Privacy Policy

This is a translation for convenience. The Korean-language version is the official and legally binding version.

Service name: Balbadak · Effective date: August 21, 2026 (amended) · Previous effective date: June 15, 2026

Balbadak (hereinafter the "Service") complies with the Personal Information Protection Act (PIPA) of Korea and related laws, and establishes the following privacy policy to protect users' personal information.

1. Personal Information Collected and Methods of Collection

Category	Items	Time of Collection
Social login	Email address, social account identifier, profile name	Upon Google/Apple login
Profile	Nickname (username), display name	Upon sign-up / profile setup
Location information	Location coordinates directly specified by the user when leaving a memo (footprint)	When writing a memo
Personal location information (optional)	The device's current location coordinates and travelled route ※ Collected only when the user actively turns on real-time location sharing	From the start until the end of location sharing
User-generated content	Memo title/description, comments, likes, visibility settings	While using the Service
Automatically collected	Device information, access logs, push notification token	While using the Service

※ When using the Service as a guest (non-member), no identifying information such as email is collected.

2. Purpose of Collection and Use of Personal Information

Member identification and login, provision of the Service
Storing and displaying location-based memos and sharing them among users (according to friend/group/visibility settings)
Displaying current location and travelled route to group members, only where the user has actively turned it on (real-time location sharing)
Providing social features such as comments and likes
Sending notice alerts, responding to inquiries, and improving the Service

3. Retention and Use Period

Upon withdrawal of membership or achievement of the purpose of collecting and using personal information, the information is destroyed without delay. The specific retention and destruction criteria are as follows.

Category	Retention Period / Time of Destruction
Account/profile (username, display name)	Anonymized immediately upon membership withdrawal
Memos/comments deleted by the user	Made private immediately upon deletion, then permanently and irrecoverably destroyed after 30 days (a grace period for recovery from accidental deletion)
Content isolated due to being reported	Kept in an access-blocked state until review is completed for compliance with relevant laws and dispute resolution, then destroyed
Automatically collected information such as access logs	3 months from the date of collection
Current location and travelled route from real-time location sharing	Destroyed immediately when sharing ends (manual stop or expiry)
Records confirming the use/provision of location information	6 months, pursuant to Article 16(2) of the Act on the Protection and Use of Location Information (coordinates are not included)

Where there is a separate retention obligation under relevant laws (such as the Act on Consumer Protection in Electronic Commerce and the Protection of Communications Secrets Act), the information is retained for the applicable period.

4. Provision of Personal Information to Third Parties

The Service does not provide users' personal information to external parties. However, in the following cases information is displayed to other users according to the user's own settings and consent.

Memos and comments written by a user: displayed according to the visibility setting chosen by the user (only me / friends / group / public)
Current location and travelled route from real-time location sharing: only where the user has separately consented and actively turned it on, displayed solely to approved members of the group chosen by the user, until sharing ends

5. Outsourcing of Personal Information Processing and Overseas Transfer

For the operation of the Service, personal information is outsourced for processing as follows, and some information is stored and processed overseas.

Trustee	Country of Transfer	Outsourced Work	Items Transferred
Supabase, Inc.	Japan (Tokyo, servers) / United States (headquarters)	Database and authentication hosting	All account and content data
Vercel, Inc.	United States	Application hosting	Access logs
Google LLC	United States	Social login, map services	Email and account identifier

Time/method of transfer: transmitted over the network while using the Service · Retention period: until termination of the outsourcing contract or membership withdrawal

6. Processing of Location Information

The Service's processing of location information is clearly divided into the following two categories.

(1) Default — the location of a memo (footprint)

The Service stores only the location directly specified by the user for the purpose of writing a memo. The "my current location" shown on the map is used only within the device and is not stored on the server. Within this scope, the user's real-time location is not continuously collected or tracked.

(2) Optional — real-time location sharing (separate consent required)

Only where the user actively turns on location sharing in a group, the Service collects the device's current location and travelled route until sharing ends, and displays them to approved members of that group.

Prior consent: Separate consent to the collection, use, and provision of location information is obtained on first use. Users who do not consent may still use all other features of the Service.
Collection period: Limited to the period from the start of sharing to its end; sharing ends automatically once the duration set by the user (maximum 12 hours) elapses or the user turns sharing off.
Notice of background collection: Recording continues while sharing is on even if the app screen is off. In that case, a notification indicating that sharing is in progress remains displayed in the device's status bar, and to save battery, location is recorded only after the device has moved a certain distance.
Immediate destruction: When sharing is turned off or the time expires, the travelled route is deleted immediately.
Withdrawal of consent: Consent may be withdrawn at any time in the app under [My Info] → [Withdraw Location Sharing Consent]; upon withdrawal, any sharing in progress ends and stored routes are destroyed.

Details concerning real-time location sharing are set out in the Location-Based Services Terms of Use. The Service completed its location-based services business filing on August 13, 2026 in accordance with the Act on the Protection and Use of Location Information.

7. Rights of Users and Legal Representatives

Users may at any time request to access, correct, delete, or suspend the processing of their personal information. Membership withdrawal can be processed directly within the app under [My Info] → [Withdraw Membership]; upon withdrawal, identifying information such as the username and display name is anonymized immediately, and the memos and comments written by the user are made private and then destroyed. Other requests may be submitted to the contact below. Sign-up by children under the age of 14 is restricted.

8. Destruction of Personal Information

Upon the lapse of the retention period or achievement of the processing purpose, electronic files are destroyed in an irrecoverable manner. Content deleted by a user is automatically destroyed after a 30-day grace period for recovery from accidental deletion, and upon membership withdrawal, identifying information is anonymized immediately.

9. Personal Information Protection Officer and Location Information Manager

Role	Name	Contact
Personal Information Protection Officer	박미혜 (Mihye Park)	olin00002@gmail.com
Location Information Manager	안현진 (Hyeonjin An)	pazorigi@naver.com

Business operator: 박미혜 (Mihye Park) · Business registration no. 750-11-00547 · 116, 1F-A, Yeonsu Prugio Complex 1, 130-3 Beotkkot-ro, Yeonsu-gu, Incheon, Republic of Korea

Remedies for Infringement of Rights

If you need consultation or wish to report a privacy infringement, you may contact the following organisations.

· Personal Information Dispute Mediation Committee: 1833-6972 / www.kopico.go.kr
· Privacy Infringement Report Center: 118 / privacy.kisa.or.kr
· Supreme Prosecutors' Office Cyber Investigation Division: 1301 · National Police Agency Cyber Bureau: 182

10. Duty of Notification

This policy takes effect on August 21, 2026, and in the event of any additions, deletions, or modifications to its contents, notice will be given 7 days prior to the effective date.

Revision history: Enacted June 15, 2026 · Amendment announced August 14, 2026 (effective August 21, 2026) — Articles 1, 2, 3, 4, 6, and 9 amended in connection with the introduction of real-time location sharing

View Terms of Service · View Location-Based Services Terms · Back to Balbadak