Article 1 (Purposes of Processing)
The Company processes personal information for the following purposes only. It will not be used for any other purpose; if a purpose changes, the Company will obtain separate consent or take other measures required under Article 18 of the Act.
1. Account identification and management: to identify users who sign in with a Google account or an Apple Account and manage the data that belongs to the account (works, characters, subscriptions).
2. Providing the Service: to store the stories, characters, scenes and images users create, keep them in sync across devices, and show published works to other users and web-reader visitors.
3. AI features: on request, to suggest the next line, infer a character's personality and emotion, and generate cover and scene-background images.
4. Notifications: to send push notifications for comments on your works, new episodes from writers you follow, and reactions received the previous day.
5. Support: to receive and answer inquiries.
6. Stability and improvement: to detect errors and analyze usage statistically.
7. Preventing misuse and protecting users: to prevent violations of the Terms and fraudulent use of the Service, to handle users' reports and blocks, and to check comments and published episodes automatically so that prohibited content is not posted.
8. Managing paid plans and packs: to verify that a subscription (Plus, Studio, Max, Direct connection) or a pack (additional uses) paid for through Google Play or the App Store is valid, provide its benefits, and reflect renewal, cancellation, refund and usage status.
9. Rewarded ads: when a user who has used up the free allowance chooses to, to show an ad, confirm it was watched to the end, and add AI suggestions.
10. Direct connection: to process a user's AI requests with the AI provider API key that user registered.
Article 2 (Personal Information Collected and How)
The Company processes the following personal information.
1. On sign-in: with a Google account, social ID (Google account identifier), email address, name and profile photo; with an Apple Account, social ID (Apple Account identifier), email address (the forwarding address Apple creates if the user chooses Hide My Email) and name (if the user shares it on first sign-in)
2. On profile edit (entered by the user): name, one-line intro, profile photo
3. Content the user creates while using the Service: work title, genre, mood and concept; episodes (dialogue, narration, description); characters (name, description, personality); scenes (name, synopsis, background); photos, background music and sound effects the user attaches; AI-generated cover and background images
4. Information generated or collected automatically during use: push notification token (FCM token; on iOS, FCM also uses the Apple Push Notification service (APNs) device token; only while signed in), app usage records (screen views, feature use and similar events), device information (device model, OS version, app version), IP address, access time, service activity (subscriptions, likes, comments, reactions)
5. On inquiry: account identifier, the inquiry text, and — if the user pastes it via "Copy version info" — device model, OS version and app version
6. Web-reader visitors (outside the app): a random anonymous identifier stored in the browser, whether the episode was read to the end, the emoji reaction left, IP address and access time
7. When using paid plans or packs (Google Play or App Store in-app purchase): the Google Play purchase identifier (purchase token) or the App Store transaction identifier (including the original transaction identifier), product ID, plan type, subscription expiry date, subscription status (active, cancelled, expired, refunded), and each pack's amount purchased and amount used. Payment methods, card numbers and billing addresses are handled by Google Play or Apple and are not collected by the Company.
8. When using rewarded ads: the advertising identifier (the Android advertising ID; on iOS the app does not request tracking permission, so the advertising identifier (IDFA) is not available), device information, IP address and ad request, viewing and interaction records, collected directly in the app by Google AdMob, which shows the ad. The Company's server keeps only the account identifier, the ad transaction identifier and the time the reward was added.
9. When using direct connection: the AI provider API key the user enters (stored encrypted; the app shows only its last four characters), and the model and image quality the user chooses
10. When reporting or blocking: the reporting Member's account identifier, the reported item (work, comment or Member) and reason, a copy of the reported item at the time of the report (title, intro, comment text), and the list of Members a Member has blocked
How it is collected: through the user signing in, typing, attaching files and sending inquiries in the app, and through data the app and server generate automatically during use.
For users who are not signed in (guests), the Company does not send story data stored on the device to the server and does not collect account information. When a guest signs in, the stories written on that device become that account's and are synced to the server.
Article 3 (Retention Period)
The Company retains personal information for the period required by law or agreed to at the time of collection.
1. Account information and user-created content: until the account is deleted. On account deletion it is destroyed without delay. However, the identifier of a deleted account (the sign-in account email) is converted to an irreversible form (hash) and kept for 1 year from the date of withdrawal to recognize re-registration and prevent misuse, then deleted.
2. Push notification token: deleted immediately on sign-out or account deletion.
3. Inquiries: kept for up to 1 year after the inquiry is resolved, then destroyed.
4. Web-reader read and reaction records: kept with the anonymous identifier and destroyed together with the work they belong to when that work is deleted.
5. Paid plan and pack information: destroyed when the account is deleted, except that the e-commerce records in item 9 are kept for the period stated there.
6. Rewarded-ad reward records (ad transaction identifier and time): destroyed when the account is deleted. Information collected by Google AdMob is governed by Google's Privacy Policy.
7. Direct connection API key: destroyed immediately when the user deletes the key in the app or deletes the account.
8. Report and block records: the block list is destroyed when the account is deleted. A report remains with the reporter's identifier removed when the reporting Member deletes the account, and is destroyed when the reported Member deletes the account.
9. The following are kept for the period required by the applicable law:
- Records of contracts or withdrawal, payment and supply of goods under the Act on the Consumer Protection in Electronic Commerce (payment, renewal and refund records for paid plans and packs): 5 years
- Records of consumer complaints or dispute handling under the same Act: 3 years
- Service access logs (IP address, access time) under the Protection of Communications Secrets Act: 3 months
- Any other information a law requires to be kept: the period set by that law
Article 4 (Provision to Third Parties)
The Company processes personal information only within the scope stated in Article 1 and provides it to third parties only with the user's consent or where permitted by Articles 17 and 18 of the Act.
However, when a user publishes a work, the following becomes visible to other users and web-reader visitors. This is disclosure the user chooses by using the publish feature.
- The published work (title, cover, episode text, characters, images) and the writer's name, profile photo and one-line intro
- Comments the user leaves on other works, with the commenter's name
Unpublishing closes the link immediately and removes the work from the Explore tab. Copies already saved or captured cannot be recalled by the Company.
Article 5 (Outsourcing of Processing)
The Company entrusts the following processing to provide the Service.
- Amazon Web Services, Inc.: server operation and storage of data, images and audio files (Seoul region)
- Google LLC (Firebase): sign-in authentication (Google account and Apple Account), push notification delivery, app usage statistics
- Google LLC (Google Play): in-app billing for paid plans and packs, subscription verification and renewal, cancellation and refund notifications
- Google LLC (AdMob): serving rewarded ads, confirming ad views
- Apple Inc.: Apple Account sign-in (Sign in with Apple), App Store in-app purchase processing, subscription verification and renewal, cancellation and refund notifications, iOS push notification delivery (APNs)
- OpenAI, L.L.C.: AI line suggestions, character personality and emotion inference, cover and background image generation, description of attached images, automated checks of comments and published episodes for prohibited content
In accordance with Article 26 of the Act, the Company's agreements with these processors specify the prohibition of processing beyond the entrusted purpose, technical and administrative safeguards, restrictions on sub-processing, supervision and liability, and the Company supervises whether they handle personal information safely.
Article 6 (Cross-Border Transfer)
The Company transfers personal information abroad as follows in order to provide the Service.
1. Google LLC (United States)
- Items: social ID, email address, name, profile photo (authentication); push notification token (notification delivery); app usage records and device information (usage statistics); Google Play purchase identifier (paid plan and pack verification); advertising identifier, device information, IP address, ad usage records and account identifier (rewarded ads)
- When and how: transmitted over the network at sign-in, when notifications are sent, while the app is used, when paid plans or packs are purchased or verified, and when the ad prompt opens after the free allowance is used up or an ad is watched
- Purpose: sign-in authentication (Google account and Apple Account, via Firebase), push notification delivery, app usage statistics, paid plan and pack verification, serving rewarded ads, confirming views and preventing fraud
- Retention: per Google's Privacy Policy (https://policies.google.com/privacy)
2. Apple Inc. (United States)
- Items: Apple Account identifier, email address and name (authentication); push notification token (iOS notification delivery); App Store transaction identifier (paid plan and pack verification)
- When and how: transmitted over the network when the user signs in with an Apple Account, when notifications are sent to an iOS device, and when a purchase is made or verified in the App Store
- Purpose: Apple Account sign-in authentication, iOS push notification delivery, paid plan and pack verification
- Retention: per Apple's Privacy Policy (https://www.apple.com/legal/privacy/)
3. OpenAI, L.L.C. (United States)
- Items: the recent lines of dialogue and narration at the moment an AI feature is requested; character names, descriptions, personality and emotion state; the work's title, genre, mood and concept; photos attached to the scene (the original image the first time, an AI-written text description afterwards); and the text of comments and published episodes for prohibited-content checks. Account information such as email and name is not sent.
- When and how: transmitted over the network each time the user requests ✨ a suggestion, cover generation, background generation or personality inference, and when the user posts a comment or publishes an episode
- Purpose: next-line suggestions, character personality and emotion inference, cover and background image generation, description of attached images, automated prohibited-content checks
- Retention: per OpenAI's API data usage policies (https://openai.com/policies/api-data-usage-policies). The API the Company uses does not use transmitted data to train models.
- With direct connection: the items above are sent to the user's own OpenAI account together with the API key the user registered (for authentication); their processing and charges are governed by the terms and policies between the user and OpenAI.
Users can refuse the transfer to OpenAI for AI features by not signing in or not using AI features; the rest of the Service remains available. Posting a comment or publishing an episode, however, involves a transfer for the prohibited-content check. Refusing the transfer to the provider of the sign-in account (Google or Apple) means features that require sign-in (AI, publishing, subscriptions, reactions) cannot be used. Not watching rewarded ads does not limit any other feature.
Questions about cross-border transfers may be directed to the contact in Article 12.
Article 7 (Destruction of Personal Information)
The Company destroys personal information without delay once it is no longer needed — when the retention period ends or the purpose is achieved.
1. Procedure: when a user deletes the account in the app's Settings or requests deletion via the contact in Article 12, the Company destroys that account's information and content. When an account that signed in with an Apple Account is deleted, the Company asks Apple to revoke the app's sign-in authorization. Information that must be kept by law is stored separately and destroyed when the period ends.
2. Method: electronic records are deleted in a way that prevents recovery; images and audio files in storage are deleted with them. Comments, likes and reactions left on other users' works are stripped of account identifiers and comment text so the author cannot be identified, leaving only a placeholder.
3. Deleting the account also erases the story data stored on that device. Signing out does not delete the account, and story data on the device remains.
Article 8 (Rights of Users and Legal Representatives)
1. Users may at any time request access to, correction or deletion of, or suspension of processing of their personal information.
2. Name, one-line intro and profile photo can be edited directly in the app's Settings. The account can be deleted directly via "Delete account" in Settings.
3. Other requests can be made by email to the contact in Article 12; the Company will act on them without delay. For verification, please write from the email address used to sign in (or Apple's forwarding address, if you used one).
4. Rights may be exercised through a legal representative or an authorized agent. In that case a power of attorney in the form prescribed by the Notice on Methods of Processing Personal Information (Annex Form 11) must be submitted.
5. Requests for access and suspension of processing may be limited under Articles 35(4) and 37(2) of the Act.
6. Correction or deletion cannot be requested for personal information that another law designates as subject to collection.
Article 9 (Security Measures)
The Company takes the following measures to keep personal information secure.
1. Administrative: the number of people who handle personal information is kept to a minimum, and an internal management plan is established and followed.
2. Technical: all traffic between the app and the server is encrypted (HTTPS), and requests from signed-in users are verified with an authentication token issued by Google (Firebase). Access rights to processing systems are managed and access records are kept. The Company does not collect or store passwords (Google and Apple sign-in only). Direct connection API keys are stored encrypted (AES-256) and never written in plain text to responses or logs.
3. Physical: servers run in an access-controlled cloud data center (Amazon Web Services).
Article 10 (Automatic Collection Tools and How to Refuse)
1. The app uses Google Firebase Analytics for usage statistics. It automatically collects an app-instance identifier and usage events, which are not combined with the user's name or email. Advertising identifiers are not used.
2. The web reader stores a random anonymous identifier in the browser's local storage to record whether an episode was read to the end and the emoji reaction left. It does not identify the visitor by name and is removed when the browser's site data is cleared.
3. The Company does not use tracking cookies and does not serve advertisements users have not asked for (banners, interstitials).
4. The app uses Google AdMob for rewarded ads that users who have used up the free allowance choose to watch. AdMob loads an ad in advance when the ad prompt opens and collects the advertising identifier, device information, IP address and ad usage records to show the ad and to confirm views and prevent fraud. The Company does not request personalized ads (non-personalized ads only). Users can delete or reset their advertising ID in the device settings (on Android, Settings > Google > Ads, or Settings > Privacy > Ads). On iOS the app does not request tracking permission, so AdMob does not access the advertising identifier (IDFA).
Article 11 (Age Restriction)
1. The Service is available only to persons 18 years of age or older. The Company does not knowingly collect personal information from children under 14.
2. If the Company learns that personal information of a child under 14 has been collected, it will destroy it without delay. If you become aware of such a case, please contact us via Article 12.
Article 12 (Privacy Contact)
The Company has a Privacy Officer responsible for overall personal-information processing. Inquiries, complaints and requests for remedy are handled by the team below.
- Privacy contact: Chatgram Operations Team
- Email: chatgramcomms@gmail.com
Users may direct all inquiries, complaints and requests for remedy regarding personal information to this team. The Company will respond and act without delay.
Article 13 (Remedies for Infringement)
Users may seek dispute resolution or counseling from the following bodies in the Republic of Korea.
- Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
- KISA Personal Information Infringement Report Center: 118 (privacy.kisa.or.kr)
- Supreme Prosecutors' Office Cybercrime Investigation: 1301 (www.spo.go.kr)
- National Police Agency Cyber Bureau: 182 (ecrm.police.go.kr)
Article 14 (Changes to This Policy)
1. This Privacy Policy takes effect on November 3, 2026.
2. If it is added to, deleted from or amended due to changes in law, policy or the Service, notice will be given through the app's Settings screen at least 7 days before the effective date, or at least 30 days before for changes that materially affect users' rights.
3. Previous versions: v4.0 (announced 2026-10-02, replaced by this version before taking effect), v3.0 (effective 2026-10-16), v2.0 (effective 2026-09-14), v1.0 (effective 2024-07-01, English only)
Addendum
This Privacy Policy is effective from November 3, 2026.