PRIVACY

Privacy Policy

Effective date · 28 October 2026

Article 1 (Purpose)

Mo.Moment ("Operator") establishes this Privacy Policy under Article 30 of the Personal Information Protection Act of the Republic of Korea, so that data subjects can understand how personal information is processed and can raise complaints. Gizmory (the "Service") is a local-first archive for the history of electronic devices you have owned or used. This Policy applies to the app, gizmory.app, and account-linked features. Effective date: 28 October 2026.

Article 2 (Items processed and how they are collected)

The Operator processes only what is needed to run the Service. You can use Chronicle, Discover, Studio, and Insights without an account.

1. Records kept on this device (default storage)
Device names, brands, years, purchase dates and prices, status, memos, life events, chronicle photos, tags and collections, story drafts, wishlist items, studio projects, and settings. By default these live in on-device SQLite and app storage, and they are not sent to a server if you are not signed in. Record sync after you sign in is described in item 2 (a).

2. Information sent to a server when you sign in, or only when you turn a feature on or run it
(a) Record sync when you are signed in (on by default): once you sign in, this device's records are sent to and received from the app and web signed in with the same account automatically. Nothing is synced if you are not signed in.
- What is sent: device records (device name, brand, category, release year, ownership start and end dates, purchase and sale prices, currency, status, your rating, memo, favorite mark, and so on), eras, device events (type, date, cost, note), custom fields, the caption, cover mark, and order of device photos, stories (title and text) and the width and height of story photos, wishlist items and boards, studio projects, Gear Fit equipment records, some settings (language, content region, default record currency, theme, effects), and this device's sync registration (a random device ID, whether automatic sync is allowed, and when that changed).
- Personal photo files (the original device and story photos) are not sent by sync and stay on this device.
- Server retention: the server keeps the current state of each record together with earlier versions used to resolve conflicts. They are kept until you delete your account or use "Reset all account records" (Settings > Data), and earlier versions of a record you deleted on a device may remain on the server. Deleting your account also deletes the server copy made by sync. "Reset all account records" deletes the synced records and the earlier versions, but the device registration (device ID, whether automatic sync is allowed, and when that changed) remains until you delete your account.
- How to turn it off: turn off "Allow automatic sync on this device" on the "App and web sync" card of the Profile screen (on the web you can also use Settings > Backup & sync > "Automatic record sync"). This device then stops sending and receiving automatically, and the copy already on the server remains. To delete the server copy, use "Reset all account records", delete your account, or email hello@gizmory.app. This setting is separate from the usage statistics setting.
- Legal basis: performing the service contract of giving signed-in members the ability to continue on another device (Article 15(1)(4) of Korea's Personal Information Protection Act and, for users in the EEA or the UK, Article 6(1)(b) GDPR). The server is run by our processor Supabase; the overseas transfer is described in Article 6.
(b) Cloud backup and local backup
- Cloud backup: the current app does not create new cloud backups (manual or automatic); a signed-in account's records continue through the record sync described in (a). For an account that still has a cloud backup uploaded earlier on our server (a JSON snapshot of records; chronicle photo bytes are not in the cloud snapshot), the "Cloud backup" card on the Profile screen shows the last backup time and the number of items, and you can import it with "Import into this account". The card is read-only.
- Local backup: you create, keep, and restore a file yourself from the Profile screen. If you include photos, original device and story photos go into a ZIP bundle; data-only keeps JSON. The local backup file is not sent to a server.

3. Social login and community (only while signed in)
On Apple or Google sign-in: an email if provided, account identifier, display name, and profile image URL if provided. Ratings, one-line reviews, published device story bodies, story photos uploaded to our servers (story-photos) when you publish a wiki story, Device Dex correction or new-device requests, device registration stats (registration events used for aggregates), and content reports. Posting requires sign-in; reading public content can still generate connection logs.

4. Launch waitlist (web, only if you enter an email)
Email address.

5. Diagnostics (builds that include the diagnostics setting (DSN))
Error messages and stacks, performance traces (about a 10% sample), session information (app state such as start and end), and app/OS/device technical information are sent automatically to Sentry. Performance traces and session information can be sent even when no error occurs. Screenshot and request-body collection are disabled, but this does not guarantee that errors never contain personal information.

6. Payments (if you buy a paid feature)
The Operator does not collect card numbers. Apple App Store or Google Play handles checkout. RevenueCat processes purchase status, product identifiers, subscription entitlements, minimum receipt data needed for restoration, and an anonymous app user identifier generated by its SDK. If you sign in, it may be linked to your account identifier. If Paddle checkout is offered on the web, Paddle may process information needed for checkout, such as buyer contact details, transaction and product/price identifiers, currency, amount, tax, and purchase status. The Operator processes the account identifier and transaction/entitlement status needed to verify web access and provide support. Web checkout is being prepared; the notices in effect when it is offered will describe the processing then in use. See Paddle's Privacy Notice for Paddle's processing.

7. Reading photo metadata (EXIF) — opt-in
"Find past gadgets from photos" only runs after you enter the feature yourself and grant photo access. It then reads capture device info (make, model, capture date) left in your photos' EXIF data — only on this device — to suggest candidates. The photos themselves and the metadata read from them are never sent anywhere. Scan results are added to your device list only after you review a candidate and confirm it yourself.

8. In-app YouTube playback — optional
When you tap play, a privacy-enhanced YouTube player loads. Playback and interaction data, IP address, app, browser and device information, cookies or similar identifiers may be sent to Google/YouTube, and an approximate region may be inferred from the IP address. Ads may appear under YouTube policies.

9. Usage statistics (app and web)
Usage statistics come in two kinds, (1) and (2). A single action, such as your first record or exporting a share image, can be reported to both.

(1) Daily totals — app (iOS and Android)
When one of the events below happens, the app sends its type to our server.
(a) The first time a device is recorded on this device for each signed-in account (including when you are not signed in), once only (records brought in by restoring a backup do not count): the category of that device (one of nine, such as phone or computer). Nothing is sent if records already exist in that account's records when the judgment is first made (including after an app update).
(b) Exporting a share image: image type and aspect ratio
Each report also includes the platform (iOS or Android), install source (app store, test distribution, or other), app version (for example 1.3.0), app display language (Korean, English, Japanese, or other), and the country in your device's language and region settings (Korea, United States, Japan, or other). The country is read from your device settings, not inferred from location data or your IP address.
Kind (1) does not include account or device identifiers, advertising identifiers, device model or OS version, exact times, or record content such as device names, notes, or prices. It is sent without account information even when you are signed in.
The server only adds 1 to a per-day (UTC) total. It does not store individual reports, and it does not store values outside a fixed list. We do not combine these totals with account, purchase, or other information to identify a particular user.
A value recording whether the first record has already been evaluated, one for each signed-in account (and one for when you are not signed in), is kept in the app's storage on this device. It is never sent anywhere and is not included in Gizmory backups (it may be included with other app data in your phone's operating-system backup).

(2) Statistics by environment and by member — app (iOS and Android) and web (gizmory.app)
(a) What is sent: only the fact that one of these four things happened.
- Visit: you opened the app or brought it back to the foreground; on the web, you opened the page.
- Activity: you tapped, scrolled, or pressed a key (we do not send where you tapped or what you typed).
- First record: you saved a device while your device list was empty (this includes saving again after resetting your records and saving for the first time in a signed-in account's records; records brought in by restoring a backup do not count).
- Share: you exported a share image (the image type and ratio are not sent in (2)).
(b) What is sent with it: a random statistics ID for this installation or browser, the platform (web, iOS, or Android), the app version, and the install source. The statistics ID is a number the app generates randomly for this purpose only; it is not an advertising identifier or a device serial number. Only apps installed from an app store and the web at gizmory.app are counted. Test distributions, development installs, and other web addresses send nothing. The server uses the app version and install source only to check their format and to filter, and does not store them. We do not send your email, name, record content (device names, notes, prices, photos), full page addresses, the referring site, or campaign (UTM) values.
(c) If you are signed in: the app attaches your sign-in token to the request header. The token contains your account number, your email, and other fields, but the server uses it only to confirm your account and stores only a converted form of your account number. We do not store your email. We do not put your email or account number in the request body. If you are not signed in, or are signed in anonymously, only the statistics ID is sent.
(d) What the server stores:
- The statistics ID and your account number are stored only after being converted with a one-way function (HMAC-SHA256) and a secret value that exists only on the server (the "converted value"); the original numbers are not stored. Because we can recompute the same converted value from an account when needed, we treat a signed-in member's records as information linked to the account.
- Each record is one row: date (Korea time), platform, converted value, member or not, and type (visit, activity, first record, share). Only one row per day, platform, and type is kept.
- For each member we also store the converted value, sign-up time, and sign-up platform. The sign-up platform is the platform of the first report that arrives within 10 minutes after the account is created; otherwise it is left as "unknown." We do not infer it from the sign-in method (Apple or Google).
- Activity from before you signed in on the same day is merged into the first account that signs in on that installation that day. For this we keep a link table (date, installation converted value, account converted value) until that day ends.
- The number of new environments counted per day is capped; to count them we keep a same-day allocation table (date and converted value) and delete it the next day.
- The same member using several platforms or devices may be counted as one member. A converted value for a signed-out installation stands for one environment (an installation or a browser profile), not a person.
- For a member who turned statistics off, we keep the converted value of the account and the time it was turned off on our server, to exclude the account from later counts (until you turn it back on or delete the account). The original account number is not stored.
- Retention: the row-level entries above are deleted automatically once 40 full days have passed since their date (Korea time). The link table is deleted when that day ends, and a member's converted value, sign-up time, and sign-up platform are kept until the account is deleted or statistics are turned off. The daily totals in (1) are kept for 25 months (Article 4). The consent record on our server (see (h)) is kept for 25 months from the day it is recorded and is deleted together with the account.
(e) What is kept on your device: the following, on this device (on the web, in this browser).
- Your usage statistics choice (on or off), the version of this Policy (the 28 October 2026 version) and the time recorded when you turn statistics on, and the marker that you turned statistics off
- A statistics ID for which the server deletion request has not yet been completed (until it is completed)
- A list of converted values used to recognize accounts: the account that was signed in when you turned statistics off, accounts for which the withdrawal was sent to our server, and accounts for which this installation has sent statistics. These are SHA-256 converted values, not the original account numbers.
- The statistics ID and the marker that the server consent record was completed
- The marker that the usage statistics choices an earlier version saved per account were checked and moved to this device-wide value
- Where: in the app, the statistics ID and the consent-record marker are in the app's temporary (cache) folder, which the operating system may clear, and everything else is in the app's storage (support) folder; on the web, everything is in browser storage (localStorage).
- Backups: none of it is included in Gizmory backups (local or cloud), and restoring one does not change it. Values in the app's storage folder may be included in the operating-system device backup on iPhone and iPad, but not in Android device backups; values in the temporary folder are not included in operating-system backups. So changing devices, deleting the app, clearing browser data, or the operating system clearing the temporary folder creates a new statistics ID, and the same person may be counted again as a new environment.
(f) Connection information: when (1) or (2) is sent, our processor Supabase records in its API logs your IP address, the time, the requested address, client information (User-Agent, such as the app's network client or your browser), a country, region, and city inferred from your IP address, your network name, and technical connection details (TLS fingerprint). For requests sent while you are signed in, your account number and session number are recorded as well. Your email is not recorded in these logs. These logs are deleted automatically under our processor Supabase's retention policy and are currently kept for about 90 days. The connection passes through Cloudflare, Supabase's sub-processor. We do not combine these logs with the statistics.
(g) Use: we compare visits, activity, first records, shares, and how many members come back 7 and 30 days after signing up across web, iOS, and Android, to improve the Service and gauge promotion results. We do not use them for advertising or link them with data from other companies' apps or websites. We do not link the website's store-redirect link records (gizmory.app/go/…) with entries in (2) person by person. Sign-up counts and the denominators of the return-visit rates are counted from the sign-up time in the account information (administrator accounts and members who turned statistics off are excluded).
(h) Legal basis: the totals in (1) are designed so that they cannot identify anyone on their own, but connection information is processed while they are sent, and (2) stores a statistics ID and a value converted from your account, so we treat both as processing of personal information. If any of the language and region settings of your device (on the web, your browser) is in the European Economic Area (EEA), the United Kingdom, or Switzerland, or in a territory to which those laws apply (such as French overseas regions, the Åland Islands, the British Crown Dependencies, and Gibraltar), or your country cannot be determined from those settings, both (1) and (2) are off by default and are sent only if you turn them on yourself in Settings. When you try to turn them on, a notice window appears (it explains what is sent, including the items in the daily totals; the number kept on this device; the link to your account; retention, which is 40 days for the daily entries and 25 months for the records of turning statistics on or off and for the daily totals; and how to turn it off and what happens, including that the daily totals cannot be deleted), and they turn on only after you tap "Turn on". We treat that choice as your consent (Article 6(1)(a) GDPR, Article 5(3) of the ePrivacy Directive, and Regulation 6 of the UK PECR). Turning statistics off is treated as withdrawing consent, and your entries on our server are deleted as described in (i). If you are below the age at which Article 8 GDPR (or the equivalent UK rule) requires parental consent in your country (between 13 and 16, depending on the country), please do not turn this on; if we learn that this has happened, we delete the entries. For all other users, we process (1) and (2) without consent under Article 15(1)(6) of Korea's Personal Information Protection Act (the Operator's legitimate interests). The choice to turn statistics on or off, the time you turned them on, and the version of this Policy shown to you at that moment (the 28 October 2026 version) are kept on this device in every region (see (e)) and, if you are signed in, also recorded on our server based on the converted value of your account (to be able to show consent and its withdrawal; kept for 25 months from the day it is recorded and deleted together with the account if you delete it). The region is determined only from your device settings; we do not use your location or IP address for this.
(i) How to turn it off, and what happens: this feature is on by default. However, if any of the language and region settings of your device (on the web, your browser) is in the European Economic Area (EEA), the United Kingdom, or Switzerland, or in a territory to which those laws apply (such as French overseas regions, the Åland Islands, the British Crown Dependencies, and Gibraltar), or your country cannot be determined from those settings, both (1) and (2) are off by default. In these regions, turning it on shows a notice window, and statistics turn on only after you tap "Turn on". Turn off Settings > Data > "Send usage statistics" and that device (on the web, that browser) stops sending both (1) and (2). For (2), turning it off also deletes your entries on our server: the app asks our server, using the statistics ID of that device, to delete its signed-out entries and then erases the ID; if you are signed in, your account's (2) entries and sign-up platform are deleted and your account is excluded from later counts (including sign-up and return-visit counts). If you turn it off while signed out, the signed-out entries of that device are deleted. After you turn it off while signed out, signing in again with an account for which this device has sent statistics before automatically deletes that account's entries. An account for which this device has never sent statistics is not deleted, and this device does not send for it either. You can also have them deleted by deleting your account or by emailing hello@gizmory.app. A report that was already being sent at the moment you turn statistics off may rarely remain and is deleted after 40 days. If the deletion request fails (for example, the device is offline), the statistics ID is kept only for this deletion request and the request is repeated the next time you run the app. This choice is saved on this device (on the web, this browser), not on an account, so signing in or switching to another account does not change it. The first time you run the app after updating, if any of the earlier per-account choices on this device is off, it is moved over as off (on the web, only the choice of the account currently signed in is moved). Deleting the app or clearing browser data can return the choice to its initial state (on iPhone and iPad, restoring from a device backup may keep it), and if you turned statistics off while signed in, that account stays excluded from counts on the server. If you turn it back on yourself in the same setting, it starts again with a new ID that is not connected to the old one, the exclusion of your account ends, and activity from while it was off is not sent later. Signed-out entries left under an earlier statistics ID (from before you reinstalled the app, cleared browser data, or the operating system cleared the app's temporary folder and the ID changed) cannot be found and are deleted automatically once 40 full days have passed since their date. The daily totals in (1) are not separated by person, so they cannot be deleted and are removed when the period in Article 4 ends. Every feature of the app keeps working if you turn it off.
(j) Start date: (2) is sent from 0:00 on 28 October 2026 (Korea time). Our server also does not accept entries from before that time. If you turned statistics off before 28 October 2026, there is nothing to delete on the server, and the account's turn-off is reported to the server the first time you run the app after that while signed in to that account (or when you sign in to that account again).

How collected: your input; OS APIs after you grant permission; transfers you start (sign-in, importing an earlier cloud backup, publish, pay, or play video); logs created when the app crashes; and usage statistics the app and web send automatically (item 9 (1) and (2), which you can turn off in Settings).

Article 3 (Purposes of processing)

The Operator does not use personal information for other purposes. If a purpose changes, a new consent or a statutory procedure under Article 18 of the Act will be followed.
1. Store, view, edit, export, and restore your chronicle
2. Record sync across your devices for signed-in accounts, and keeping and importing cloud backups uploaded earlier
3. Community features for signed-in users (reviews, stories, Device Dex requests, reports)
4. Aggregate registration stats to improve the Device Dex (not to identify you)
5. Provide Pro and restore purchases
6. Launch or update notices if you joined the waitlist
7. Diagnostics and security
8. In-app YouTube playback that you choose to start
9. Legal duties and support replies
10. Usage statistics to improve the Service and measure promotion results (daily totals, and statistics on visits, activity, first records, shares, and return visits after sign-up by environment and member; Article 2, item 9)

Article 4 (Retention periods)

Where retention is legally required, only the relevant records are retained separately and deleted when the period ends. Applicable Korean periods include 5 years for contracts, withdrawal, payments and supply; 3 years for consumer complaints and disputes; and 6 months for advertising records.

Local records remain until you delete them. Cloud backups uploaded earlier remain until you delete your account, and you may also ask for their deletion at hello@gizmory.app. Server copies made by record sync for a signed-in account are kept until you delete the account or use "Reset all account records" (Settings > Data), and turning off automatic sync on this device does not by itself delete the server copy. "Reset all account records" deletes the synced records and the earlier versions, but the device registration (device ID, whether automatic sync is allowed, and when that changed) remains until you delete your account. The server also keeps earlier versions of records to resolve conflicts, so earlier versions of a record you deleted on a device may remain on the server.

Usage statistics are kept differently by kind. (1) Daily totals are deleted by a daily automatic job 25 months after the day they describe. (2) Visit, activity, first-record, and share entries are kept as individual rows (date, platform, converted value, type) and deleted automatically once 40 full days have passed since their date (Korea time). The link table used to merge activity from before sign-in is deleted when that day ends. A member's sign-up time and sign-up platform are kept, together with the converted value, until the account is deleted or statistics are turned off. Deleting your account also deletes the (2) entries linked to it, including activity from before you signed in that was merged into the account the same day. The consent record on our server (Article 2, item 9 (2) (h)) is kept for 25 months from the day it is recorded and is deleted together with the account. The converted value of a member who turned statistics off and the time they did so are kept, to exclude the account from later counts, until the member turns statistics back on or deletes the account. Turning statistics off deletes the signed-out (2) entries of that device and, if you are signed in, your account's (2) entries and sign-up platform from our server (Article 2, item 9 (2) (i)). The daily totals in (1) are not separated by person and are deleted only when their period ends. Signed-out entries left under an earlier statistics ID (from before you reinstalled the app, cleared browser data, or the operating system cleared the app's temporary folder and the ID changed) cannot be found and are deleted only when the 40 full days have passed. Connection records left in our processor's API logs when statistics are sent are deleted automatically under our processor Supabase's retention policy and are currently kept for about 90 days. Website connection records are covered by Article 10.

Deleting an individual Lounge post or reply marks it deleted and hides it publicly; it is not immediate physical erasure of its server text. Turning push off or signing out disables the device token. There is currently no uniform automatic deletion period for tokens, delivery history, read records, reports or audit records. You may request deletion or suspension; necessary legal or rights-protection retention must be explained with its basis and scope.

Waitlist database records and operator mailbox copies, story-photo storage, diagnostics and backup copies require separate handling. Account deletion does not guarantee simultaneous erasure from every store. Retention questions and deletion requests: hello@gizmory.app.

Article 5 (Provision to third parties)

The Operator does not provide personal information to third parties, except:
1. Where you have consented in advance
2. Where a statute specially requires it or compliance is unavoidable
Gizmory does not operate its own advertising SDK. If you choose to play an in-app YouTube video, ads may appear in the YouTube player and playback data is processed under Google/YouTube policies.

Article 6 (Entrustment and overseas transfer)

The Operator entrusts the following work. Some processors are outside Korea. Contracts and oversight follow Articles 26 and 28-8 of the Act.

1. Supabase (Supabase Pte. Ltd.) — authentication, community data, cloud backup snapshots, record sync copies, story-photos storage, and usage statistics. Data location: Sydney, Australia (ap-southeast-2). Contact: privacy@supabase.com
2. Apple — Sign in with Apple, App Store in-app purchases
3. Google — Google sign-in, Google Play in-app purchases
4. RevenueCat — purchase and subscription status, paid entitlements, and purchase restoration
5. Sentry — error and performance diagnostics, session information, and technical information in enabled builds
6. Google/YouTube — in-app video playback you start, player interactions, and IP, app, browser and device information
7. Cloudflare (Cloudflare, Inc.) — website and static asset delivery, website connection records, and website visit statistics (Cloudflare Web Analytics); as Supabase's sub-processor, the network path between the app and Supabase. Location: Cloudflare locations worldwide, nearest to you. Contact: privacyquestions@cloudflare.com

Overseas transfer of usage statistics (Article 2, item 9)
- Items: (1) event type and category values, platform, install source, app version, app display language, country category. (2) event type (visit, activity, first record, share), platform, statistics ID, app version, install source, if you are signed in, sign-in information (a token that contains your account number and email, among other fields; our server does not store the email) and the choice to turn statistics on or off with its time and the policy version shown to you (the consent record), and, for a member who turned statistics off, the converted value of the account and the time (to exclude the account from later counts). For both: connection information when sent (IP address, time, requested address, client information such as User-Agent, country, region, and city inferred from your IP address, network name, and technical connection details)
- Countries: Australia (statistics storage); countries with the Cloudflare location nearest to you (network path); the country where the log-processing facilities designated by Supabase are located (connection logs)
- When and how: each time an event happens, over an encrypted connection (HTTPS)
- Recipients: Supabase Pte. Ltd. (privacy@supabase.com) and its sub-processor Cloudflare, Inc. (privacyquestions@cloudflare.com)
- Purpose and retention: aggregating usage statistics; (1) totals for 25 months, (2) row-level entries for 40 days (a member's converted value, sign-up time, and sign-up platform until the account is deleted or statistics are turned off), the consent record on our server for 25 months (deleted together with the account), the converted value and turn-off time of a member who turned statistics off until the member turns statistics back on or deletes the account, connection logs deleted automatically under the processor's policy (currently about 90 days)
- How to refuse and effect: turn off Settings > Data > "Send usage statistics" and that device (on the web, that browser) stops transferring data for this purpose, and the (2) entries linked to that device's current statistics ID and to the account you are signed in with are deleted from our server (Article 2, item 9 (2) (i)). In the regions described in Article 2, item 9 (2) (h), and where the country cannot be determined, this setting is off by default and data is transferred only if you turn it on. The daily totals in (1) are not separated by person and cannot be deleted; they are removed when the period in Article 4 ends. No feature stops working.

Overseas transfer of record sync (Article 2, item 2 (a))
- Items: the records and settings listed in Article 2, item 2 (a), and this device's sync registration (a random device ID, whether automatic sync is allowed, and when that changed). Personal photo files are not transferred.
- Countries: Australia (storage of the sync copy); countries with the Cloudflare location nearest to you (network path)
- When and how: each time a sync runs, over an encrypted connection (HTTPS)
- Recipients: Supabase Pte. Ltd. (privacy@supabase.com) and its sub-processor Cloudflare, Inc. (privacyquestions@cloudflare.com)
- Purpose and retention: giving signed-in members the ability to continue on another device; kept until you delete your account or use "Reset all account records" (the device registration until you delete your account)
- How to refuse and effect: nothing is transferred if you are not signed in. If you are signed in, turn off "Allow automatic sync on this device" on the "App and web sync" card of the Profile screen (on the web, Settings > Backup & sync > "Automatic record sync") and this device stops transferring automatically; the copy already on the server remains. Without sync you cannot continue on another device, while the records on this device keep working.

Transfers happen over encrypted connections when you use the feature (sign-in, record sync, importing an earlier cloud backup, publish, pay, play video, a crash, or a usage statistics report). You may refuse under Article 8, but then sign-in, record sync, importing an earlier cloud backup, community, and paid checkout will not work. Turning off usage statistics does not disable any feature. The default local chronicle stays on this device without entrustment while you are not signed in.

Article 7 (Destruction)

Data should be destroyed without delay when its purpose or required retention ends, using methods that prevent recovery for electronic files and shredding or incineration for paper.

Reset records deletes local records; cloud-copy deletion is a separate option. Using Delete account executes removal of server account-linked data, but does not simultaneously erase the local chronicle, external search copies, separate photo-storage cleanup, retained reports/audits or mailbox copies. See Articles 4 and 13 and request outstanding-copy deletion at hello@gizmory.app.
Account deletion: https://gizmory.app/account-deletion

Article 8 (Your rights and how to exercise them)

You may at any time:
1. Request access, correction, deletion, or suspension of processing
2. Withdraw consent and delete your account
3. Turn off record sync, reset local records, or delete individual devices and stories
Use in-app Settings or email hello@gizmory.app. A legal representative of a child under 14 may need to show documents required by law. The Operator will act without delay or explain why it cannot.

How you can exercise your rights over usage statistics (Article 2, item 9) depends on the kind. (1) Daily totals are not separated by person, so we cannot find, show, correct, or delete a particular user's values; they are deleted automatically after 25 months. (2) Entries for a signed-in member can be found by recomputing the converted value from the account, so you may ask us to show or delete them at hello@gizmory.app; after confirming your identity, we respond to an access request within 10 days and act on a deletion request without delay. Deleting your account also deletes them. For (2) entries of a signed-out installation, the server does not store the original ID and the app does not show it to you, so we cannot find a particular user's entries from an email request alone. Instead, if you turn off Settings > Data > "Send usage statistics" (suspension, objection, or withdrawal of consent), sending stops and the app asks our server, using that device's statistics ID, to delete its signed-out entries, and then erases the ID. If you are signed in, your account's (2) entries and sign-up platform are also deleted, and your account is excluded from later counts. If you turn it off while signed out, the signed-out entries of that device are deleted. After you turn it off while signed out, signing in again with an account for which this device has sent statistics before automatically deletes that account's entries. An account for which this device has never sent statistics is not deleted, and this device does not send for it either. You can also have them deleted by deleting your account or by emailing hello@gizmory.app. A report that was already being sent at the moment you turn statistics off may rarely remain and is deleted after 40 days. If the request fails, it is repeated the next time you run the app. Entries left under an earlier statistics ID (from before you reinstalled the app, cleared browser data, or the operating system cleared the app's temporary folder and the ID changed) cannot be found and are deleted automatically once 40 full days have passed.

Article 9 (Safeguards)

Under Article 29 of the Act the Operator takes:
1. Administrative measures: least privilege, purpose limitation
2. Technical measures: HTTPS in transit, account-scoped access control, a local-first design in which default records are not uploaded unless you sign in (record sync after sign-in is in Article 2, item 2 (a))
3. Physical measures: as provided by the cloud processor
You remain responsible for where you keep backup files and who holds the device. Regular backups are recommended.

Article 10 (Automatic collection and how to refuse it)

1. App: The Gizmory app does not use advertising identifiers or tracking cookies for behavioural ads itself. The app sends the usage statistics in Article 2, item 9 automatically and keeps on your device a first-record value for (1) (one for each signed-in account and one for when you are not signed in) and, for (2), the statistics ID, your usage statistics choice and consent record, the marker that you turned statistics off, the marker that earlier per-account choices were checked, any statistics ID waiting for a server deletion request, and a list of converted account values (Article 2, item 9 (2) (e)). These statistics are not used for advertising and are not linked with data from other companies' apps or websites. If any of the language and region settings of your device (on the web, your browser) is in the EEA, the UK, or Switzerland (or a territory to which those laws apply), or your country cannot be determined, this setting is off by default and statistics are sent only if you turn them on. To refuse: turn off Settings > Data > "Send usage statistics".
2. In-app YouTube: If you tap an in-app YouTube video, its privacy-enhanced player loads and Google/YouTube may use cookies or similar technology and show ads. The player does not load unless you tap play.
3. Website (gizmory.app): The website may use strictly necessary cookies or similar technology for delivery and security. It does not use its own advertising tracking cookies. In the web app (gizmory.app), kind (2) of Article 2, item 9 stores in your browser's storage (localStorage) the values described in Article 2, item 9 (2) (e) (the random statistics ID, your usage statistics choice and consent record, the marker that you turned statistics off, the marker that earlier per-account choices were checked, any statistics ID waiting for a server deletion request, and a list of converted account values). These are not cookies and are not strictly necessary to provide the Service. If any of the language and region settings of your device (on the web, your browser) is in the EEA, the UK, or Switzerland (or a territory to which those laws apply), or your country cannot be determined, this setting is off by default and statistics are sent only if you turn them on. Turning off Settings > Data > "Send usage statistics" stops reports, asks our server to delete the entries, and then deletes the ID, and clearing site data in your browser also removes it. The web app may also download a font from Google's font server (fonts.gstatic.com) when the page contains a character that is not in its built-in fonts (such as an emoji); your IP address and browser information may then be passed to Google. Cloudflare handles website requests, which involves connection information (IP address, browser information, requested address, time, and IP-inferred country). Web server logs we configure are deleted automatically within 7 days; Cloudflare's security records follow Cloudflare's retention policy. When you use a store link on the website (gizmory.app/go/…), the destination store, page language, button position, and any campaign label on the link are written to these logs without cookies or account information. A country inferred from your IP address may be used to show regional content but is not stored separately. The website (pages on gizmory.app such as the introduction and policy pages) uses cookie-free visit and performance statistics (Cloudflare Web Analytics). A measurement script that Cloudflare adds to the page automatically (static.cloudflareinsights.com) sends information such as the address of the page you visited, the referring address, your browser, operating system and device type, and page load performance to Cloudflare, and Cloudflare infers a country from your IP address for its aggregate figures. We use these statistics to understand visits and page performance, and Cloudflare keeps them under its own retention policy. They are not used in the web app (gizmory.app/web). You can block this measurement with your browser's script or content blocking features. You can block strictly necessary cookies in your browser settings, but some features may not work. The legal basis, items, method, purpose, retention period, and how to refuse for usage records processed in an identifying way are set out in Article 2, item 9.
4. Do Not Track: The app and website do not collect information about your activities over time and across other companies' websites or online services, so they do not change their behaviour in response to browser Do Not Track signals. If you play a YouTube video, Google/YouTube may collect such information under its own policies.

Article 11 (Children)

The Service is not directed at children under 14, and the Operator does not knowingly collect their personal information. If such information is found, it is destroyed without delay.

Article 12 (Public editorial — Gizmory Magazine)

Published issues of Gizmory Magazine in the Discover tab are public editorial content written and edited by Gizmory. They are not personal records and are not part of your account.

Article 13 (Personal information processed in the community)

1. Pseudonymous profile — Once you join the community, your public identifier (handle), display nickname, bio, and a system-generated avatar value are shown to other users and on the public web. Your email address and Apple/Google sign-in identifier are never made public.
2. Private-review story submissions — Story text and photos you submit through the private-review route are first held in an Operator-only private review store. A submission with any photo is moved to the public store, and shown, only after every photo in it is approved. A rejected or still-under-review submission is not published.
3. Photo metadata (EXIF) — When you pick a story photo, the app keeps only the copy the device re-encodes for you, and uploads that copy when you submit. Most capture metadata is stripped by that re-encoding, but byte-level removal is not guaranteed. Before upload, you are warned to check the photo yourself for serial numbers, receipts, addresses, or faces.
4. Consent records — The Operator stores whether and when you accepted the Community Guide, and your consent to public web exposure before you publish.
5. Report and block records — Report reasons, targets, handling history, and your block list are kept as operational evidence and are not shown to other users.
6. Scope of disclosure — An approved, published pseudonymous profile or story can be read at the app and at gizmory.app/community whether or not a viewer is signed in, and may be indexed by search engines once the Operator turns on web indexing.
7. On account deletion — Deleting your account removes your pseudonymous profile and the community content you posted (stories, reviews, comments, and more) without recovery. Report and moderation records are kept for operational purposes with some account references set to null. This does not mean the record is fully anonymized. Audit records are kept only for actions the Operator itself took; they may include the identifier of the Operator account that took the action and of the account the action targeted (for example, a membership change), and those identifiers may remain even after the account is deleted.

Article 14 (Privacy contact)

Privacy and complaints: Mo.Moment (Mo, Yoon Won)
Trade name Mo.Moment
Representative Mo, Yoon Won
Business registration no. 422-59-00756
Mail-order business report no. 2026-고양덕양구-1596호
Reporting authority Goyang City
Address #829, 63, Baekkkot-gil, Uijeongbu-si, Gyeonggi-do
Phone +82 10 5717 4082
Email hello@gizmory.app
Hosting service provider Supabase Pte. Ltd. and Cloudflare, Inc.
Account deletion: https://gizmory.app/account-deletion

Article 15 (Remedies)

You may also contact:
1. Personal Information Infringement Report Center (privacy.kisa.or.kr / 118)
2. Personal Information Dispute Mediation Committee (www.kopico.go.kr / 1833-6972)
3. Supreme Prosecutors' Office Cyber Investigation (www.spo.go.kr / 1301)
4. National Police Agency Cyber Bureau (ecrm.police.go.kr / 182)

Article 16 (Changes)

This Policy applies from 28 October 2026. If the law or the Service changes the text, the reason and effective date will be posted in the app or on the web. Material changes will be announced before they take effect. Previous versions are listed below with the period during which each applied.

Previous versions and periods of application
- Policy effective 16 October 2026 — applied from 16 October 2026 to 27 October 2026
- Policy effective 11 September 2026 — applied from 11 September 2026 to 15 October 2026
Comparison of what changed: comparison table for 28 October 2026
Japanese users: 外部送信に関する公表 (in the app, open it from Settings > App info > the row 外部送信に関する公表, which is shown under this Japanese name in every display language, with the note "For users in Japan" added in English)

Change history
- 28 October 2026 — usage statistics (Article 2, item 9) now described as (1) daily totals and (2) statistics by environment and by member (including the web, starting 0:00 on 28 October 2026 Korea time), with Articles 3, 4, 6, 8, and 10 updated. Row-level entries in (2) are kept for 40 days, and turning statistics off also deletes your (2) entries from our server. Statistics are off by default in the EEA, the UK, Switzerland, and similar regions, and where the country cannot be determined (Articles 2 (item 9), 6, and 10). Corrected the items and retention of connection logs (Articles 2 (item 9), 4, and 6: "within 7 days (currently 1 day)" is now deletion under the processor's policy, currently about 90 days). Corrections to existing notices: record sync for signed-in accounts (on by default) is now described in Article 2 (item 2 (a)), Article 3 (item 2), Article 4, and Article 6, and Article 2 items 1 and 2 were revised; performance traces and sessions were added to what Sentry receives (Article 2 item 5 and Article 6); the web app's use of Google's font server is disclosed (Article 10); and a notice of website visit statistics (Cloudflare Web Analytics) is added (Articles 6 and 10). The values kept on the device for (2), the scope of what turning statistics off does, and the notice window shown when turning statistics on were spelled out (Articles 2 (item 9), 4, 6, and 10). Corrected that new cloud backups can no longer be created (only earlier backups remain) and the scope of the record sync reset (Articles 2 (item 2 (b)), 3, 4, 6, and 8); corrected the scope of the first-record judgment in (1) (per account) and the local-first sentences that apply only while you are not signed in (Articles 2 (item 9), 9, and 6). Previous versions, their periods of application, and a comparison table published (Article 16). Added an external-transmission notice and an overseas-storage notice to the Japanese summary.
- 16 October 2026 — added usage statistics (Article 2, item 9); updated entrustment and overseas transfer (Article 6) and automatic collection (Article 10).

Article 17 (Lounge and processing clarification)

Lounge processes account-linked profiles and avatars, posts/replies, categories, linked devices and usage years, private saves and blocks, reports and moderation, and notification creation/read times. Reaction records relate to other community content that offers reactions, not a Lounge reaction feature. Unlike pre-reviewed stories, Lounge content may publish immediately and may be readable without sign-in at the public stage.

Being signed in with Lounge reply push enabled and iOS notification permission granted enables processing of Apple APNs device tokens, environment, enabled status, delivery targets, attempts and results. Current pushes contain a generic new-reply notice and internal identifiers, not nicknames or reply text. In-app activity notices may remain when Lounge push is off. OS notification permission is not marketing consent.

Signed-in device-registration raw data (account, device and local-item IDs and acquisition year) can sync independently of cloud backup. Unlike public aggregates, raw records are account-linked. Daily visits for active community profiles support personal activity statistics. An estimated birth year calculated from a selected generation can be included in settings and backup; it is not age verification.

Enabled RevenueCat builds can process an anonymous SDK identifier before purchase. Where web Pro Stripe checkout is offered, account/product/transaction information is processed; consult that checkout for cancellation. Cloudflare supports website delivery and applicable operator notification emails. External code delivery networks and YouTube may process connection information. Supabase project storage is in Sydney, Australia (ap-southeast-2); this does not limit every vendor to that country.

Processor tasks differ from independent providers. Each processing activity needs an applicable basis, such as contract necessity, consent or a legal duty; not all analytics is contract-essential. The legal basis and overseas transfer of usage statistics are set out in Article 2, item 9 and Article 6. Details of other overseas transfers, such as diagnostics (Sentry), require further confirmation. Contact hello@gizmory.app for information and rights requests.

Depending on residence and applicable legal thresholds, US residents may have access, correction, deletion, portability, sale/sharing/targeted-advertising opt-out, sensitive-data and appeal rights. We do not unfairly discriminate for exercising rights. We do not offer automatic GPC handling; Do Not Track is addressed in Article 10. We do not categorically deny sale/sharing under US definitions, including third-party player processing. Email requests are handled under applicable statutory deadlines and exceptions. Local export is not a copy of all server-held personal information.