Privacy Policy

Article 1 (Personal Information Collected and Methods)

1. At Sign-Up (Required)

2. Information Generated During Service Use

3. Automatically Collected Information

4. When Connecting a Calendar (Optional, mog Plus)

• Event descriptions, locations, and attendees are not imported.
• mog sends only the title, time, and reminder of records the user assigned to a calendar. Record bodies and photos are never sent.
• mog's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. This information is used only to provide calendar sync, and is not used for advertising or to train AI models.

5. At Waitlist Sign-Up

Exact IP addresses and sub-country location data are not stored.

6. Information Not Collected

• Precise location (GPS coordinates, city-level address)
• Contacts and call records
• Information from other apps on the device
• Payment information (in-app purchases are handled directly by Apple/Google)

Article 2 (Purpose of Collection and Use)

Article 3 (Retention and Use Period)

1. The Company retains and uses personal information while a user uses the Service.
2. Upon a user's withdrawal request, the Company shall destroy personal information without delay. However, information required to be retained by applicable laws shall be stored for the applicable period.
3. When a calendar account is disconnected, its credentials (refresh token or app-specific password) are deleted immediately. Records imported from a calendar are kept until the user deletes them or withdraws.

Article 4 (Third-Party Disclosure)

The Company does not, in principle, provide users' personal information to third parties. The following cases are exceptions.

1. When the user has consented in advance
2. When required by applicable laws

When calendar sync is turned on, at the user's request mog sends event titles, times, and reminders to the calendar services the user connected (Google Calendar by Google LLC, iCloud Calendar by Apple Inc.) and receives events from those calendars.

Article 5 (Delegation of Processing)

The Company delegates personal information processing as follows for service provision.

Article 6 (Destruction of Personal Information)

1. The Company shall destroy personal information without delay when the retention period has expired or the purpose of processing has been achieved.
2. Information in electronic file form shall be permanently deleted using methods that prevent recovery.

Article 7 (User Rights and Exercise)

Users may exercise the following rights.

1. Right to Access: Users may view the processing status of their personal information.
2. Right to Correction and Deletion: Users may request correction or deletion of inaccurate personal information.
3. Right to Suspend Processing: Users may request the suspension of personal information processing.
4. Right to Withdraw Consent: Users may withdraw consent to the collection and use of personal information.
5. Right to Data Portability: Users may request a copy of their data by emailing the Privacy Officer. The Company will provide it in a reasonable format within the period required by applicable law.

Access, correction, deletion, suspension of processing, and withdrawal of consent can be exercised directly through the in-service settings. Data portability requests should be sent to the Privacy Officer email listed in Article 10.

Article 8 (Security Measures)

The Company implements the following technical and administrative measures to ensure the security of personal information.

1. Encryption at Rest: User data, databases, and backups stored in the cloud are encrypted using the industry- standard AES-256 algorithm.
2. Encryption in Transit: All communication between user devices and servers, as well as between internal server networks, is encrypted using TLS 1.2 or higher.
3. Local-First Storage: Core user content such as logs, memos, and images is stored in a local database on the device first; cloud synchronization is performed based on the user's login and selection.
4. Credential Protection: Authentication tokens issued through social login are encrypted and stored in secure storage provided by the operating system (iOS Keychain, Android Keystore).
5. Calendar Credential Protection: Google refresh tokens and iCloud app-specific passwords used for calendar sync are encrypted in the server's encrypted secret store (Supabase Vault) and cannot be read by the app or other users. An iCloud app-specific password is not your Apple ID password, and you can revoke it at any time at appleid.apple.com.
6. Access Control and Least Privilege: Company personnel's access to user content is limited to the minimum necessary for work, and access logs are recorded and managed.
7. Notice on End-to-End Encryption: The Service does not currently implement end-to-end encryption (E2EE). As such, the Company is technically capable of accessing user content. Actual access is limited to the following explicit and restricted circumstances.
   • Customer support or data recovery requested by the user
   • Diagnosis and recovery of service outages
   • Legal requirements or lawful requests from investigative authorities
   • Responses to fraudulent use or security threats

Article 9 (Cookies and Automatic Collection Devices)

Due to the nature of the mobile app service, cookies are not used. When using the web service, minimum necessary cookies for service operation may be used.

Article 10 (Privacy Officer)

The Privacy Officer overseeing personal information processing at the Company is as follows.

• Position: Representative
• Email: jsunee.dev@gmail.com

Article 11 (Changes to This Privacy Policy)

This Privacy Policy takes effect on the effective date. Any changes will be announced within the Service.