Privacy Policy

Effective date: August 15, 2026

Habit School (the “Service”) complies with the Personal Information Protection Act of the Republic of Korea and other applicable laws. This policy describes only the data the Service actually collects, stores, and transmits.

1. Personal information we collect

a. Required, collected automatically at Google sign-in

• Google account email address, display name, profile photo URL
• An internal unique identifier (UID)

b. Entered or uploaded by the user (optional)

• Meal photos, exercise photos and videos, sleep record photos, step-count screenshots
• Text the user writes, such as gratitude journal entries
• Records shared to the gallery, and comments and reactions left on other users’ posts
• A nickname used for public display when posting anonymously

c. Sensitive information (separate consent)

The following qualifies as sensitive information under Article 23 of the Personal Information Protection Act, and we obtain separate consent, distinct from the other items, at sign-up. Declining does not prevent registration or use of the core features; only the corresponding features are locked.

• Weight, blood glucose, blood pressure
• Body composition (muscle mass, body fat, visceral fat) and its history
• Blood test report images and the analysis derived from them

d. Collected when redeeming a coupon

• Recipient mobile phone number, used solely to deliver the mobile coupon

e. Collected when you use a Habit Coach chat command

Only when you enter a command beginning with ! in a KakaoTalk chat — !오늘, !연결 and the like — we collect the following in order to carry it out.

• The command you typed
• The name (nickname) KakaoTalk displays for you

f. Blockchain wallet data

• Wallet address
• Encrypted wallet private key and its encryption initialization vector (IV)

g. Collected automatically

• Service usage records, access logs, error logs
• Per-device push token, if push notifications are enabled
• Usage statistics and cookies via Google Analytics

2. Why we collect and use it

• Identifying members and handling sign-in
• Storing, retrieving, and summarizing health habit records
• Providing AI analysis of meals, exercise, and blood test results
• Operating the gallery (community), friends, and group features
• Awarding and managing points, and running weekly missions and challenges
• Exchanging points for mobile coupons and delivering them
• Issuing and displaying blockchain token rewards
• Linking a KakaoTalk group-chat account to an app account
• Sending push notifications
• Improving the service, responding to errors, and preventing abuse

3. Provision to third parties

We do not provide personal information to third parties without the user’s consent, except as follows.

This transfer occurs only when the user actively requests a coupon redemption. If no coupon is redeemed, no phone number is transmitted.

We may also provide information where a law specifically requires it, or where an investigative authority requests it through the procedures and methods prescribed by law.

4. Processing entrusted to others

Our agreements with processors include terms requiring personal information to be handled safely, and we oversee their compliance.

5. Where your data is stored, and transfers overseas

Where your data lives depends on what kind it is. Text — your logs, health figures and journal entries — is stored in Seoul, Republic of Korea, but the photos and videos you upload are stored in the United States. The table below sets out which is which.

Users may refuse the overseas transfer. Because the photo and video store is located abroad, refusing means the upload features cannot be used. Keeping logs and figures without photos remains fully available, and that data is stored in Korea.

6. How long we keep it

Personal information is retained while the account is active and, on account deletion, destroyed without delay and without exception. The Service handles no cash payments and so is not subject to the payment and goods-supply record retention duties of the E-Commerce Act; nothing is kept after deletion.

a. Deleted when you delete your account

• Member record and its subcollections (body composition history, blood test records, push tokens)
• Daily logs, gallery posts, share cards
• Every uploaded photo and video file, including thumbnails
• Notifications, reaction point ledger entries, group membership and check-in records
• Comments and reactions left on other users’ posts
• Our copies of the blockchain transaction records and point redemption records
• KakaoTalk group-chat linking data (sender identifier, nickname)
• The authentication account itself

The KakaoTalk identifier and nickname do not wait for account deletion — they are removed once the link is made, or after 30 days if it is not.

b. What the Service cannot delete

7. How we destroy personal information

• Information held as electronic files is permanently deleted by a method that prevents recovery.
• Deletion runs automatically on the server when an account deletion is requested, and the result is reported back to the user.

8. Your rights and how to exercise them

You may exercise the following rights at any time.

• Request access to your personal information
• Request correction of errors
• Request deletion
• Request suspension of processing
• Withdraw consent — sensitive information consent can be withdrawn at any time in the app’s settings, which locks the corresponding features
• Delete your account, directly from the Profile tab in the app

Requests may be made through the contact below and are handled without delay.

9. Children under 14

The Service does not accept registrations from children under the age of 14. We confirm that the user is 14 or older at sign-up, and if we learn that a user is under 14 we delete the account and the personal information collected without delay.

10. Security measures

• Encryption in transit via HTTPS
• Wallet private keys stored under AES-GCM encryption
• Access control and per-user data isolation through Firebase Security Rules
• Permission separation so a user can read and write only their own data
• Content Security Policy (CSP)

11. Cookies and automatic collection

The Service collects usage statistics through Google Analytics, which uses cookies. You may refuse cookies in your browser settings, though some features may then be limited.

12. Changes to this policy

If this policy changes, the change and its effective date will be announced within the Service. For changes unfavourable to users, we give at least 30 days’ notice before the effective date.