Privacy Policy

1. Purposes of Processing Personal Information

The Company processes personal information for the following purposes. If a purpose changes, the Company will obtain separate consent as required by law.

• Membership registration and management: identifying users through Google or GitHub accounts, keeping users signed in, preventing misuse, and processing membership withdrawal
• Providing the Service: Installability Checks for registered apps, providing tester lists, installing and launching apps on devices, and providing progress records and final reports (AI — Anthropic Claude or OpenAI Codex — is used to check apps' first-launch screens and create usage patterns, and to summarize records for final reports)
• Payments and refunds: processing fee payments, managing payment history, and processing refunds
• Customer support: receiving and answering inquiries, handling extension and refund requests, and keeping records of dispute handling
• Service notifications: dashboard notifications about check results, payments, test progress, and more
• Measuring advertising effectiveness: checking whether visits from ads led to payments (see section 11)

2. Personal Information Processed

The Company does not itself store payment method information such as card numbers; it is processed by the payment service provider. When you pay from outside the Republic of Korea, you pay in the checkout of our reseller Paddle; the name, country, and payment method information you enter directly in the Paddle checkout is processed by Paddle under its own privacy policy, and the Company does not receive it.

The package name, app name, screenshots, and launch records of apps registered by users are information about the apps. Because the Company runs apps only with Tester Accounts owned by the Company, it takes care that no personal information of users or of the apps' users is included. However, if an app displays third-party information on screen, that information may be included in screenshots and on-screen text. The Company advises users to prepare a test environment without real user data; any information that is nevertheless included is processed only within the scope of providing the Service and is destroyed together with the screenshots when the test ends (up to 4 screenshots per app, such as the first-launch screens shown in the final report, are kept until the member withdraws).

The Company does not collect personal information of children under the age of 14, and persons under 14 may not become members.

3. Processing and Retention Periods

The Company destroys personal information without delay when a member withdraws. Screenshots of registered apps are deleted when the test ends and the app is closed, except up to 4 per app (such as the first-launch screens shown in the final report), which are deleted upon withdrawal, and dashboard notifications are deleted after 30 days. However, the following information is retained for the periods set by applicable laws and then destroyed.

4. Procedures and Methods of Destruction

Personal information whose retention period has ended or whose processing purpose has been achieved is destroyed without delay. Information that must be retained by law is stored separately from other information.

• Electronic files: permanently deleted using methods that make recovery impossible
• Paper documents: shredded or incinerated

5. Provision of Personal Information to Third Parties

The Company processes users' personal information only within the scope of the purposes in section 1, and does not provide it to third parties except with the user's consent or where specifically provided by law.

6. Outsourcing of Personal Information Processing

To provide the Service, the Company outsources personal information processing as follows. In its outsourcing contracts, the Company specifies compliance with personal information protection laws, restrictions on re-outsourcing, safeguards, liability for damages, and other matters, and supervises whether processors handle personal information securely.

If a processor changes, the Company will give notice through this Privacy Policy.

7. Transfer of Personal Information Overseas

To provide the Service, the Company transfers personal information overseas for processing as follows. This constitutes outsourcing and storage necessary to perform a contract under Article 28-8(1)(3) of the Personal Information Protection Act.

Users may refuse the overseas transfer. However, because the transfers above are essential to providing the Service, refusing requires withdrawing membership, and the Service cannot be used.

8. Rights and Obligations of Users and How to Exercise Them

• Users may at any time request access to, correction of, deletion of, or suspension of processing of their personal information.
• Users may withdraw their membership directly from their account settings.
• Other requests can be made through Support in the dashboard or by emailing the Chief Privacy Officer, and the Company will take action and notify the user of the outcome within 10 days of receiving the request.
• Rights may also be exercised through a legal representative or a person authorized by the user. In this case, a power of attorney must be submitted.
• Deletion cannot be requested for personal information that other laws require to be retained.

9. Measures to Ensure the Security of Personal Information

• Administrative measures: keeping the number of people who can access personal information to a minimum
• Technical measures: encryption in transit (HTTPS), separation of database access privileges and row-level access control, and retention of access records
• Physical measures: servers storing personal information are operated in data centers with the processors' security certifications

10. Actions in the Event of a Personal Information Breach

If the Company becomes aware that personal information has been leaked, it will, in accordance with Article 34 of the Personal Information Protection Act and without delay (within 72 hours unless there is a justifiable reason), notify users of the items leaked, when and how the leak occurred, what users can do to minimize damage, the Company's response and remedy procedures, and the department and contact information for reporting.

If the leak exceeds the scale set by law or involves sensitive information, the Company will also report it to the Personal Information Protection Commission or the Korea Internet & Security Agency (KISA) and take measures to minimize damage.

11. Installation, Operation, and Refusal of Automatic Collection Tools

The Company uses cookies and browser storage (local storage) to keep users signed in and to display the most recent sign-in method (Google or GitHub) on screen.

The Company uses the Google Ads tag to measure advertising effectiveness. To check whether a visit that came from clicking an ad led to a payment, this tag stores an ad-click identifier in a cookie, and when a payment is completed it sends the order number and payment amount to Google. Information that directly identifies users, such as name or email, is not sent.

The Company uses Vercel Web Analytics to understand how often pages are viewed. It does not use cookies, and it aggregates visited page URLs, referral sources, device and browser types, and countries in a form that cannot identify individuals.

Users can refuse cookies in their browser settings. However, if cookies are refused, sign-in cannot be maintained and the dashboard cannot be used. To block only advertising cookies, users can turn off personalized ads in Google Ad Settings (adssettings.google.com).

12. Chief Privacy Officer

The Company designates the following Chief Privacy Officer to oversee personal information processing and to handle user complaints and remedies for damage.

13. Remedies for Infringement of Rights

If you need a remedy for an infringement of your personal information, you can apply for dispute resolution or counseling to the following organizations in the Republic of Korea.

• Personal Information Dispute Mediation Committee: 1833-6972 (no area code, within Korea) · www.kopico.go.kr
• Personal Information Infringement Report Center: 118 (no area code, within Korea) · privacy.kisa.or.kr
• Supreme Prosecutors' Office: 1301 (no area code, within Korea) · www.spo.go.kr
• Korean National Police Agency: 182 (no area code, within Korea) · ecrm.police.go.kr

14. Changes to This Privacy Policy

If this Privacy Policy changes, the Company will give notice on the Service from 7 days before the change takes effect. Changes that materially affect users' rights will be announced from 30 days before.