Privacy Policy
The short version: we collect as little as possible, we tell you exactly where it goes, and you can delete all of it, any time.
1. What we collect, and why
| Data | When | Why (purpose) |
|---|---|---|
| Email address | When you sign in or create an account (we email you a one-time code; there is no password) | Account creation, sign-in, and essential account notices. Nothing else. No marketing without separate consent. |
| Birth year | On the sign-up screen | Checked on your device only to confirm you are 14 or older (Korean law). It is not sent to our servers and not stored. |
| Saved content | When you save a place or a route | Your bookmarks and routes (place names and map coordinates of the stops you chose), synced to your account so they follow you across devices. |
| Location coordinates | When you build a route, or if you allow device location | Route stops are sent to our server once to calculate time and distance. Device location, if you allow it, is used in the moment to show nearby spots and is not stored. |
| Usage events | While you browse | Which pages and buttons are used (analytics), so we know what helps and what doesn't. Pseudonymous IDs; no advertising trackers, no ad networks. |
| IP address | On every request (standard for any website) | Security only: abuse prevention (daily request limits) and server logs. Rate-limit counters are deleted within about 7 days. |
We do not collect: real name, phone number, passport or ARC numbers, payment card numbers, health data, precise location history, or anything we don't strictly need.
The mobile app is different: it collects nothing
Everything in the table above describes the website. The WYK Pass app carries its guides inside the download and runs fully offline. It has no sign-in and no account, it asks for no device permissions, and it sends nothing to our servers or to any analytics service. The only thing it writes is your checklist ticks, and those stay on your phone. Deleting the app deletes them.
The one time the app reaches outside itself is when you tap an emergency number: it hands that number to your phone's dialer. We do not see the call.
2. Where your data goes (including overseas)
Some processing happens outside Korea. Under Korean privacy law (PIPA) we must tell you exactly what, where, and to whom:
| Recipient | Country | What & why | Kept for |
|---|---|---|---|
| Supabase (database & sign-in) | South Korea (Seoul region) | Your account (email) and saved content are stored in Supabase's Seoul, Korea data region. Supabase, Inc. (USA) operates the infrastructure. | Until you delete your account |
| PostHog (analytics) | USA | Usage events (page views, taps) with pseudonymous IDs are sent to PostHog's US servers at the time they happen, so we can improve the product. | Retained only as long as needed for product analysis, then periodically purged. |
| Kakao Mobility (routing) | South Korea | The map coordinates of your route stops are sent once to compute driving time and taxi fare. No account identifier is attached. | Not stored by us; per Kakao's policy |
| Vercel (website hosting/CDN) | USA (global CDN) | Serves the website; standard access logs (IP, user agent). | Per Vercel's log retention |
| Google Fonts | USA | Your browser requests the page fonts from Google's servers (your IP is visible to Google in that request, as with any font CDN). | Not stored by us |
You may refuse the overseas transfer, but analytics-free operation of the service is not technically separable at this time; if you do not agree, please do not use WYK Pass, or contact us below.
3. How long we keep it
- Account & saved content — until you delete your account. Deletion is immediate and permanent (see §4).
- Security rate-limit counters (IP) — about 7 days, then purged automatically.
- Audit records — security audit entries (e.g. "an account was deleted") are retained for security and legal purposes and removed when no longer needed. They contain no email and no content.
- Analytics events — retained only as long as needed for product analysis, then periodically purged.
- If another law requires a longer retention (e.g. commerce records once payments launch), we keep only what that law names, only for that period.
4. Your rights: see it, fix it, delete it
- Access & correction — email us and we will show you everything tied to your account, or correct it.
- Delete everything — two ways:
- In the app: the account screen's "Delete my account" action erases your account and every row tied to it (bookmarks, routes, entitlements) in one step.
- By email: write to wouldyoukorean@gmail.com from your account email with the subject "Delete my data".
- Withdraw consent — same channels. Withdrawing required consent means closing the account.
- We respond within the timelines required by Korean law (PIPA), normally within 10 days.
5. Cookies & local storage
We use browser local storage for: your sign-in session (Supabase tokens), your in-progress route, and checklist ticks. We do not use third-party advertising cookies. Signing out wipes session data and app caches from the device.
6. Age limit
WYK Pass accounts require you to be 14 or older (the consent age under Korean law). The birth-year check runs on your device; we do not store it.
7. How we protect it
- Row-level security on every database table: you can only ever read your own rows. Verified automatically on every code change.
- Server secrets never ship to the browser; the keys your browser holds cannot read anyone else's data even if copied.
- All traffic is HTTPS-only with strict security headers.
- Operator access to personal data is logged and minimized.
8. Changes
If this policy changes in a way that matters (new data, new recipient, new purpose), we will update this page and note the new effective date at the top at least 7 days before it applies.
9. 한국어 고지 (개인정보 처리방침 요지)
아래는 「개인정보 보호법」(PIPA)에 따른 필수 고지 사항의 한국어 요지입니다. 영어 본문과 한국어 요지가 다를 경우 한국 이용자에게는 한국어 요지가 우선합니다.
- 적용 범위: 웹(wouldyoukorean.com/pass)과 WYK Pass 모바일 앱에 모두 적용됩니다. 단 앱은 개인정보를 일절 수집하지 않습니다 — 로그인·계정 없음, 기기 권한 요청 없음, 서버·분석 도구로 전송하는 데이터 없음. 체크리스트 상태만 기기 안에 저장되며 앱 삭제 시 함께 사라집니다. 아래 항목은 웹에 해당합니다.
- 수집 항목·목적: ① 이메일 주소(로그인 일회용 코드 발송·계정 관리) ② 저장한 장소·경로(장소명·좌표, 기기 간 동기화) ③ 서비스 이용 기록(행태 이벤트, 서비스 개선) ④ IP 주소(보안·어뷰즈 방지). 출생연도는 만 14세 확인용으로 기기에서만 검사하며 서버로 전송·저장하지 않습니다.
- 보유·이용 기간: 회원 탈퇴(계정 삭제) 시까지. IP 기반 보안 카운터는 약 7일, 보안 감사 기록은 최대 90일 후 파기. 관계 법령에 따라 보존이 필요한 경우 해당 기간 동안만 보존.
- 국외 이전: ① PostHog, Inc.(미국) — 서비스 이용 행태 분석, 이벤트 발생 시점에 전송 ② Vercel, Inc.(미국) — 웹 호스팅·접속 로그 ③ Google LLC(미국) — 웹폰트 제공(접속 IP). 데이터베이스·계정 정보는 대한민국(서울 리전, Supabase)에 저장됩니다. 이용자는 국외 이전을 거부할 권리가 있으며, 거부 시 서비스 이용이 제한될 수 있습니다.
- 파기 절차·방법: 보유 기간 경과 또는 처리 목적 달성 시 전자적 파일은 복구 불가능한 방법으로 즉시 파기합니다.
- 이용자 권리: 열람·정정·삭제·처리정지 요구 가능. 앱 내 계정 삭제 기능 또는 이메일(wouldyoukorean@gmail.com)로 요청. 만 14세 미만 아동은 가입할 수 없습니다.
- 개인정보 보호책임자: 김영민 · 연락처 wouldyoukorean@gmail.com
- 권익 침해 구제: 개인정보분쟁조정위원회(1833-6972) · 개인정보침해 신고센터(privacy.kisa.or.kr, 국번 없이 118)
10. Service provider (사업자 정보)
- Service: WYK Pass — website (wouldyoukorean.com/pass) and mobile app (
com.wouldyoukorean.pass) - 상호(Business name): 우쥬코리안 (WouldYouKorean)
- 대표(Representative): 김영민
- 사업자등록번호(Business registration no.): 206-49-61036
- Hosting: Vercel, Inc. (web) · Supabase (database, Seoul region, South Korea)
- Contact / 문의: wouldyoukorean@gmail.com