Fortune Diary Privacy Policy
Effective Date: October 21, 2026
Version: 2.1.0
Nasapagym Co., Ltd. (hereinafter "Company") complies with the Personal Information Protection Act, the Act on Promotion of Information and Communications Network Utilization and Information Protection, and other applicable laws, and strives to protect users' personal information.
Article 1 (Personal Information Collected)
1. Required Items
| Item | Purpose of Collection |
|---|
| Email | Member identification, login, service notifications |
| Name (Nickname) | Display within the Service |
| Date of Birth | Ganji calendar calculation, personality analysis |
| Gender | Saju calculation, personalized service |
2. Optional Items
| Item | Purpose of Collection |
|---|
| Time of Birth | Accurate time pillar calculation |
| Profile Photo | Community profile display |
| Place of Birth | Accurate timezone calculation |
3. Information Collected During Service Use
- Diary content and mood records (text, 5-dimension mood scores)
- Photos and images (diary attachments, stored on Cloudflare R2)
- Photo EXIF metadata (location coordinates, capture time) - for photo timeline feature
- Community posts and comments
- Partner/family registration info (nickname, date of birth, relationship type)
- Point earning/usage history
- Streak (consecutive record) data
- Device information (OS, app version)
- Access logs, IP address
- Advertising identifier (only with ATT consent, Google AdMob integration)
Article 2 (Purpose of Collection and Use)
- Service Provision: Core services including diary writing, Ganji calendar, mood tracking, community, and photo timeline
- Member Management: Member identification, identity verification, prevention of fraudulent use
- Service Improvement: Service quality enhancement, new service development, usage statistics
- Marketing: Event and promotion notifications (with consent)
- AI Analysis Service: Picture diary, personalized daily advice, dream interpretation, monthly review and monthly insight, emotion analysis (with AI analysis consent)
- Ad Delivery: Personalized/non-personalized ads through Google AdMob (based on ATT consent)
- Location-Based Services: Timeline map display using photo EXIF location data
- Partner/Family Relationship Analysis: Comparative analysis of registered persons' energy profiles
Article 3 (Retention and Use Period)
- Member Information: Until account deletion (deleted immediately upon withdrawal)
- Diary Data: Until account deletion (deleted within 30 days of withdrawal)
- Photo Data: Until account deletion (deleted within 30 days of withdrawal)
- Community Posts/Comments: Deleted upon account deletion (reported content retained for 90 days)
- Partner/Family Registration Info: Deleted immediately upon deregistration or withdrawal
- Point/Streak Records: Deleted upon account deletion
- Advertising Identifier: Deleted immediately upon ATT consent withdrawal
- Access Logs: 3 months
- Marketing Consent Records: Until consent withdrawal
- AI Feature Results (picture diary images, advice, dream interpretations, monthly reviews and insights): Until account deletion (deleted within 30 days after deletion)
- Information Sent to the External AI Service: Retained by the processor for up to 30 days for abuse monitoring, then deleted
However, where retention is required by applicable law, data shall be retained for the applicable period.
| Retained Item | Retention Period | Applicable Law |
|---|
| Contract or subscription withdrawal records | 5 years | E-Commerce Act |
| Payment and goods supply records | 5 years | E-Commerce Act |
| Consumer complaint records | 3 years | E-Commerce Act |
| Access logs | 3 months | Protection of Communications Secrets Act |
Article 4 (Provision of Personal Information to Third Parties)
The Company does not, in principle, provide users' personal information to third parties. However, exceptions apply in the following cases:
- When the user has given prior consent
- When required by law
- When outsourcing within the scope necessary for service provision
Article 5 (Outsourcing of Personal Information Processing)
| Service Provider | Outsourced Task | Retention Period |
|---|
| Cloudflare (R2) | Image storage, CDN | Until account deletion |
| AWS (ECR/ECS) | Server hosting, database | Until account deletion |
| Firebase | Push notification delivery | Upon delivery completion |
| Google AdMob | Ad delivery | Upon ad session end |
| Apple (App Store) | In-app payment processing | Upon payment completion |
| OpenAI, L.L.C. (United States) | AI feature processing (picture diary images, advice, dream interpretation, monthly reviews and insights, emotion analysis, inappropriate-content checks) | Deleted after up to 30 days |
Article 5-2 (Overseas Transfer of Personal Information)
To provide AI features, the Company entrusts the processing of personal information to an overseas processor as follows.
| Item | Details |
|---|
| Recipient | OpenAI, L.L.C. (privacy contact: [email protected]) |
| Country | United States |
| Time and Method | Each time a Member uses an AI feature, sent over an encrypted network (HTTPS) |
| Items | Only what the feature in use needs: diary title, content and mood, attached photos (picture diary), dream descriptions, birth date, time and gender for saju calculation, and the relationship to a registered person (not their name). Account information that identifies the Member (name, email, phone number, member ID) is not sent. |
| Purpose | Generating AI feature results (picture diary images, advice, dream interpretation, monthly reviews and insights, emotion analysis, inappropriate-content checks) |
| Retention | The processor does not use the information to train AI models and deletes it after retaining it for up to 30 days for abuse monitoring. |
| How to Refuse | Do not give AI analysis consent, or turn it off in the app under Menu > gear (Settings) > AI analysis consent. Refusing only disables AI features; basic services such as writing diaries remain available. |
Article 6 (AI Analysis Service)
When a Member gives AI analysis consent, processing works as follows.
- Features: Picture diary, personalized daily advice, dream interpretation, monthly review and monthly insight, emotion analysis
- Processing: Only the information the feature needs is sent to the external AI service (Article 5-2) to create the result. Account information that identifies the Member (name, email, phone number, member ID) is not sent.
- No Training: The external AI service does not use the information to train AI models and deletes it after up to 30 days.
- Stored Results: Results are stored in the Member's account, provided only to the Member, and not used for advertising.
- Anonymous Statistics: Personalized advice may use anonymous, aggregated mood trends of Members sharing the same day pillar (10 or more people).
- Consent and Withdrawal: AI analysis consent is optional and can be turned off at any time in the app under Menu > gear (Settings) > AI analysis consent. After it is turned off, consent is asked again before using AI features, and existing results are hidden until consent is given again. Members may request deletion of results under Article 7.
Article 6-2 (Location Information Processing)
- The Service extracts location information (latitude, longitude) and capture time from EXIF metadata of photos attached to diary entries by the user.
- Location information is used solely for displaying travel routes on the map in the photo timeline feature.
- Location information is collected only when the user grants photo access permission on their device.
- Collected location information is stored on the server and deleted upon account deletion.
- Users who do not wish to share location information may use photos with location data removed when attaching photos.
Article 6-3 (Community Service)
- Posts and comments in the community are visible to other Members.
- When posting, the member's nickname and profile sticker are displayed to other users.
- Reported content is retained for up to 90 days for administrator review.
- When a report is filed, the reporter's member information and IP address are recorded.
Article 7 (User Rights)
- Right of Access: You may request to view your personal information
- Right of Correction: You may request correction of inaccurate personal information
- Right of Deletion: You may request deletion of your personal information
- Right to Suspend Processing: You may request suspension of personal information processing
- Right to Withdraw Consent: You may withdraw consent to personal information processing
Rights may be exercised through the in-app settings or customer center.
Article 8 (Measures to Ensure Security of Personal Information)
The Company takes the following measures to ensure the security of personal information:
- Administrative Measures: Establishment and implementation of internal management plans, regular employee training
- Technical Measures: Personal information encryption, access control management, security software installation
- Physical Measures: Access control to server rooms
Article 9 (Personal Information Protection Officer)
| Category | Information |
|---|
| Name | Jinwoo Choi |
| Position | CEO / Personal Information Protection Officer |
| Contact | [email protected] |
Article 10 (Changes to Privacy Policy)
This Privacy Policy may be amended in accordance with changes in laws, policies, or security technologies. Changes shall be announced at least 7 days in advance.
Article 11 (Remedies for Rights Infringement)
If you need to report or consult regarding personal information infringement, please contact the following agencies:
- Personal Information Infringement Report Center: (no area code) 118
- Personal Information Dispute Mediation Committee: 1833-6972
- Supreme Prosecutors' Office Cyber Investigation Division: (no area code) 1301
- National Police Agency Cyber Bureau: (no area code) 182
Addendum
This Privacy Policy shall be effective from October 21, 2026. (Previous version 2.0.0: effective April 15, 2026)