하루동화 Privacy Policy
Version 1.0 · Effective April 22, 2026 · Service 하루동화 · Operator GIUN Labs
⚠️ This document is a draft and will be reviewed by legal counsel before launch.
1. Overview
하루동화 (the "Service") is an AI-powered illustrated diary for elementary school students. Use of the Service requires the registration and consent of a legal guardian (parent) for users under 14 years of age. This policy complies with the Korean Personal Information Protection Act, COPPA (US), GDPR-K (EU), and related laws.
2. Information We Collect
2.1 Legal Guardian (Parent) Information
- Required: email address, name, social login identifier (Kakao/Google/Apple ID)
- Optional: parent's mobile phone number (for child safety alerts)
2.2 Child Information (collected after parental consent)
- Required: name (or nickname), date of birth, gender
- Service usage records: diary entries, AI analysis results, generated images, mood/weather selections, uploaded photos
- Preferences: favorite pet companion, illustration style
2.3 Automatically Collected Information
- Device information, OS version, app version
- Service usage logs, access timestamps
3. Purposes of Collection
- Provide the AI illustrated diary service for children (summary, keywords, image generation)
- Parent safety alerts (when violence, self-harm, or bullying signals are detected)
- Subscription billing and refunds
- Service quality improvement and error handling
4. Retention and Use Period
- Upon account withdrawal, all data is immediately destroyed
- Diary content is readable only by the child
- If retention is required by relevant laws, data is stored separately for the required period
| Item | Period | Legal Basis |
|---|
| Records on contracts and subscription withdrawal | 5 years | E-commerce Act |
| Records on payment and supply of goods | 5 years | E-commerce Act |
| Records on consumer complaints or dispute resolution | 3 years | E-commerce Act |
| Access logs | 3 months | Communications Privacy Act |
5. Special Provisions for Children Under 14
5.1 Legal Guardian Consent
- At signup, we collect the legal guardian's email or social login plus explicit consent
- Material changes after signup require re-consent from the legal guardian
5.2 Child Data Protection
- Children's diary content is not directly readable even by the legal guardian
- However, when a safety flag is triggered, the legal guardian is notified via KakaoTalk message
- Third-party advertising is fully prohibited
- Selling children's personal information to third parties is fully prohibited
5.3 Exercising Your Rights
The legal guardian may, at any time, request:
- Access to the child's personal information
- Correction or deletion
- Suspension of processing
- Account withdrawal (→ all data immediately destroyed)
6. Disclosure to and Outsourcing with Third Parties
6.1 Outsourced Vendors
| Vendor | Scope |
|---|
| Google LLC | AI analysis (Gemini), image generation (Imagen) |
| Google Cloud | Server infrastructure, image storage |
| Cloudflare | DNS, CDN |
| RevenueCat | Subscription billing |
| Solapi | Parent KakaoTalk notifications |
6.2 International Transfers
- Google LLC (United States): diary text transferred for AI analysis (de-identified)
- Timing: at the moment a diary is written
- Method: HTTPS encryption
7. Security Measures
- Data in transit: HTTPS (TLS 1.3)
- At rest encryption: JWT secret key, parent PIN (bcrypt)
- Access control: role-based permissions, log monitoring
- Server: Google Cloud, asia-northeast3 region
8. Cookies and Automatic Collection
The Service is delivered as a mobile app and does not use web cookies. The mobile app uses only secure storage to keep the user logged in.
9. Privacy Officer
| Field | Detail |
|---|
| Name | Jongkeun Baek |
| Affiliation | GIUN Labs Engineering |
| Email | [email protected] |
10. Remedies for Rights Infringement
- Personal Information Protection Commission (Korea): privacy.go.kr / 182
- Personal Information Dispute Mediation Committee: kopico.go.kr / 1833-6972
11. Policy Changes
If this policy changes, we will notify users in-app and via the legal guardian's email at least 7 days in advance. Material changes require re-consent.