| Member identification and authentication | Phone number, nickname |
| Confirming age 14 or older | Date of birth |
| Providing the Service (video/chat sharing) | Content, Group membership |
| Sending push notifications | FCM token, time zone |
| Service stability / security | Device information, IP address, error logs |
| Preventing fraudulent use | Report history, block history, access logs |
| Evidence of consent to terms | Consent history |
| Marketing (if optional consent given) | Nickname, marketing consent status |

## 3. Retention and Use Period of Personal Information

| Item | Retention period | Basis |
|---|---|---|
| Sign-up information | Until membership withdrawal | Providing the Service |
| Videos (Content) | **7 days after upload** | D-12-10 |
| Chat messages | **90 days** (author may be anonymized) | Q-12-08 |
| Access logs | **3 months** | Article 41 of the Enforcement Decree of the Protection of Communications Secrets Act |
| Withdrawn member information | Deleted immediately (except where retention is required by law, for the required period) | D-12-09 |
| Records of fraudulent use | **1 year** (e.g., to block re-registration) | Preventing fraudulent conduct |

## 4. Provision of Personal Information to Third Parties

As a rule, the Company does not provide Users' personal information to outside parties. It is provided only in the following exceptional cases:

1. Where the User has given prior consent
2. Where required by law or requested by an investigative agency in accordance with lawful procedures
3. Where provided in a form that does not identify any specific individual, for purposes such as compiling statistics or academic research

## 5. Outsourcing of Personal Information Processing

The Company outsources certain tasks to the following companies to operate the Service.

| Contractor | Outsourced tasks | Items processed |
|---|---|---|
| Google LLC (Firebase) | Authentication, data storage, cloud infrastructure, error logs (Crashlytics) | Phone number, videos, chats, FCM token, anonymized error information |
| Apple Inc. | iOS push notifications (APNs) | FCM token |

### 5.1 Overseas transfer
- Firebase data is stored in the **Seoul region (asia-northeast3)**, but some metadata may pass through servers in the United States.
- If you do not consent to this transfer, your use of the Service may be restricted.

## 6. Users' Rights

Users may exercise the following rights at any time:

1. **Request access to personal information**
2. **Request correction / deletion of personal information**
3. **Request suspension of processing of personal information**
4. **Request membership withdrawal and data deletion** — via the "Delete Account" menu in the Service
5. **Right to data portability** (where the GDPR applies) — request to `kheedogg@gmail.com`

These rights may be exercised through the settings menu in the Service or by email to `kheedogg@gmail.com`.

## 7. Destruction of Personal Information

### 7.1 Destruction procedure
- Destroyed immediately upon membership withdrawal or expiry of the retention period
- Securely deleted through an automated pipeline (Cloud Function)

### 7.2 Destruction method
- **Electronic files**: Permanently deleted using a method that makes recovery impossible
- **Printed or other paper materials**: Shredded or incinerated

## 8. Measures to Ensure the Security of Personal Information

The Company implements the following technical and administrative safeguards:

1. **Encrypted storage** — Firebase's built-in encryption (AES-256) + HTTPS transmission
2. **App Check** — Blocking abnormal clients (D-12-04)
3. **Access control** — Permission separation based on Firestore Security Rules
4. **Breach response** — Upon becoming aware of a breach, notifying Users and supervisory authorities without delay in accordance with applicable laws
5. **Physical security** — Data is stored in Google Cloud (Firebase) data centers and is subject to their physical security policies

## 9. Protection of Personal Information of Children Under 14

**ChimeMe is available to persons aged 14 and older.** (Q-12-03)
- Age is verified by entering a date of birth at sign-up
- Sign-up attempts by persons under 14 are blocked
- If it is confirmed that a person under 14 has signed up fraudulently, the account is deleted immediately

## 10. Management of Automatic Collection Mechanisms (Cookies / Tokens)

- ChimeMe is provided as a mobile app and does not use ordinary web cookies.
- Authentication sessions (Firebase ID Token, Refresh Token) are stored securely by the Firebase Authentication SDK in the device OS's secure storage (iOS Keychain, etc.).
- Users can revoke tokens through "Log Out" or "Delete Account" in the app.

## 11. Push Notifications

- The Company sends push notifications for new videos / chat messages / system notifications within Groups.
- Users can change whether to receive each type of notification in "Notification Settings" in the app.
- System notification permissions can be changed in the device settings.

## 12. Chief Privacy Officer

- **Chief Privacy Officer**: 김도희 (Dohee Kim)
- **Email**: kheedogg@gmail.com

Users may contact the Chief Privacy Officer regarding any inquiries, complaints, or remedies for damages related to personal information arising from use of the Company's Service.

## 13. Remedies for Infringement of Rights

Users may request remedies for infringement of their rights from the following organizations:

- **Personal Information Dispute Mediation Committee**: 1833-6972 (https://www.kopico.go.kr)
- **Personal Information Infringement Report Center**: 118 (https://privacy.kisa.or.kr)
- **Supreme Prosecutors' Office Cyber Investigation Division**: 1301 (https://www.spo.go.kr)
- **Korean National Police Agency Cyber Investigation Bureau**: 182 (https://ecrm.cyber.go.kr)

## 14. Changes to this Privacy Policy

This Privacy Policy may be changed due to changes in laws, policies, or the Service.
- Important changes will be announced through in-app notices and push notifications **from 30 days before** the effective date.
- For material changes, Users' renewed consent will be obtained.

## 15. GDPR Compliance (Users in Europe)

For Users in Europe only, the following rights are additionally guaranteed:

1. **Right to data portability** (Article 20) — Export of one's own data in JSON format
2. **Right to be forgotten** (Article 17) — Permanent deletion of data (applied automatically upon membership withdrawal)
3. **Right to object to automated decision-making** — May object if subject to automated moderation

Contact: `kheedogg@gmail.com`

---

## Addendum

This Privacy Policy takes effect from 2026-07-04.