Privacy Policy

Last updated: May 27, 2026

Haru Studio (hereinafter "the Company") values the personal information of its users and complies with the Personal Information Protection Act (Korea) and other applicable laws. This policy applies to MyCurve (hereinafter "the Service").

1. Personal Information Collected

The Company collects the following personal information for account registration and service provision.

Required Items

• Account information: email address (automatically collected via social login), social login identifiers (Google, Apple, LINE)
• Weight records: weight, goal weight, and recording date entered directly by the user
• Service usage records: notes and other data entered by the user

Optional Items

• Profile information: nickname (entered directly by the user)
• Photos: photos taken or uploaded by the user for record-keeping
• Preferences: weight unit, language, text settings, and other values selected by the user

Automatically Collected Items

• Device information: device identifier, OS version, device model, language setting
• Log information: date and time of service access, usage history
• Advertising identifier: advertising ID (AAID, etc.) for ad delivery

2. Purpose of Collection and Use

1. Service provision: user identification, weight recording and management, graphs and statistics, goal management, photo recording, and cross-device synchronization
2. Customer support: responding to inquiries, handling complaints, delivering notices
3. Advertising: serving in-app ads and measuring ad performance
4. Legal compliance: preventing misuse, fulfilling obligations under applicable laws

3. Handling of Photos and Record Data

1. Photos uploaded by users are securely stored in a private storage system for cross-device synchronization and are accessible only by the respective user. They are not disclosed to any third party.
2. Weight records and other data entered by users are used solely for the purpose of providing the Service and are not shared externally without user consent.
3. Users may view or delete their photos and record data at any time within the Service. All such data is permanently deleted upon account deletion.

4. Retention and Duration of Use

1. Upon account deletion: immediately deleted (except where retention is required by law, in which case data is stored separately for the legally required period)
2. Retention required by law:
   • Protection of Communications Secrets Act (Korea): login records (3 months)
3. Record data entered by users: retained until the user deletes it or deletes their account

5. Disclosure to Third Parties

The Company does not, in principle, provide users' personal information to third parties. However, the following cases are exceptions:

1. When the user has given prior consent
2. When required by law or requested by an investigative authority in accordance with legally prescribed procedures

6. Outsourcing of Processing

The Company outsources personal information processing to the following service providers:

• Supabase, Inc. — database hosting, user authentication, photo storage
• Google LLC — social login (Google), advertising (AdMob)
• Apple Inc. — social login (Apple)
• LY Corporation (LINE) — social login (LINE)

These service providers process personal information securely in accordance with applicable privacy laws and this policy.

7. International Transfer of Personal Information

The Company transfers (stores) personal information overseas as follows for service provision:

• Recipient: Supabase, Inc.
• Country: data may be stored on cloud servers located outside Korea (Asia region, etc.)
• Items transferred: the items specified in Section 1 of this policy
• Purpose: database hosting, user authentication, photo storage
• Retention period: until account deletion or termination of the outsourcing agreement

By using the Service, users are deemed to have consented to the above international transfer. If you do not consent, use of the Service may be restricted.

8. Rights of Users and Legal Representatives

Users may exercise the following rights at any time:

1. Request to access personal information
2. Request to correct or delete personal information
3. Request to suspend processing of personal information
4. Request to delete account and personal information

These rights may be exercised through the "Settings" menu in the Service or by contacting us at the email address below.

9. Destruction Procedures and Methods

1. Destruction procedure: when a user requests account deletion, data is destroyed immediately. Where retention is required by law, data is stored separately and destroyed after the retention period expires.
2. Destruction method: electronic files are permanently deleted using methods that prevent recovery.

10. Security Measures

The Company takes the following measures to protect personal information:

• Encrypted storage and transmission of personal information (HTTPS/TLS)
• Private storage of photos with access restricted to the respective user
• Minimized access permissions and administrator authentication
• Installation of security software and periodic reviews

11. Advertising and Advertising Identifiers

1. The Company may display third-party advertisements (Google AdMob, etc.) within the Service.
2. Advertising identifiers (AAID, etc.) may be collected and used in the course of ad delivery. Users may reset their advertising identifier or limit personalized ads through their device settings.
3. The Company does not provide users' weight records or photo data for advertising purposes.

12. Children's Personal Information

This Service is not intended for children under the age of 14 and does not permit registration or use by children under 14. The Company does not collect personal information from children under 14.

13. Privacy Officer

14. Changes to This Policy

If this Privacy Policy is amended, the Company will notify users through in-app notices and the website at least 7 days before the changes take effect.