Privacy Policy

At a glance

Your email and your entries are the heart of it — beyond that we keep only the settings and logs the app needs to run (§1).
You can keep entries on your device only — then they are never stored on the server (§1).
Your entries are used for nothing beyond showing them back to you, and are never provided to anyone.
We do not collect your name, date of birth or phone number.
If you don't sign in for one year, your account and all entries are deleted (with 30 days' notice).

1. What we collect and why

Item	Used for
Email address	Signing in, identifying your account
Entries (time and state)	Showing your calendar and stats, syncing across devices — depends on where you store entries (below)
Language & time zone, notification settings	App language, the basis for dates and reminder times, showing notifications
Ad view history	Granting "ad-free days", preventing abuse
Referral relationships	Granting referral rewards
Device info (OS version and model)	Reproducing and fixing bugs
Device identifier	Preventing referral-reward abuse — we never store the raw value, only an irreversible hash
Sign-in times	Deciding when to delete an account unused for over a year
App open history (date, hour, count, time spent)	Understanding how much the service is used — it never includes what you logged
Feedback you send	Replying to you (only when you send it)

Stored on the server whichever you choose: Email address, language, time zone and notification settings, ad view history, referral relationships, device info, device identifier, last access time, app open history, feedback.
Not stored on the server if you choose device-only: Only your entries (time and state). Anything already on the server is deleted the moment you switch. They pass through the server only while "Email my records" builds your file, and are discarded right after.
An entry holds only a time and a state. No notes, photos or location.
We do not collect your name, date of birth or phone number.
We do not collect advertising IDs or location.
The device identifier is used only to prevent referral-reward abuse — to stop one person claiming it repeatedly by changing email addresses. We never store the raw value, only an irreversible hash, and it is never used for ads or tracking.
App open history contains only the date, hour, count and time spent of your app opens. It is kept even if you choose device-only storage, but it never includes what you logged.
We do not knowingly collect personal data from children under 14.

2. Your entries are sensitive personal information

Entries are health data, so we ask for your consent separately when you choose to store them on the server (Article 23 of the Korean Personal Information Protection Act).
Without that consent your entries are not stored on the server — you can still use the app with on-device storage. Deleting your account withdraws the consent and deletes your entries immediately.
Entries are shown only on your own screen. Our admin screens show totals such as counts and date ranges, never the content.
If you choose device-only storage, we hold no health data on our servers (entries pass through only while "Email my records" builds your file, and are discarded right after).

3. How long we keep it

If you delete your account: your entries, ad view history and feedback are deleted immediately. This cannot be undone.
After one year without signing in: your account and all entries are deleted automatically. We email you 30 days beforehand, and opening the app once cancels it.
If you choose device-only storage: your entries are not kept on the server. Any entries already on the server are deleted the moment you make that choice.
App open history: deleted automatically after 13 months, and immediately if you delete your account.
How we delete: removed from the database immediately, with no way to restore.
Backup copies: we back up the whole database daily for disaster recovery. Copies that may still contain deleted information are destroyed automatically within 90 days.
Exceptions: we keep a one-way hash of your email so the sign-up bonus cannot be claimed repeatedly (the address cannot be recovered from it), and we keep referral relationships so referral rewards cannot be claimed repeatedly (they hold no personal information — only account identifiers and the referral code). If the account has entered a referral code, we also keep a one-way hash of the device identifier for the same purpose (the identifier cannot be recovered from it; if no code was entered, it is deleted with the account).

4. Who else sees it

We do not provide or sell your data to third parties.
We rely on only what running the app requires — Google AdMob (showing ads) and Amazon Web Services (hosting and sending our email).
Google's servers are outside Korea (in the United States and elsewhere), so an overseas transfer happens to that extent. Only what ads need is transferred — never your entries. These transfers rely on Google's Standard Contractual Clauses.
Amazon Web Services is used in the Seoul region only. Your account and entries are stored there, and sign-in codes and notices are sent from there. When you ask us to email your entries, the attached file passes through it too. Nothing leaves Korea.
Your entries are stored in the Republic of Korea. If you are in Europe, no extra safeguard is needed for that transfer — the European Commission has recognised Korea as providing an adequate level of protection (adequacy decision, December 2021, reaffirmed July 2026).
Ads may use an advertising ID. You can turn off personalised ads in your device settings.

5. Our legal basis for processing

If you use the app outside Korea, we must tell you the legal basis for each kind of processing.

Your entries (health data): Explicit consent, asked separately when you choose server storage (GDPR Art. 9(2)(a) · Korea PIPA Art. 23).
Email and sign-in: Performance of a contract — needed to create your account and sign you in (GDPR Art. 6(1)(b)).
Language, time zone, notification settings: Performance of a contract — needed for the app to work correctly.
Ads and advertising ID: Consent, asked when you first open the app. You can turn it off in your device settings at any time.
Abuse prevention: Legitimate interests — preventing repeated sign-up bonuses (GDPR Art. 6(1)(f)).

6. Your rights

You may request access, correction, deletion, restriction of processing, or suspension of processing at any time.
Get a copy of your data: Tap Settings → Email my records and we'll send your full history as a CSV file. It opens in any spreadsheet app and can be moved to another service.
Restriction and objection: You can ask us to pause processing or object to it. Write to the address below.
Withdrawing consent: You can withdraw consent at any time. Processing before withdrawal remains lawful, and we stop processing afterwards. Deleting your account also withdraws consent.
In the app: edit or delete entries from the list, delete your whole account under Settings → Delete account, and turn notifications off under Settings → Notifications.
Anything else: write to the address below and we will handle it without undue delay (within 30 days at the latest). You can also request deletion there if you cannot use the app.
We do not carry out automated decision-making or profiling.

7. How we keep it safe

Traffic is encrypted with TLS (HTTPS).
Auth tokens are kept in the device's secure storage; one-time codes, the re-signup hash of your email and the device identifier are stored only as hashes.
Data is separated per user so no one can reach another user's entries.

8. Contact and help

Contact: STARWIDE Co.,Ltd. Development Team (Privacy Officer) / starwide [at] starwide.co.kr / +82-31-465-3918 / 1F, 40-10 Bakdal-ro 557beon-gil, Manan-gu, Anyang-si, Gyeonggi-do, Republic of Korea
Your right to complain: Telling us first is usually quickest, but you can always complain directly to the supervisory authority where you live. United Kingdom: Information Commissioner's Office (ico.org.uk) / Australia: Office of the Australian Information Commissioner (oaic.gov.au) / New Zealand: Office of the Privacy Commissioner (privacy.org.nz) / Singapore: Personal Data Protection Commission (pdpc.gov.sg) / European Union: your national data protection authority (edpb.europa.eu) / Korea: Personal Information Dispute Mediation Committee +82-1833-6972 (www.kopico.go.kr) · Privacy Infringement Report Centre 118 (privacy.kisa.or.kr)
If this policy changes, we announce the effective date and what changed in the app and on the web page beforehand.

Effective date: 1 August 2026