Privacy Policy

1. General

Haru Diary ("하루일기", the "App") is operated by a solo developer (the "Developer"), who treats users' personal information as important and complies with applicable law including the Personal Information Protection Act of the Republic of Korea. This policy explains how personal information is collected, used, stored, and destroyed in the course of using the App.

Haru Diary stores the user's diary on the user's device by default (local first). Personal information is sent to an external server only when the user uses certain features described below, such as cloud backup, accounts, and payment.

2. Personal Information Collected

The Developer collects and processes the following personal information.

• Sign-up and sign-in (optional feature): email address, password, nickname (display name), profile photo URL, whether the email is verified
• Device and usage information: a device identifier generated automatically by the App (a random UUID), operating system type (platform), app version, connection and activity timestamps
• Diary data: diary text written by the user, mood or emotion information, attached photos. This information is stored on the device by default and is stored on the Developer's server (Firebase) only if the backup feature is turned on.
• Payment and subscription information: whether a subscription (Pass) has been paid for, subscription expiry date, purchased product identifier, purchase time. Actual payment and card information is processed through the Apple App Store or Google Play; receipt validation and subscription status management are carried out through a subscription management service (RevenueCat); and the Developer does not store payment method information such as card numbers.
• AI feature usage information: the diary text and photos sent in order to perform the requested feature when using AI conversation, sentence polishing, handwriting photo conversion, or the monthly look-back. This information is used only to generate a response and is not used to identify the member (see section 8 below).
• Voice input: when the voice dictation feature is used, the speech recognition function of the operating system (iOS/Android) converts speech to text. This processing is performed by the device operating system, and the Developer does not separately store voice data.
• Inquiries and feedback: the content and category of the inquiry or feedback sent by the user, an (optional) contact address for a reply (email), account identifier, email, nickname, platform, app version
• Notification information: the notification token (FCM) and notification settings used to deliver reminders and push notifications
• App usage records: launching the App, screen navigation, and conversion events such as sign-up and saving a diary entry are collected through Google Analytics for Firebase. These are used only to improve the service; they are not used for advertising purposes and no advertising identifier is collected. Diary text is not transmitted (see section 7 below).

* Biometric data (Face ID/fingerprint) and the PIN (as a hash) used for app lock are processed and stored only inside the user's device and are not sent to the Developer's server.

3. How Personal Information Is Collected

• Information entered directly by the user when signing up or signing in
• Information generated or collected automatically while using the App (device identifier, platform, activity timestamps, and so on)
• Information sent when the user runs a feature such as backup or an inquiry

4. Purposes of Use

• Identifying and verifying members and maintaining the signed-in state
• Providing cloud backup and restore of diary entries
• Providing AI features such as AI conversation, sentence polishing, handwriting photo conversion, and the monthly look-back
• Providing voice input (dictation)
• Payment, renewal, and restore of a Pass (subscription), and providing free trials
• Preventing duplicate sign-ups and abuse, and determining eligibility for a single free trial (using the device identifier)
• Responding to inquiries and feedback and improving service quality
• Providing notifications the user has set, such as journaling reminders
• Improving features by analysing app usage records (not used for advertising purposes)

5. Retention and Use Period

In principle the Developer destroys personal information without delay once the purpose of collection and use has been achieved. When a member withdraws, the account and the diary data backed up to the cloud are deleted.

• Diary entries and photos stored only on the device are removed together with the App when the user deletes the App or deletes them within the App.
• However, where retention is required under applicable law (for example records of payment or withdrawal of subscription under electronic commerce law), the information is kept for the period that law prescribes.

6. Delegated Processing and Provision to Third Parties

To provide the service smoothly the Developer delegates processing of personal information as set out below, and does not provide personal information to third parties for purposes beyond those stated without the user's consent.

• Google LLC (Firebase Authentication, Cloud Firestore, Cloud Storage, Cloud Functions, Cloud Messaging): member authentication, storage of diary and photo backups, storage of payment status and inquiry data, sending notifications
• Google LLC (Firebase AI Logic / Gemini): processing diary text and photos to provide AI features
• Google LLC (Google Analytics for Firebase): collection and analysis of app usage records
• RevenueCat, Inc.: subscription receipt validation and subscription status management
• Apple Inc. / Google LLC (App Store · Google Play payments): processing Pass payments and restoring purchases

7. App Usage Records (Analytics)

The App collects app usage records — such as launching the App, screen navigation, and conversion events like sign-up and saving a diary entry — through Google Analytics for Firebase. They are used only to understand which features are actually used and to improve the service.

• They are not used for advertising purposes, and no advertising identifier (IDFA/AAID and the like) is collected.
• Diary text is not transmitted.
• Information about Google's data processing is available here: https://firebase.google.com/support/privacy

8. Use of Generative AI (Gemini)

The App uses Google's generative AI (Gemini) for some features, including conversation with "AI Haru", sentence polishing, handwriting photo conversion, and the monthly look-back (letter). When these features are used, the diary text and photos needed to perform the feature are sent to Google's Gemini through Firebase AI Logic.

The content sent is used only to generate the response to the request (the conversation, the polished sentence, the transcribed text, the look-back letter, and so on) and is not used to identify the user. The Developer does not store a separate Gemini API secret key in the App; calls are made through the Firebase project.

AI features operate only if the user agreed to the above when first using them. A user who does not want this transmission may choose not to use the AI features.

9. Transfer of Personal Information Abroad

The Google services used by the Developer, such as Firebase, Gemini, and Analytics, as well as RevenueCat and others, may store and process data on servers located outside Korea (in the United States and elsewhere). Where the user uses backup, account, inquiry, or AI features, the relevant information may be transferred abroad, and by using the App the user is deemed to have agreed to this.

• Items transferred: the items collected under section 2 above
• Countries of transfer: the United States and other countries where Google and RevenueCat data centres are located
• Recipients: Google LLC, Apple Inc., RevenueCat, Inc.

10. Rights of Users and Legal Representatives

The user may at any time access, correct, or delete their personal information, or request that its processing be suspended.

• The nickname and profile can be edited directly on the My Information screen.
• Diary data can be backed up, restored, or deleted from the device in Settings.
• Deletion of the account and of cloud backup data can be requested by withdrawing membership.
• Other rights may be exercised by contacting the privacy officer below, and the Developer will act without delay.

11. Destruction Procedure and Method

Information in electronic file form is permanently deleted by a method that makes recovery or reproduction impossible, and information stored on the device is removed together with the App when the App is deleted or the in-app deletion feature is used.

12. Security Measures

• Authentication information such as passwords is encrypted and managed through Firebase Authentication.
• App lock (biometrics/PIN) is processed only inside the device, and the PIN is stored as a hash.
• Personal information is protected through management of server access rights and access control.

13. Personal Information of Children Under 14

As a matter of principle the Developer does not collect personal information of children under the age of 14. If sign-up by a child under 14 is confirmed, that information is destroyed without delay.

14. Privacy Officer and Contact

Haru Diary is an app provided by the operator of Harufactory. Inquiries about the processing of personal information, requests to access, correct, or delete it, and complaints or requests for remedy may be sent to the contact below.

• Contact: the operator of Harufactory
• Email: contact@harufactory.com

15. Duty of Notice

If anything is added to, deleted from, or changed in this Privacy Policy, notice will be given in advance through an in-app notice or this page. Where there is an unavoidable reason such as a change in law or policy, the change may be reflected immediately.

This English text is a translation provided for convenience. The Korean text is the original; if the two differ, the Korean text prevails.