Privacy Policy
1. Overview
The operator handles members' personal information according to this policy. Authors, as sellers of paid subscriptions, handle the payment information they receive from PayPal on their own responsibility.
We don't ask readers for national ID numbers or sensitive information, and we don't use automated decisions or advertising profiles.
2. Information we handle
- Sign-up and login: email, password hash (we don't store your actual password), display name. With Google sign-up: Google account identifier, email, name and profile image.
- Subscriptions and payments: PayPal subscription ID and payer ID, product, amount, currency, tax and fees, payment and refund times, subscription status. We don't receive card or bank account numbers.
- Consent records: type and version of consent, time, IP address, the wording and price shown, country, language and time zone.
- Paid reading records: member, post and time. These are kept when a paid post is delivered, regardless of analytics consent.
- Analytics: every view records the post, channel and time. Only readers who consent also have their member ID, analytics session ID, referral source, country, device and read depth recorded.
- Security: login sessions and hashed IP addresses of login, sign-up and password reset requests. We don't store the original IP address of these requests.
- Activity: comments, likes, reports (including the email of reporters who aren't logged in) and restriction records.
- Email logs: type of email, recipient member and time sent.
- Authors: channel information, contact email, and report or registration documents.
- Creator applications: pen name, contact email, bio, channel plan (name, topic, publishing schedule, desired price, writing languages), portfolio link, sample posts, report, business and credential documents for investment channels, and when you agreed. The operator's review notes and decision.
- Hosting access logs: our hosting company handles IP addresses and browser information while serving the site.
- Inquiries: the email address for our reply, the inquiry type and message, and any image you attach. If you send it while logged in, we also receive your member ID and sign-up email.
3. Why we use it
- Identifying members, keeping you logged in and protecting accounts
- Providing subscriptions, checking access, and handling payments, refunds and disputes
- Sending subscription start, failed payment, yearly renewal and password reset emails. We don't send marketing email.
- Keeping evidence of consent and auto-renewal, and meeting tax and legal duties
- Tracing leaks of paid posts and preventing mass collection, and, if multiple authors join, as a basis for sharing all-access revenue (reading records)
- Blocking password guessing and excessive requests (hashed IP addresses)
- Statistics for authors and service improvement (readers who consent)
- Answering inquiries and handling copyright infringement reports
- Reviewing creator applications and telling applicants the result
4. How long we keep it
- Account information: until you close your account, when we delete your profile and login information.
- Contract, payment, refund and withdrawal records: 5 years. Consumer complaint and dispute records: 3 years.
- Auto-renewal consent records: at least 3 years or 1 year after cancellation, whichever is longer. Other consent records and email logs: 5 years.
- Raw analytics: deleted within 25 months. Daily totals that can't identify individuals are kept.
- Paid reading records: linked to your account until you close it, when we remove the link.
- Login sessions: up to 30 days. Password reset links: 1 hour.
- Hashed IP addresses: deleted within 1 hour after the limit period ends.
- Comments: when you close your account, the writer is shown as "Deleted user" and the text remains.
- Likes: deleted when you close your account.
- Inquiries: 3 years after we finish replying, in the operator's mailbox.
- Creator applications: a rejected application is deleted with its documents, files and review notes 1 year after the review ends. An approved application is kept while the channel runs. When you close your account, applications that weren't approved and their documents are deleted right away.
6. Service providers and transfers abroad
We use the companies below to run the service, and information is transferred abroad over the network while you use it.
- Vercel (USA): site hosting, access logs, country and time zone lookup
- Supabase (servers in Singapore): database storage
- Cloudflare R2 (servers in Asia-Pacific): image and file storage
- Resend (USA): sending notices and inquiry emails, including email address and message content
- Google (USA): authentication for members who choose Google login
Information is kept until you close your account or the contract with the provider ends. If you don't want this, you can close your account, and you won't be able to use the service. [Provider contact details: to be stated after professional review]
8. Your rights
You can ask to access, correct, delete or stop processing your information, and withdraw consent, at any time. A legal representative or someone you authorize can also ask.
You can make requests in My Page or through the contact below, and receive your profile, subscription and payment history, comments, likes, consent records and creator applications as a file. Records the law requires us to keep can't be deleted during that period.
9. Deletion
When the retention period ends or the purpose is met, we delete information promptly so it can't be restored. Information kept by law is managed separately.
10. Security measures
- Encryption in transit and hashed passwords
- Row-level access restrictions in the database
- Documents kept in private storage and opened through links valid for 5 minutes
- Two-step authentication for the operator and logs of operator actions
11. Children under 14
Children under 14 can't sign up. If we learn of such an account, we delete it.
12. Members in the EU and UK
The operator is the data controller. Our legal bases are:
- Contract: accounts, subscriptions and notices
- Legal obligation: tax and consumer protection records
- Legitimate interests: security, leak tracing and preventing mass collection
- Consent: analytics
You have the rights of access, rectification, erasure, restriction, portability and objection, and you can complain to the supervisory authority in your country. Safeguards for transfers abroad: [to be stated after signing data processing agreements]
13. Members in Taiwan
The collector, purposes, data types, and the period, region, recipients and methods of use are described above. You can request inquiry, review, copies, correction, an end to collection, processing or use, and deletion. Without the required information, you can't sign up or subscribe.
14. Privacy officer
송선호, Representative. Please send privacy questions to the contact below.
15. Remedies in Korea
- Personal Information Infringement Report Center: 118
- Personal Information Dispute Mediation Committee: 1833-6972
- Supreme Prosecutors' Office: 1301
- National Police Agency: 182
16. Changes to this policy
We post changes in Notices at least 7 days before they take effect. Important changes are posted at least 30 days ahead and also sent by email.