Privacy Policy
(to be announced) (the "Operator") runs the IYAGI app (the "Service") in compliance with the Personal Information Protection Act of the Republic of Korea and other applicable laws, and handles your personal data as described below. Effective date: 2026-10-08
1. Data we collect and why
| Data | Purpose | When |
|---|---|---|
| Phone number (verified by SMS) | Identity verification, preventing duplicate accounts and ban evasion. The server stores only a one-way keyed hash (HMAC) and the country code, never the number itself. | Sign-up |
| Login identifiers (Firebase UID, Apple identifier) | Linking and restoring your account | Sign-up |
| Birth year | Adult verification (19 or older by calendar year; 18 outside Korea) and your age band. We do not collect the month or day. It is kept so your age band updates each new year; other users see only the age band, and only if you made it public. | Sign-up |
| Profile (nickname, gender, who you are looking for, country, country preference, chat languages, taste tags, intro, face-art number, whether your age band is public) | Building and showing suggestion lists | Entered by you |
| Device data (device identifier, platform, push token, time zone, UI language) | Push notifications, refreshing suggestions and bundling night-time notifications by local time | Collected by the app |
| Conversations (first hello message, messages) | Providing the Service, handling reports, keeping conversations as required by Korean youth-protection rules | Entered by you |
| One-liner board posts | A one-line post (mood or status) shown to other users. One per person; a new post replaces the previous one. | Entered by you |
| Point ledger and purchase records | Granting and spending points, handling payments and refunds | Using the Service |
| Reports, blocks, activity dates, moderator actions | Keeping the Service safe, resolving disputes, statistics | Using the Service |
| IP address | Rate limiting, access control for the moderator console, handling web deletion requests | Collected automatically |
| App usage data (screens viewed, key action events, app instance ID, device model, OS and app version, crash records) | Usage statistics and crash analysis to improve the Service (Google Analytics and Crashlytics, section 4). Conversations, posts, nicknames and phone numbers are not included. | Collected by the app |
We do not collect photos, real names, location (GPS) or national ID numbers.
2. Retention
Personal data is deleted without delay once its purpose is fulfilled or you delete your account. Account deletion takes effect 30 days after you request it; you can cancel in the app during that period. The following data is kept for the stated period.
| Data | Retention | Basis |
|---|---|---|
| Profile, tastes, settings, birth year and age band, login identifiers, push tokens | Deleted immediately when deletion takes effect | - |
| Hashed phone number (HMAC) and sign-up bonus record | 1 year after deletion takes effect | Preventing repeated sign-up bonuses and ban evasion |
| Conversations | 30 days after a conversation ends (ended conversations are read-only). When you delete your account, open conversations end and stay visible to the other person for 30 days, then are deleted | Providing the Service, handling reports |
| Reported conversations and report records | Until the report is resolved and the 14-day appeal period ends | Dispute resolution |
| One-liner board posts | 7 days (immediately when you post a new one or delete it). Deleted immediately when account deletion takes effect | Providing the Service |
| Point ledger and purchase records | 5 years, detached from the account identifier | Korean Act on Consumer Protection in Electronic Commerce |
| Access logs (IP) | 3 months | Korean Protection of Communications Secrets Act |
3. Sharing with third parties
We do not share your personal data with third parties, except when required by law, such as a lawful request from a law-enforcement authority.
By the nature of the Service, other users can see your nickname, face art, country, chat languages, taste tags, intro, gender, age band (if you made it public), an approximate last-seen time, your one-liner board post, and the messages you send to them.
4. Processors and international transfers
| Processor | Task | Data transferred | Country and retention |
|---|---|---|---|
| Google LLC (Firebase Authentication) | SMS phone verification | Phone number | Google servers in the United States and elsewhere, per Google's policies |
| Google LLC (Firebase Cloud Messaging) | Push notification delivery | Push token, notification text (message contents are not included) | United States and elsewhere |
| Google LLC (Google Analytics for Firebase) | Usage statistics (counts of screens and action events, aggregated by UI language and country) | App instance ID, device model, OS and app version, screen and event records. The advertising identifier is not collected | United States and elsewhere; per the Google Analytics retention setting (up to 14 months) |
| Google LLC (Firebase Crashlytics) | Crash analysis | Error records at the time of a crash, device model, OS and app version, app instance ID | United States and elsewhere; 90 days |
| Tencent Cloud Lighthouse (Seoul) | Server and database hosting | All Service data | Stored in the hosting region |
| Google LLC (Google Translate) | Translation so moderators can read conversations in other languages when handling a report | Text of reported conversations and intros (only when a moderator opens the translation, sent from the moderator's browser) | United States and elsewhere, per Google's policies |
| Google LLC (AdMob) | Rewarded ads (when introduced) | Advertising identifier | United States and elsewhere |
Where personal data is transferred abroad, we tell you at sign-up who receives it, in which country, which data, for what purpose and for how long, and obtain your consent or rely on another legal basis.
5. Deletion
Data past its retention period is erased irreversibly by an automatic clean-up job. When account deletion takes effect, your profile, login identifiers and push tokens are erased at once, open conversations are ended, and remaining points are forfeited.
6. Your rights
- Access and correction: open "3. My tastes" in the app to view and edit your profile and tastes.
- Deletion: open "6. About" in the app and tap "[ Delete account ]". Deletion takes effect after 30 days; you can cancel before then.
- If you cannot use the app: use the account deletion request page. The Operator verifies your identity and then processes the request.
- Other requests (access, correction, deletion, suspension of processing): email (to be announced). We verify your identity and respond within 10 days. A legal representative or an authorised person may also make the request.
7. Security measures
- Phone numbers are stored only as one-way keyed hashes (HMAC).
- Traffic between the app and the server is encrypted (HTTPS); session tokens are stored as hashes.
- The moderator console is reachable only from allowed locations, requires a password plus a one-time code (OTP), and logs every action.
- Moderators do not read conversations except to handle reports or comply with the law.
8. Automatic collection
The app does not use cookies. It collects your device's push token for notifications; turning notifications off in your device settings stops them. The app automatically collects screens viewed, key actions and crash records through the Google Analytics and Crashlytics SDKs (table in section 4). Collection of the advertising identifier (AD_ID) is turned off in the app; if rewarded ads are introduced, we will inform you separately about the advertising identifier and ask for consent.
9. Children
The Service is for adults only: 19 or older in Korea, or the age of majority where you live (at least 18). We do not collect children's data and delete any account found to belong to a minor.
10. Privacy officer and contact
- Operator: (to be announced) (representative: (to be announced))
- Privacy officer: (to be announced)
- Contact: (to be announced)
- Address: (to be announced)
In Korea you may also contact the Personal Information Dispute Mediation Committee (1833-6972, www.kopico.go.kr), the Privacy Infringement Report Center (118, privacy.kisa.or.kr) or the National Police Agency Cyber Bureau (182).
11. Changes
Changes to this policy are announced in the app and on this page at least 7 days before they take effect (30 days for changes that materially affect your rights).