Privacy Policy
Version 1 · October 10, 2026 – October 14, 2026
Key points
- What: the random user number your Apple or Google sign-in gives us, a summary of your hoop for each year (dates and patch types — no text, photos, or places), short text used to pick patches, app usage events, and visit records from our intro site (viva.bang9.dev).
- What might surprise you: to pick a patch, the names of things in a photo, event titles, Instagram captions, and notes you write pass through our server to Cloudflare in the US and the model provider TypeSafe AI (through OpenRouter in the US if Cloudflare doesn't answer; see "AI classification"). Names of other people left in event titles can be included.
- Ads and analytics: before you subscribe, the app shows Google AdMob ads. The app and the intro site use Google Analytics and Meta ad measurement to measure which ads and posts lead to installs and app store visits. In the EU, the UK, and Switzerland, the intro site doesn't do this, and the app asks first (for ads, through Google's ad consent form) and does it only after you allow it. Elsewhere you can turn it off in Settings › Your Privacy Choices in the app or in Your Privacy Choices (see "Ads and analytics — Consent and how to turn things off").
- Who and where: we hand work to servers, database, and AI classification (Cloudflare, US), subscription checks (RevenueCat, US), a backup route for AI classification (OpenRouter, US), and app and intro site analytics (Google, US). For Android photo labels (Google ML Kit), ads in the app (Google AdMob), and ad measurement (Meta, US), your phone or browser sends data straight to the company, which also uses it for its own purposes.
- How long: account data until you delete your account, usage counts for two days, app usage events and intro site visit records for about three months.
- Your rights and contact: delete right away with Settings › Delete account in the app; for access, correction, deletion, or restriction of anything else, write to us using our contact details.
Who is responsible, and our privacy contact
The controller for viva is winterlog studio ("we", "us"), and our privacy contact (the person who handles questions and complaints about personal data) is the owner, Hyungu Kang.
- Business name: winterlog studio
- Owner and privacy contact: Hyungu Kang
- Address: 5-12 Gwangmyeong-ro 347beon-gil, Jungwon-gu, Seongnam-si, Gyeonggi-do, Republic of Korea
- Email: support@bang9.dev
- Phone: +82 10 9688 1157
- Business registration no.: 577-24-02412
All requests, questions, and appeals under this policy go to the email address above.
What we collect and what we use it for
We use personal data only for the purposes below. For users in the EU, the UK, and Switzerland, the app's usage events and its Google Analytics and Meta ad measurement happen only after you allow them in the app, and personalized ads in the app only after you agree in Google's ad consent form (consent). Everything else either performs our contract with you (providing the service) or is based on our legitimate interests. In Korea, analytics, ads in the app, and ad measurement are disclosed in this policy as entrustment (work we hand to a provider to do on our behalf) without separate consent (Korea PIPA §26).
Sign-in and accounts — one account per person, the same hoops on any phone
Data used Sign-in user number, account number
Legal basis Contract (Korea PIPA §15(1)4, GDPR 6(1)(b))
Syncing hoops by year — getting them back on another phone or after reinstalling
Data used Hoop summaries by year
Legal basis Contract
Picking patch designs (AI classification)
Data used Classification text
Legal basis Contract
Checking your subscription
Data used Account number, subscription records
Legal basis Contract
Handling store refund requests
Data used Whether the purchase was delivered, our view on the refund
Legal basis Contract and your agreement to the Terms (when you pay in the app). Not done in the EU, the UK, and Switzerland
Preventing abuse — daily usage limits
Data used Account number, pseudonymized IP address
Legal basis Legitimate interest: keeping the service running by stopping excessive and automated requests (PIPA §15(1)6, GDPR 6(1)(f))
Improving the app — seeing where people get stuck, and which actions lead to coming back and subscribing
Data used Usage events
Legal basis Legitimate interest: making the app easier to use (in the EU, the UK, and Switzerland only if you allow it in the app — consent, GDPR 6(1)(a))
Answering your questions
Data used Sender's email address, message
Legal basis Contract
Intro site analytics — seeing where visitors come from and whether they go on to the app stores
Data used Intro site visit records, data sent to Google Analytics
Legal basis Legitimate interest: seeing which introductions and ads help, and improving them. Not done for visitors from the EU, the UK, or Switzerland
Measuring ads and posts (Meta)
Data used Data sent to Meta (ad cookies, the page viewed and page events, IP address, browser information)
Legal basis Legitimate interest: seeing whether ads work. Not done for visitors from the EU, the UK, or Switzerland
App analytics (Google Analytics) — seeing which actions lead to coming back and subscribing
Data used Data sent to Google Analytics from the app
Legal basis Legitimate interest. In the EU, the UK, and Switzerland, only if you allow it in the app (consent, GDPR 6(1)(a))
Measuring app ads (Meta App Events) — seeing which ads lead to installs
Data used Data sent to Meta from the app
Legal basis Legitimate interest. In the EU, the UK, and Switzerland, only if you allow it in the app (consent)
Ads in the app before you subscribe (Google AdMob) — showing and measuring ads
Data used Data sent to Google AdMob from the app
Legal basis Legitimate interest: funding the features you use before subscribing with ads. In the EU, the UK, and Switzerland, ads are requested only after Google's ad consent form, and personalized ads only if you agree there (consent, GDPR 6(1)(a))
Sign-in provider (Apple or Google) and the random user number it gives us
Source Confirmed by Apple or Google when you sign in
Random account number, when the account was created, whether free entries were used before subscribing
Source Created by our server
Hoop summaries by year: for each moment its date, patch type ID, category, source (photo, calendar, Instagram, workout, or your own note), distance and duration; marks for removed moments; the number of photos; whether the hoop is still filling or finished
Source Uploaded by the app (also without a subscription)
Classification text: names of things in a photo, event titles (with people's names we can recognize removed), Instagram captions, notes you write about a day
Source Sent by the app (while you're subscribed; before you subscribe, when you add an entry you wrote)
Subscription check results: whether you're subscribed, when it expires
Source Asked from RevenueCat
Purchase records: account number (RevenueCat customer ID), purchase, subscription, renewal, and refund records, plus the device type, OS and app version, language and region settings, and IP address that the in-app payment feature sends along
Source Sent straight to RevenueCat by the in-app payment feature (RevenueCat SDK) when you sign in and when you subscribe
Daily usage: counts per account number and per pseudonymized IP address
Source Counted by our server
Usage events: random device ID, phone type (iOS or Android), the shape of the screen path you opened (like /settings), features you used and their outcome (for example, where you met the payment screen, or whether you allowed a permission or notifications — short values like a type or a range), app language, country, on Android the install source once at first launch (where you first came from, as Google Play reports it), and subscription payment, renewal, and auto-renewal-off records (store, country, amount)
Source Sent by release builds of the app; the country comes from Cloudflare's IP lookup (the IP address itself isn't kept). When you subscribe, the app also attaches this device ID to RevenueCat to link subscription records to it, and RevenueCat reports those records to our server (we don't keep the account number with them)
Support email: sender's address and message
Source Emails you send us
Intro site visit records: random browser ID, the page path (/) and the app store button you tapped, how you first arrived (the utm values of an ad or post link, otherwise the kind of site you came from), the domain of the site you came from, page language, country
Source Sent by the intro site's measurement script; the country comes from Cloudflare's IP lookup (the IP address itself isn't kept)
Data sent to Google Analytics and Meta: Google Analytics visitor cookies, Meta ad cookies, the page address and page events (page viewed, app store button), IP address, device and browser information
Source Sent by your browser straight to Google and Meta on the intro site. Google uses the IP address only to work out an approximate location and doesn't keep it
Data sent to Google Analytics from the app: the Firebase app instance ID, app events (actions like signing up, signing in, an entry, Add more, the payment screen, starting a payment, and sharing, with their fixed values — no moment text, photos, or Instagram content), in-app purchases (product, amount, currency), device information, approximate location worked out from the IP address, and the iPhone advertising identifier (only if you allow tracking)
Source Sent straight to Google by Google Analytics (Firebase) in the app. Google doesn't keep the IP address
Data sent to Meta from the app: a random ID made by the Meta SDK, app installs and launches, signing up, the first entry, starting a payment, in-app purchases (product, amount, currency), IP address, device information, and the device advertising identifier (Android, or an iPhone that allowed tracking)
Source Sent straight to Meta by Meta App Events (the Meta SDK) in the app
Data sent to Google AdMob from the app (only before you subscribe): the advertising identifier (Android advertising ID, or the IDFA on an iPhone that allowed tracking), IP address and the approximate location worked out from it, device and app information (model, OS, app version, language), ad views and taps and ad diagnostics, and your ad consent status
Source Sent straight to Google by the Google AdMob SDK in the app
Requests to our server carry a sign-in token (a value that keeps you signed in, valid for 180 days). The token is kept in your phone's secure storage.
Information about other people
Event titles, Instagram captions, and notes you write can contain the names or nicknames of family and friends. Your phone removes people's names it can recognize before sending, but it doesn't always catch every one. This text comes from your phone (calendar, Instagram export) or from what you wrote, and is used only to pick a patch design. Our server doesn't store it and discards it once classified; only a classification record that isn't linked to any account remains.
Why we don't notify those people: we don't know who they are or how to reach them, and we don't keep the text, so we have no way to tell them (GDPR 14(5)(b)). On request, we'll point to this policy as the source.
What stays on your phone, and app permissions
- Looking through photos: the names of things in your photos (like "cafe" or "cup") are read only by your phone's own features (iOS Vision, Android ML Kit). Photo pixels, files, and photo IDs are never uploaded.
- Photo locations: the location (GPS) saved in a photo is read on your phone and kept only in a cache on your phone. It isn't sent to our server, and our server rejects requests that contain location fields.
- Calendar: events are read, never changed. Event titles and places stay on your phone (a title is sent, with names removed, only for classification).
- Workouts: from Apple Health or Health Connect, the app reads only the date and type of each workout and turns them into patches on your phone. It doesn't use or store figures like distance, workout duration, or heart rate, and doesn't write to Health. Workout data isn't used for ads, marketing, or sale; only the days you stitch (date, patch type, and source) are kept on our server in your hoop summary, like any other moment.
- Instagram export: the zip file you hand over is opened on your phone only.
- Your notes and copies of attached photos stay in the app's folder on your phone.
- "Try it" on the intro site: the line you write is turned into a patch inside your browser and isn't sent anywhere.
What's on your phone is removed when you use Settings › Sign out or Delete account, or delete the app. If you turn a permission off, the app stops reading that data from then on.
Every app permission is optional. Without them you can still add entries by writing.
Photos (iOS Photo Library; Android photos or selected photos)
Why To look through the year's photos and attach photos to an entry
Required? Optional
Photo location (Android media location)
Why To pick travel and place patches from where a photo was taken (on your phone only)
Required? Optional
Save photos (iOS)
Why To save a story card to Photos
Required? Optional
Calendar
Why To find what you did in the year from your events (read only)
Required? Optional
Health (workouts in iOS Health; exercise and past records in Android Health Connect)
Why To make patches from the days and types of your workouts (read only)
Required? Optional
Turning them off: on iPhone, Settings › viva; on Android, Settings › Apps › viva › Permissions — at any time. For Health, use iPhone Settings › Health › Data Access & Devices › viva, or the Health Connect app on Android.
How long we keep it and how we delete it
Sign-in provider and random user number
Why Sign-in, finding your account
How long Until you delete your account
Random account number, creation time, whether free entries were used before subscribing, whether and when you agreed to AI classification
Why Your account, notices about free entries before subscribing, a record of your AI classification choice
How long Until you delete your account
Hoop summaries by year (dates, patch types, categories, sources, distance and duration, removal marks, photo counts, status)
Why Seeing the same hoops on another phone
How long Until you delete your account
Classification text (names of things in photos, event titles with names removed, captions, your notes)
Why Picking patch designs
How long Not stored (sent and discarded)
Other people's names or nicknames left in classification text
Why Picking patch designs (not used otherwise)
How long Not stored (sent and discarded)
Classification records (not linked to any account or IP)
Why Not asking about the same words twice
How long One year from creation
Daily usage per account number and pseudonymized IP address
Why Preventing abuse
How long 2 days from collection
Whether you're subscribed, expiry time
Why Checking your subscription (kept while you're subscribed, also deleted with your account)
How long 1 day after the subscription ends
Purchase and subscription records at RevenueCat
Why Checking and restoring your subscription
How long Until you ask us to delete your account
Usage events (random device ID, phone type, screen, features and their outcome, language, country, Android install source, subscription records)
Why Improving the app — which actions lead to coming back and subscribing
How long 3 months from collection
Intro site visit records (random browser ID, page, app store button, how you first arrived, domain of the site you came from, language, country)
Why Intro site analytics
How long 3 months from collection
Visit records sent to Google Analytics (visitor cookies, page, page events, approximate location, device and browser information)
Why Intro site analytics (kept by Google)
How long 2 months from collection
Ad measurement data sent to Meta (ad cookies, page, page events, IP address, browser information)
Why Measuring ads and posts
How long Not kept by us — data Meta receives is under Meta's policy
Usage data sent to Google Analytics from the app (app instance ID, app events, in-app purchases, device information, approximate location)
Why App analytics (kept by Google)
How long 2 months from collection
Ad measurement data sent to Meta from the app (random ID made by the Meta SDK, app installs and launches, signing up, the first entry, starting a payment, in-app purchases, IP address, device information, advertising identifier)
Why Measuring app ads
How long Not kept by us — data Meta receives is under Meta's policy
Ad data sent to Google AdMob from the app (advertising identifier, IP address and approximate location, device and app information, ad responses and diagnostics, ad consent status)
Why Showing and measuring ads in the app before you subscribe
How long Not kept by us — data Google receives is under Google's policy
App update check data (IP address, random install ID, phone type, app version, update number, last error message)
Why Receiving app updates
How long We don't keep it — Expo handles what it receives under its policy
Snapshot records from earlier test builds (including purchase numbers)
Why No longer used
How long Deleted, as it's no longer used
Support email (address and message)
Why Answering your questions
How long 3 years from collection
Photos, names of things in them, photo locations, photo IDs, copies of photos attached to entries
Why Picking patches (on your phone only)
How long On your phone only (removed with the app)
Event titles, places, and dates
Why Finding what you did in the year (on your phone only)
How long On your phone only (removed with the app)
Workout dates and types (Apple Health, Health Connect)
Why Turning the days you worked out into patches (on your phone only; no figures are used)
How long On your phone only (removed with the app)
Your notes, the Instagram export file, sign-in token
Why Filling hoops, sign-in (on your phone only)
How long On your phone only (removed with the app)
Payment records that must be kept by law are kept by the sellers, Apple and Google, under their own policies. Data we must keep by law (support email in the table above) is kept separately and only for that period.
Deletion (erasing data so it can't be recovered): when you delete your account with Settings › Delete account in the app, we delete your account, sign-in link, hoop summaries by year, subscription check, and usage counts kept by account number from our database right away (without the app, see Delete Your Account). Other data is deleted when its period in the table above ends, and we delete RevenueCat purchase records when you ask. Deleted data remains in database backups for up to 30 days and then disappears.
Service providers, disclosure to third parties, and international transfers
Service providers (processors): we use the providers below to do work on our behalf. Their terms and data processing agreements limit them to the tasks we give them and require the same level of protection as this policy.
Cloudflare, Inc.
Task Running servers and the database, storing usage events, forwarding support email, running the AI classification model
Country United States
650 Industries, Inc.
Task Delivering app updates
Country United States
Google LLC
Task App analytics (Google Analytics for Firebase)
Country United States
Google LLC
Task Intro site analytics (Google Analytics)
Country United States
NAVER Corp.
Task Support email inbox
Country South Korea
OpenRouter, Inc.
Task Routing AI classification requests (picking patch designs from short text) that get no answer from Cloudflare
Country United States
RevenueCat, Inc.
Task Confirming and recording subscription purchases, linking subscription payments to usage events
Country United States
TypeSafe AI, Inc. (model provider)
Task Computing patch designs (AI classification)
Country United States
Sign-in is handled by Apple (Sign in with Apple) and Google (Sign in with Google), and payment by the sellers, Apple (App Store) and Google (Google Play), under the terms and policies you agreed to with them. We only receive the user number and subscription results they confirm.
Apart from the cases in the table below, we don't disclose your personal data to third parties for their own use. Disclosures required by law, such as under a court order, are the exception.
Google LLC — policies.google.com/privacy
Country United States
Data Usage statistics of the Android photo labeling feature (ML Kit): device model, OS version, app name and version, feature usage counts, processing time, a random per-installation ID (no photo or label content)
Recipient's purpose Measuring and improving how ML Kit works, and detecting misuse (Google's own purposes)
When and how Sent straight from your phone to Google when you look through photos on Android, over an encrypted connection
Retention Under Google's policy
How to refuse, and what happens Turning off the Photos permission stops it together with photo labeling; patches are then no longer picked from photos
Meta Platforms, Inc. — facebook.com/privacy/policy
Country United States
Data On the intro site: Meta ad cookies, the page address and page events (page viewed, app store button), IP address, browser information
Recipient's purpose Measuring ads and posts, and also choosing and improving ads under Meta's policies (Meta's own purposes)
When and how Sent straight from your browser to Meta when you open the intro site (viva.bang9.dev) and when you tap an app store button, over an encrypted connection
Retention Under Meta's policy
How to refuse, and what happens Not sent if you opt out of sale and sharing (the Your Privacy Choices section of this policy) or your browser sends a GPC signal. Opting out doesn't affect using the site or the app. Not sent for visitors from the EU, the UK, or Switzerland
Meta Platforms, Inc. — facebook.com/privacy/policy
Country United States
Data In the app: a random ID made by the Meta SDK, app installs and launches, signing up, the first entry, starting a payment, in-app purchases (product, amount, currency), IP address, device information, and the device advertising identifier (Android, or an iPhone that allowed tracking)
Recipient's purpose Measuring app ads (linking installs to ads); Meta also uses it under its own policy to choose and improve ads (Meta's own purposes)
When and how Straight from your phone to Meta while you use the app, over an encrypted connection
Retention Under Meta's policy
How to refuse, and what happens How to turn it off is under "Ads and analytics — Consent and how to turn things off" below. Turning it off doesn't affect using the app. In the EU, the UK, and Switzerland, it's sent only if you allow it in the app
Google LLC — policies.google.com/privacy
Country United States
Data In the app: the advertising identifier (Android advertising ID, or the IDFA on an iPhone that allowed tracking), IP address and approximate location, device and app information, ad views and taps and ad diagnostics, and your ad consent status
Recipient's purpose Showing and measuring ads in the app before you subscribe; Google also uses it under its own policy to choose and improve ads (Google's own purposes)
When and how Straight from your phone to Google when the app requests an ad before you subscribe, over an encrypted connection
Retention Under Google's policy
How to refuse, and what happens Once you subscribe, the app no longer requests ads. How to turn off personalized ads and the advertising identifier is under "Ads and analytics — Consent and how to turn things off" below. Either way, it doesn't affect using the app. In the EU, the UK, and Switzerland, it's sent only after Google's ad consent form
Apple Inc. — apple.com/legal/privacy, Google LLC — policies.google.com/privacy
Country United States
Data Whether the purchase was delivered, our view on the refund
Recipient's purpose Deciding whether to refund the purchase (the store's own purpose)
When and how When a refund request for a subscription bought in the app reaches the store, from us through RevenueCat (which works for us) to that store, over an encrypted connection
Retention Under the store's policy
How to refuse, and what happens Applies only to subscriptions bought in the app. Not done in the EU, the UK, and Switzerland
International transfers (sending personal data to another country, or letting it be accessed from one) happen through the service providers in the table below and the recipients in the third-party table above. Transfers for servers, subscription checks, and AI classification are entrustments needed to run the service and are disclosed in this policy (Korea PIPA §28-8(1)3). Transfers for app and intro site analytics (Google Analytics), ads in the app before you subscribe (Google AdMob), and ad measurement (Meta) are entrustments that aren't essential to the service and are disclosed in this policy.
Cloudflare, Inc. — www.cloudflare.com/privacypolicy/
Country United States
Data transferred Account number, sign-in links, hoop summaries, subscription check results, usage counts, usage events, classification text in transit, support email
Purpose Running servers and the database, storing usage events, forwarding support email, running the AI classification model
When and how Each time the app calls our server, over an encrypted connection
Retention As in the retention table
650 Industries, Inc. — expo.dev/privacy
Country United States
Data transferred IP address, a random ID made for each app install, phone type, app version and the update currently in use, and the error message if the last run stopped because of an app error
Purpose Delivering app updates
When and how When the app starts, straight from your phone to Expo over an encrypted connection
Retention Under Expo's policy
Google LLC — firebase.google.com/support/privacy
Country United States
Data transferred Firebase app instance ID, app events and their fixed values, in-app purchases, device information, approximate location worked out from the IP address, and the iPhone advertising identifier if allowed
Purpose App analytics (Google Analytics for Firebase)
When and how Straight from your phone to Google while you use the app, over an encrypted connection (only when this device's choice allows)
Retention 2 months from collection
Google LLC — policies.google.com/privacy
Country United States
Data transferred Google Analytics visitor cookies, the page address and page events, approximate location worked out from the IP address, device and browser information
Purpose Intro site analytics (Google Analytics)
When and how Sent from your browser straight to Google when you open the intro site (viva.bang9.dev) and when you tap an app store button, over an encrypted connection (not sent for visitors from the EU, the UK, or Switzerland, or from browsers that opted out of sale and sharing)
Retention 2 months from collection
OpenRouter, Inc. — openrouter.ai/privacy
Country United States
Data transferred Classification text (names of things in photos, event titles with names removed, Instagram captions, your notes)
Purpose Routing AI classification requests (picking patch designs from short text) that get no answer from Cloudflare
When and how Sent by our server only for classifications that get no answer from Cloudflare (encrypted connection)
Retention Not stored (brief retention for abuse monitoring as set out in its terms)
RevenueCat, Inc. — www.revenuecat.com/privacy
Country United States
Data transferred Account number (RevenueCat customer ID), purchase, subscription, renewal, and refund records, the random device ID for usage events attached when you subscribe, plus the device type, OS and app version, language and region settings, and IP address sent by the in-app payment feature
Purpose Confirming and recording subscription purchases, linking subscription payments to usage events
When and how When you sign in, and each time you subscribe or your subscription is checked, from the app and our server over an encrypted connection
Retention Until you ask us to delete your account
TypeSafe AI, Inc. (model provider) — typesafe.ai/legal/privacy-policy
Country United States
Data transferred Classification text
Purpose Computing patch designs (AI classification)
When and how When Cloudflare or OpenRouter passes a request to the model (encrypted connection)
Retention As set out in its terms
How to refuse, and what happens: if you don't want classification text to leave your phone, don't write text in an entry and don't connect Photos, Calendar, or Instagram with Add more. Patches are then picked by on-phone rules only and may fit less well. Sign-in and subscriptions don't work without our server and subscription checks, so refusing those means deleting your account. Transfers for analytics, ads in the app, and ad measurement can be turned off as described in the third-party table above and under "Ads and analytics — Consent and how to turn things off" below, and turning them off doesn't affect using the site or the app.
Data from users in Europe comes to Korea under the EU adequacy decision for Korea (2022/254). Transfers to US providers rely on the EU-U.S. Data Privacy Framework where the provider participates, or on the provider's data processing terms with standard contractual clauses.
AI classification
- Who processes it: our server asks an AI model made by TypeSafe AI (TypeSafe AI, Inc., US) through the AI model service of Cloudflare (Cloudflare, Inc., US). Only requests that get no answer from Cloudflare are sent, with the same text, to the same model through OpenRouter (OpenRouter, Inc., US). OpenRouter is an intermediary that routes requests to model companies. We have no contract with the model provider TypeSafe AI directly, and we haven't yet received its contact details, retention period, training use, or the basis for transfers to it, so we can't list them. Send questions about this company using our contact details and we'll look into them through Cloudflare and OpenRouter.
- What we send: one line of classification text at a time — names of things in a photo, event titles with names removed, Instagram captions, and notes you write about a day.
- What comes back: the chosen patch type, a confidence score, and two or three other candidates.
- How long: our server doesn't store the text; it keeps only classification records that aren't linked to any account, so the same words aren't asked twice. Whether Cloudflare, OpenRouter, and the model provider keep requests briefly for abuse monitoring depends on their terms.
- Training: we don't train AI on this text (AI classification in the Terms).
- Opting out: the app asks before sending anything the first time. If you don't agree, no classification text leaves your phone and patches are picked on the phone only. You can change this anytime in the app's Settings › Pick patches with AI.
Ads and analytics — What's stored on your device, and the tools
The app's usage events are first-party statistics kept on our server, and analytics and ad measurement turn on only when this device's choice allows. If you sign out or delete your account, the app deletes the device ID and the Google Analytics and Meta IDs, and creates new ones the next time it sends. The intro site stores nothing in the browsers of visitors from the EU, the UK, or Switzerland; browsers that opt out of sale and sharing get no Google or Meta cookies, and any already set are deleted.
Usage events (our own stats) — random device ID (also attached at RevenueCat when you subscribe)
Company (country) winterlog studio, the operator (Korea), stored with Cloudflare (US); the device ID is linked at RevenueCat, Inc. (US)
Purpose Improving the app — seeing where people get stuck, and which actions lead to coming back and subscribing
How long 3 months from collection (the device ID attached at RevenueCat stays with the purchase record until you delete your account)
Required? No — you can object as described under "Consent and how to turn things off" below (in the EU, the UK, and Switzerland, only if you allow it)
Sign-in token
Company (country) winterlog studio, the operator (Korea)
Purpose Keeping you signed in
How long Until you sign out or delete the app (the token stops working after 180 days)
Required? Yes
RevenueCat SDK
Company (country) RevenueCat, Inc. (US)
Purpose Checking and recording subscription purchases, restoring purchases
How long Until you ask us to delete your account
Required? Yes — for subscriptions (to stop it, delete your account and the app)
ML Kit (Android)
Company (country) Google LLC (US)
Purpose Measuring how the photo label feature works and performs
How long Under Google's policy
Required? Only when you use photo labels — stops if you turn off photo access
Google Analytics for Firebase (app) — app instance ID
Company (country) Google LLC (US)
Purpose App analytics
How long 2 months from collection
Required? No — you can turn it off in Settings › Your Privacy Choices
Meta App Events (app) — random ID made by the Meta SDK, and the advertising identifier if allowed
Company (country) Meta Platforms, Inc. (US)
Purpose Measuring app ads
How long Under Meta's policy
Required? No — you can turn it off in Settings › Your Privacy Choices
Google AdMob (app, only before you subscribe) — advertising identifier, ad consent status
Company (country) Google LLC (US)
Purpose Showing and measuring ads in the app
How long Under Google's policy (ad consent status stays on your phone until you delete the app)
Required? No — used only before you subscribe. You can turn off personalized ads in Settings › Your Privacy Choices (in the EU, the UK, and Switzerland, through Google's ad consent form)
Intro site visit records (our own stats) — random ID, utm values, and how you first arrived, in browser storage
Company (country) winterlog studio, the operator (Korea), stored with Cloudflare (US)
Purpose Intro site analytics
How long Values in browser storage until you clear them (utm values and how you first arrived are set again after 7 days); server records 3 months from collection
Required? No — can be turned off as described under "Consent and how to turn things off" below
Google Analytics 4 — visitor cookies
Company (country) Google LLC (US)
Purpose Intro site analytics
How long Cookies 2 years; records Google receives 2 months from collection
Required? No — off when you opt out of sale and sharing or send GPC
Meta pixel — ad cookies
Company (country) Meta Platforms, Inc. (US)
Purpose Measuring ads and posts
How long Cookies 90 days; data Meta receives under Meta's policy
Required? No — off when you opt out of sale and sharing or send GPC
Sale and sharing opt-out cookie
Company (country) winterlog studio, the operator (Korea)
Purpose Remembering this browser's opt-out
How long 400 days
Required? Yes — needed to honor the opt-out
How Google uses this information is explained in How Google uses information from sites or apps that use our services.
Third parties, including Google and Meta, may use cookies, web beacons, advertising identifiers, and similar technologies to collect or receive information from this site, the app, and elsewhere on the internet, and use it to show and measure ads and to choose targeted ads. To opt out of targeted ads, use Google ad settings, Meta ad settings, aboutads.info, or youronlinechoices.eu.
Ads and analytics — Consent and how to turn things off
- App — Korea and elsewhere: choose Don't allow in Settings › Your Privacy Choices in the app to turn off Google Analytics and Meta ad measurement and delete the IDs they stored on your phone; ads in the app then request only non-personalized ads. To object to usage events, tell us using our contact details.
- App — EU, UK, and Switzerland (and when we can't tell your country): the app asks first, and records usage events and uses Google Analytics and Meta ad measurement only after you allow it. Choose Don't allow to stop all three and delete the IDs stored on your phone (including the device ID). For ads, the app shows Google's ad consent form (UMP) the first time it requests one and requests ads only after you choose; personalized ads are used only if you agree in that form and this device's choice also allows it. To show this form, the ad SDK may first send device and app information to Google. You can change this anytime in Settings › Your Privacy Choices.
- iPhone tracking permission (ATT): only on a device where Google Analytics and Meta ad measurement are on (in the EU, the UK, and Switzerland, only after you allow them in the app), the app asks once with the App Tracking Transparency (ATT) prompt. Only if you allow tracking is the advertising identifier (IDFA) sent to Google and Meta; otherwise events are sent without the advertising identifier (app installs from ads are counted with Apple's SKAdNetwork). Ads in the app (Google AdMob) follow the same permission. To turn it off later, turn viva off in iPhone Settings › Privacy & Security › Tracking.
- Advertising identifiers: Meta ad measurement uses the device advertising identifier to measure which ads lead people to install the app, and ads in the app before you subscribe use it to choose and measure ads — the advertising ID on Android, and on iPhone the IDFA if you allowed it in ATT. Google Analytics uses only the iPhone IDFA, and only if you allowed it. On Android, you can delete or reset the advertising ID under Ads (or Google › Ads) in your phone's settings.
- Intro site — EU, UK, and Switzerland: non-essential cookies and storage may be used only after consent. If you visit from these countries (worked out from your IP address), or we can't tell which country you're visiting from, we don't record your visit and don't use Google Analytics or Meta ad measurement.
How to turn things off on the intro site: open viva.bang9.dev/?notrack=1 once and visit records, Google Analytics, and Meta ad measurement all stay off in that browser (?notrack=0 undoes it). To turn off only Google Analytics and Meta ad measurement, use "Opt out in this browser" in Your Privacy Choices; Google and Meta cookies already set are deleted then too. You can also clear or block cookies and site data in your browser settings.
Your Privacy Choices
Under the privacy laws of several US states, you can opt out of the sale and sharing of your personal information right here. This browser's status is shown at the end of this section, and if you haven't opted out yet, you can do it there.
We don't sell personal information for money. However, Meta ad measurement on the intro site (sending ad cookies, the page viewed, and page events to Meta) and in the app (sending a random ID made by the Meta SDK, the advertising identifier, and app events to Meta), and ads in the app before you subscribe (Google AdMob sending the advertising identifier and how you respond to ads to Google for personalized ads), may count as "sharing" or "selling" for targeted advertising under some US state laws.
How to opt out: (1) Tap "Opt out in this browser" in "Status in this browser" below. We set an opt-out cookie in this browser, don't turn on Meta ad measurement or Google Analytics in it, and delete Google and Meta cookies already set. (2) Email us at the address in our contact details with "Do not sell or share". In the app, opt out in Settings › Your Privacy Choices (the app doesn't receive GPC signals).
An opt-out applies only to that browser, so opt out separately in other browsers and devices. Clearing your browser's cookies also clears opt-out (1).
Global Privacy Control (GPC): if your browser sends a GPC signal, we treat it as an opt-out of sale and sharing, and in that browser the intro site doesn't turn on Meta ad measurement or Google Analytics (visit records continue). Because you've already opted out, the link in (1) isn't shown; you can see whether we received the signal in "Status in this browser" below.
Appeals: if we can't act on your request, we'll tell you why. If you disagree, email us at the same address with "Appeal". We'll tell you the result within 60 days, and if it's still not resolved, you can complain to your state's attorney general.
External Transmission Disclosure (Japan)
Under Article 27-12 of Japan's Telecommunications Business Act, we disclose the information the viva app and our intro site (viva.bang9.dev) send from your phone or browser to others. The official Japanese disclosure is at 外部送信に関する公表事項.
RevenueCat, Inc. (US) — the RevenueCat SDK in the app
Information sent Account number (RevenueCat customer ID), purchase and subscription records (store receipts), random device ID for usage events (when you subscribe), device type, OS and app version, language and region settings, IP address
Purpose Checking and recording subscription purchases, restoring purchases, improving the app (linking subscription payments to usage events — device ID)
Us (winterlog studio) — our server on Cloudflare (data centers Cloudflare runs in many countries)
Information sent Random device ID, phone type, the shape of the screen path you opened, features you used and their outcome (short values like a type or a range), app language, the country you connected from (worked out from your IP address — we don't keep the IP address itself), Android install source (once at first launch)
Purpose Improving the app (seeing where people get stuck, and which actions lead to coming back and subscribing)
Google LLC (US) — ML Kit in the Android app
Information sent Device model, OS version, app name and version, how many times the feature was used, processing time, a random ID created for each install (no photo or label content)
Purpose Measuring how the photo label feature works and performs
Google LLC (US) — Google Analytics (Firebase) in the app
Information sent Firebase app instance ID, app events (actions like signing up, an entry, Add more, the payment screen, starting a payment, and sharing, with their fixed values), in-app purchases, device information, IP address, and the iPhone advertising identifier if allowed
Purpose App analytics
Meta Platforms, Inc. (US) — Meta App Events (Meta SDK) in the app
Information sent random ID made by the Meta SDK, app installs and launches, signing up, the first entry, starting a payment, in-app purchases, IP address, device information, and the device advertising identifier (Android, or an iPhone that allowed it)
Purpose Measuring app ads
Google LLC (US) — Google AdMob in the app (only before you subscribe)
Information sent Advertising identifier (Android advertising ID, or the IDFA on an iPhone that allowed it), IP address, device and app information (model, OS, app version, language), ad views and taps, ad diagnostics, ad consent status
Purpose Showing and measuring ads in the app
Us (winterlog studio) — the intro site's measurement script and our server on Cloudflare
Information sent Random browser ID, the page path and the app store button you tapped, how you first arrived (utm values, the site you came from), page language, the country you connected from (worked out from your IP address — we don't keep the IP address itself)
Purpose Intro site analytics
Google LLC (US) — Google Analytics on the intro site
Information sent Google Analytics visitor cookies, the page address and page events, IP address, device and browser information
Purpose Intro site analytics
Meta Platforms, Inc. (US) — the Meta pixel on the intro site
Information sent Meta ad cookies, the page address and page events, IP address, browser information
Purpose Measuring ads and posts
Transmissions that are essential to provide the service (sign-in, hoop syncing, and classification requests to our server; the Apple or Google sign-in you choose; store payments) aren't covered by the disclosure. Classification text is sent to Cloudflare (or OpenRouter if Cloudflare doesn't answer) by our server, not by your phone.
Children
viva isn't meant for children. You can't sign up if you're under 14 in Korea or under 13 elsewhere (or under a higher age set by the law of your country). If we learn that we've received information from someone younger, we delete it right away.
We don't run a parental consent process. We don't target ads at children.
Your rights and how to make a request
- Delete: Settings › Delete account in the app deletes your account and your hoops on our server right away. Without the app, follow Delete Your Account.
- Access and portability: we'll show you your data on our server (such as your hoop summaries) or send it as a JSON file.
- Correction, restriction, objection: you can object to processing based on legitimate interest (such as usage events).
- Agents: a legal guardian or someone you authorize can also make a request (with written authorization).
Apart from deleting in the app, make requests using our contact details. We act on or answer your request within 10 days of receiving it (Korea PIPA Enforcement Decree Arts. 41, 43, and 44). If we refuse, we'll tell you why and how to appeal. To make sure you own the account, we may ask for information such as a subscription order number.
Where to get help: if telling us doesn't resolve it, you can ask these bodies for help:
- Korea: Personal Information Dispute Mediation Committee, +82 1833-6972, www.kopico.go.kr
- Korea: Personal Information Infringement Report Center, 118, privacy.kisa.or.kr
- Korea: Supreme Prosecutors' Office 1301, Korean National Police Agency 182
- If you live in Europe, the UK, or elsewhere, you can complain to the data protection authority where you live (see the country notes below).
How we protect it
- Everything is sent over encrypted connections (HTTPS).
- Sign-in tokens can be issued only by us and stop working once you delete your account. On your phone they're kept in secure storage.
- IP addresses are never stored as-is; they're counted only in pseudonymized form. Our server logs don't record account numbers, tokens, or classification text.
- Server secrets are kept only in an encrypted secret store, and access to the database is limited to the operator.
- Our server rejects hoop uploads that contain text, places, or photo IDs (what we don't need, we don't accept).
Changes and language
This policy (version 1) was announced on October 3, 2026 and takes effect on October 10, 2026. If we change this policy, we'll announce it on this page before the change takes effect (on the effective date at the latest) and show what changed side by side with the previous version. If a new purpose or a new recipient is added, we'll tell you before that processing starts and ask for your consent where the law requires it.
This document was originally written in Korean. Translations are provided for convenience. If they differ, the original prevails, unless the law of the country where you live says otherwise.
Users in the EU, EEA, and UK
- Legal bases: contract (6(1)(b)) and legitimate interests (6(1)(f)), and consent (6(1)(a)) for the app's usage events, Google Analytics, Meta ad measurement, and personalized ads (Google AdMob) — see the table by purpose. Our legitimate interest is preventing abuse. You can withdraw consent at any time (see "Consent and how to turn things off").
- Your rights: access (Art. 15), rectification (16), erasure (17), restriction (18), portability (20), and objection (21). You can object at any time to processing based on legitimate interests.
- Automated decisions: we make no automated decisions with legal or similarly significant effects (we only pick patch designs).
- Complaints: you can complain to the supervisory authority where you live. In the UK that's the ICO (ico.org.uk). If you're in the UK and make a data protection complaint to us, we'll acknowledge it within 30 days (UK Data (Use and Access) Act 2025).
The United States and other countries
Users in the countries below can make requests under their country's law using our contact details. We process personal data only for the purposes above, and it's processed by service providers abroad (in the US).
United States (the law of your state)
Rights To know, access, correct, delete, and opt out of sale and sharing. We won't discriminate against you for using them
Reply period The period your state's law sets (usually 45 days)
Where to complain Appeals in the Your Privacy Choices section above
Brazil (LGPD Arts. 18 and 19)
Rights Confirmation of processing, access, correction, anonymization, blocking or deletion, portability, information about who we've shared your data with, and the consequences of not consenting
Reply period 15 days
Where to complain Brazil's data protection authority (ANPD)
Mexico (data protection law)
Rights Access, rectification, cancellation, opposition (ARCO)
Reply period 20 days
Where to complain —
Colombia (Law 1581 of 2012, Arts. 14 and 15)
Rights To know, correct, or delete your data, or confirm the basis for processing
Reply period Queries 10 business days, complaints 15 business days
Where to complain Superintendence of Industry and Commerce (SIC)
Argentina (Personal Data Protection Law, Arts. 14 and 16)
Rights Access (free once every six months), correction, deletion
Reply period Access 10 days, correction and deletion 5 business days
Where to complain Agency for Access to Public Information (AAIP)
Canada
Rights Access, correction
Reply period 30 days
Where to complain Office of the Privacy Commissioner of Canada (OPC), Quebec's Commission d'accès à l'information (CAI)
Türkiye (KVKK Arts. 11 and 13)
Rights The rights under KVKK Article 11
Reply period 30 days
Where to complain —
Chile
Rights Access, rectification, deletion, objection, portability
Reply period —
Where to complain Chile's data protection authority
Australia
Rights Access, correction
Reply period —
Where to complain Office of the Australian Information Commissioner (OAIC)
India
Rights Nominating someone to exercise your rights in case of death or incapacity
Reply period —
Where to complain —
Vietnam
Rights Access, correction, deletion, restriction
Reply period —
Where to complain —
Switzerland
Rights —
Reply period —
Where to complain Federal Data Protection and Information Commissioner (FDPIC)
Indonesia
Rights Access, correction, deletion, stopping processing
Reply period —
Where to complain —
- United States — categories of personal information we collect: identifiers (sign-in user number, account number, random device and browser IDs, IP address, ad cookies, advertising identifier), commercial information (subscription records), internet activity (app screens and features, how you respond to ads; on the intro site, the page viewed and page events), approximate location (country worked out from your IP address), and content you write (classification text, support email). Sources, purposes, recipients, and retention are as described in the sections above.
- United States — sharing: the categories of "sharing" described in Your Privacy Choices are identifiers (ad cookies, a random ID made by the Meta SDK, the advertising identifier, IP address) and internet activity (the page viewed, page events, app events, how you respond to ads), and the recipients are Meta and Google. We don't collect sensitive personal information or use it to infer characteristics.
- United States — Do Not Track and GPC: we don't respond to the browser Do Not Track signal specifically, and we treat a GPC signal as an opt-out of sale and sharing. Our ad measurement provider (Meta) may collect information about your activity on this site and other sites.
- Legal bases: in Brazil (LGPD Art. 7, V and IX) and Chile, performance of a contract and legitimate interest (see the table by purpose). In Mexico, every purpose is necessary to provide the service, so there are no secondary purposes that need separate consent, and international transfers are all to processors, so no separate consent is requested.
- Contacts: the data protection officer (encarregado) for Brazil, the person responsible for privacy questions in Canada, and the grievance contact for India are our privacy contact above.
- International transfers: for Brazil, see "International Transfers of Personal Data (Brazil)" below. Data about users in Quebec is transferred after we've checked each provider's level of protection, and transfers from Switzerland to US providers rely on the Swiss-U.S. Data Privacy Framework where the provider participates, or on standard contractual clauses.
Users in Japan
- Requests for disclosure, correction, suspension of use, or suspension of disclosure to third parties go to our contact details. We charge no fee.
- Handling personal data abroad (understanding the foreign environment): Korea — we handle it in Korea. Korea has the Personal Information Protection Act, supervised by the Personal Information Protection Commission (www.pipc.go.kr). United States — handled by Cloudflare, RevenueCat, OpenRouter, TypeSafe AI, Google, and Meta. The US has no single federal privacy law; privacy laws exist state by state.
- Provision to third parties abroad (including processors): the recipients and countries are those in the tables under "Service providers, disclosure to third parties, and international transfers". Cloudflare, RevenueCat, and OpenRouter keep measures equivalent to those required under Japan's Act on the Protection of Personal Information through their terms and data processing agreements. Google (ML Kit usage statistics, ads in the app) and Meta (ad measurement) each handle the data under their own policies.
- The information required when providing data to third parties abroad (Article 28(3) of Japan's Act) is available on request.
International Transfers of Personal Data (Brazil)
To provide the service, personal data of users in Brazil is transferred to Korea (to us) and to the US (to our service providers).
- Method and basis: transfers under processing agreements (each provider's data processing terms).
- Countries and recipients: see the international transfers table.
- Purpose and duration: see "What we collect and what we use it for" and the table under "How long we keep it and how we delete it".
- Responsibility: we are responsible for our providers' processing. Onward transfers by a recipient are limited to its own sub-processors.
- Your rights: the Brazil rights in the table under "The United States and other countries" apply equally to transferred data.