Privacy Policy

Bomtobe (hereinafter referred to as "the Company") establishes and discloses this Privacy Policy to protect users' personal information in accordance with the Personal Information Protection Act and related regulations, and to promptly and effectively address any related grievances.

Article 1 (Collection Items and Methods of Personal Information)

1. Information Collected at Registration

2. Information Automatically Collected During Service Use

3. Collection Methods

App registration screen, profile settings screen, automatic generation and collection during service use, automatic device information collection

Article 2 (Purpose of Collection and Use of Personal Information)

The Company processes personal information for the following purposes.

Article 3 (Retention and Use Period of Personal Information)

The Company shall promptly destroy personal information after the purpose of collection and use has been fulfilled. The retention period for each item is as follows.

Article 4 (Provision of Personal Information to Third Parties)

The Company does not, in principle, provide users' personal information to external parties. However, the following cases are exceptions.

• When the user has given prior consent
• When required by law or when an investigative agency makes a request in accordance with the procedures and methods prescribed by law for investigative purposes

Article 5 (Entrustment of Personal Information Processing and Third-Party Services)

The Company entrusts personal information processing or uses third-party services as follows for service provision.

Article 6 (Procedures and Methods for Destruction of Personal Information)

1. Destruction Procedures

Users' personal information is destroyed without delay in accordance with internal policies after the purpose of collection and use has been fulfilled.

2. Destruction Methods

• Electronic Files: Permanently deleted using irrecoverable methods (MongoDB document deletion, object storage file deletion)
• Paper Documents: Shredded or incinerated

3. Scope of Deletion Upon Account Withdrawal

Upon account withdrawal, the following data is completely deleted sequentially.

• Posts and related comments
• Notices and linked calendar events
• All authored comments
• Uploaded files (metadata and original files)
• Calendar events
• Sent and received messages
• Device registration information and notification history
• Authentication tokens (Access/Refresh)
• AI chat sessions, uploaded documents, and embedding data
• Member account information

Article 7 (Rights of Users and Legal Representatives and Methods of Exercise)

Users (or legal representatives) may exercise the following rights at any time.

• Right to Access: View the status of personal information processing
• Right to Rectification: Correct errors in personal information (via in-app profile editing or customer support)
• Right to Deletion: Delete personal information (via account withdrawal or customer support)
• Right to Suspend Processing: Suspend the processing of personal information
• Right to Withdraw Consent: Withdraw marketing communication consent (changeable directly in app settings)

The above rights may be exercised through the app settings menu or by submitting a written or email request to the Privacy Officer listed below. We will take action without delay.

Article 8 (Measures to Ensure the Security of Personal Information)

The Company takes the following measures to ensure the security of personal information.

Article 9 (Biometric Authentication Information Processing)

The MoyeoBom app provides biometric authentication (fingerprint, facial recognition) for convenient login.

• Biometric data (fingerprints, facial templates) is stored only in the secure enclave of the user's device (iOS Keychain, Android Keystore, Windows Hello) and is not transmitted to the server.
• Only the biometric authentication activation status (Boolean value) is stored on the server.
• Biometric authentication is optional and can be disabled at any time in the app settings.

Article 10 (Cookies and Local Storage)

• Mobile App (Android/iOS): Authentication tokens are encrypted and stored in the platform's secure storage (SecureStorage).
• Web Version: Authentication tokens are stored in browser session storage (sessionStorage) and are automatically deleted when the browser tab is closed.
• Admin Dashboard (Dev): Uses cookie-based authentication, which automatically expires after 8 hours.

Article 11 (Installation, Operation, and Rejection of Automatic Data Collection Devices)

1. Firebase Analytics

The Company uses Firebase Analytics to collect app usage statistics for service improvement.

• Collected information: App events (login, post creation, search, voting, etc.), screen view records, error logs
• User properties: Role, affiliated site, platform information
• Data retention period: 26 months (Google default policy)
• Opt-out method: Analytics data collection can be disabled in the app settings menu

2. Firebase Cloud Messaging

Device tokens are collected for push notification delivery. If you do not wish to receive notifications, you can disable notifications in the app settings.

Article 12 (International Transfer of Personal Information)

The Company may transfer personal information overseas as follows for service provision.

Article 13 (Privacy Officer)

The Company designates a Privacy Officer as follows to oversee the processing of personal information and to handle user complaints and remedies for damages.

Article 14 (Methods of Remedy for Infringement of Rights)

Users may apply for dispute resolution or consultation with the following organizations to seek remedies for personal information infringement.

• Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
• Personal Information Infringement Report Center: 118 (privacy.kisa.or.kr)
• Supreme Prosecutors' Office Cyber Investigation Division: 1301 (www.spo.go.kr)
• National Police Agency Cyber Investigation Bureau: 182 (ecrm.cyber.go.kr)

Article 15 (Changes to the Privacy Policy)

This Privacy Policy is effective from the enforcement date. In the event of additions, deletions, or modifications due to changes in laws, policies, or security technologies, the changes shall be announced through the app at least 7 days prior to their effective date.