PRIVACY
Privacy policy
How puzzlog handles personal information.
This English translation is provided for convenience. The Korean version is the original and prevails in case of any discrepancy. Read the Korean original
zerobacklabs (the “Company”) establishes and publishes this Puzzlog Privacy Policy under applicable law, including the Personal Information Protection Act of the Republic of Korea, to protect data subjects’ personal information and address related concerns.
1. Processing purposes, categories, and retention periods
The Company processes the minimum personal information necessary to provide the Service as follows.
| Purpose | Personal information processed | Collection method | Legal basis | Retention period |
|---|---|---|---|---|
| Registration and account management | Sign-in provider (Google or Apple), provider-issued member identifier, email address, name and profile information (if provided), registration and withdrawal request times | Received from Google or Apple; entered by the user | Article 15(1)(4) of the Personal Information Protection Act | Up to 30 days after withdrawal is requested; destroyed if the request is not canceled |
| Sign-in and service protection | Authentication information, access logs, IP address, device and app information, app installation identifiers | Generated through service use | Article 15(1)(4) of the same Act | As needed for operation and security; members’ information is destroyed when withdrawal becomes final |
| Service provision | Photos and videos registered by members, content registration times, puzzle and theme information | Registered by the user; generated through service use | Article 15(1)(4) of the same Act | Until the user deletes it or withdrawal becomes final |
| Group features | Group joining and leaving records, invitations, content sharing and reaction records | Generated through service use | Article 15(1)(4) of the same Act | Until use of the relevant group or feature ends; destroyed when withdrawal becomes final |
| Service error analysis and stability improvements | Error and crash information, app version, OS and device information, and technical diagnostic information needed to analyze errors | Generated when an app error occurs | Article 15(1)(4) of the same Act | Up to 90 days from collection |
| Push notifications | Push notification tokens, device type, group notification preferences, delivery results | Generated through service use | Article 15(1)(4) of the same Act | While notifications are used; delivery stops upon a withdrawal request and information is destroyed when withdrawal becomes final |
| Email inquiries, complaints, rights-infringement reports, and privacy rights requests | Email address, inquiry, report or deletion request, attachments, and Company replies | Provided by the user by email | Article 15(1)(4) of the same Act | Until the inquiry or request has been resolved |
| In-app customer inquiries and reply history | Member identifier, inquiry category, title and text, Company and member replies, creation, read and closure times | Entered by members in the app; generated during handling | Article 15(1)(4) of the same Act | Retained to provide inquiry history until account withdrawal becomes final; requests for deletion under applicable law are handled separately |
Notifications scheduled on the device, such as daily puzzle reminders, are handled on the user’s device, and their settings are not transmitted to the Company.
Guest use
While using the Service without signing in, photos, videos, and puzzle records registered by the user are stored only on the user’s device, not on the Company’s servers.
Connection information is also processed to handle requests and protect the Service when signed-out users retrieve public content. Cloudflare's processing of access and security information is described in Section 6. App error information is processed for error analysis and stability improvements as described in the table above.
When the user signs in, photos, videos, and puzzle records stored on the device are transferred to the signed-in account and are then processed for the service provision purpose above.
Usage statistics, error reports and the advertising-related information in Section 7 ④ may also be transmitted during guest use. On-device records can be deleted in the app and may also be removed when the app is uninstalled or the device is reset.
Social sign-in
For social sign-in, the Company receives the account information listed in Section 1 from Google or Apple. The information provided depends on the user's settings and the sign-in provider's policies.
The Company does not request unique identification information such as resident registration numbers, or sensitive information such as health information, as separate input fields for registration or use. Photos and videos uploaded by members may nevertheless contain sensitive information, as explained in Section 9.
Membership withdrawal and deletion grace period
When a member requests withdrawal, service use, sign-in, and notification delivery stop immediately, and the member’s group-shared content is hidden from other members.
To address accidental or mistaken account deletion, the Company retains the account and User Content in a recoverable state for 30 days from the request. Personal information is used only for account recovery during this period.
Members may cancel the request within 30 days by signing in again or using another method provided by the Company.
If the request is not canceled within 30 days, withdrawal and termination of the service agreement become final. The Company promptly destroys personal information except information that must be retained under applicable law.
If a member explicitly requests immediate deletion during the grace period, the Company verifies identity as necessary and promptly destroys personal information except information subject to legal retention requirements. The account and content cannot then be recovered.
Information subject to a legal retention obligation or a lawful need for retention, such as handling a legal dispute, is retained for the necessary period and then destroyed.
Usage statistics
The Company collects usage statistics to understand service use and improve quality.
Information collected for app usage statistics consists of a random statistics identifier generated on the device, an app-session identifier, records of app launches, screen views and feature use with their results, the time of occurrence, the operating system type, the app version, and whether the user was signed in.
Random statistics identifiers are processed separately from account IDs.
Usage statistics are transmitted automatically when Members and Guests use the app. The app currently has no setting to individually turn off this transmission. Account IDs and sign-in authentication tokens are not included in statistics requests. App error reports and access logs for service protection are handled separately.
2. Children and registration age
① In South Korea, we do not accept registration by children under 14. In other countries, users must meet any age required to independently provide legally required consent to the processing of personal information.
② We do not currently collect or verify parental or legal guardian consent for registration. Users confirm that they meet the age requirements in the Terms. We do not additionally collect date of birth, identity documents, or location information for this confirmation, or automatically determine country of residence.
③ If we discover an ineligible account, we restrict or terminate it and promptly delete personal information, except information we must retain under applicable law.
④ Guest use has no age restriction. Processing of Guests' on-device records, usage statistics, access and error information, and advertising-related information is described in Sections 1, 6 and 7.
3. Destruction of personal information
① The Company promptly destroys personal information when it is no longer needed, such as when its retention period expires or its processing purpose is fulfilled.
② For an ordinary withdrawal request, personal information is deemed no longer needed when the 30-day grace period in Section 1 ends and is promptly destroyed, except information that must be retained under other laws.
③ If a member requests immediate deletion during the grace period, the Company verifies identity, ends the grace period, and promptly destroys personal information except information that must be retained under other laws.
④ Information subject to retention under other laws is stored and managed separately from other personal information and destroyed when its retention period ends.
⑤ Electronic files are securely deleted so that they cannot be recovered or reproduced. Photo and video files are also deleted from their storage locations.
4. Provision to third parties
Except for group sharing selected by the user as described below or cases permitted by applicable law, the Company does not provide personal information to third parties.
When members join a group and share content, group members may see display names, shared photos and videos, themes and reactions. Visibility depends on group themes, participation status and the app’s same-day recording conditions. Deleting content, leaving a group or withdrawing membership can limit display in the app, but cannot recall copies already saved or shared by other members.
It may do so to the extent permitted by the Personal Information Protection Act, for example where the data subject gives separate consent or a specific legal provision permits it.
5. Outsourcing of personal information processing
The Company entrusts the following processing tasks to service providers.
| Service provider | Entrusted task |
|---|---|
| Amazon Web Services, Inc. | Operation of service servers and storage for photos, videos, and other data |
| 650 Industries, Inc. (Expo) | Relay of push notification delivery |
| Functional Software, Inc. d/b/a Sentry | Collection and analysis of technical diagnostic information about app errors and crashes |
| Cloudflare, Inc. | Hosting of service information web pages and operation of the security proxy (access protection and traffic relay) for API and administrator access |
| Zoho Corporation Pte. Ltd. (Singapore, Zoho Mail contracting entity) / Zoho Technologies (US data center operator) | Sending, receiving, and storing customer inquiry emails |
The primary storage for member accounts, User Content and group information is Amazon Web Services servers and storage located in the United States. The resulting overseas transfer is described in Section 6.
Google and Apple social sign-in services are not processors entrusted by the Company. Rather, the Company receives member identification and related information when members use those sign-in services.
When outsourcing processing, the Company takes measures required by applicable law, including prohibiting processing beyond the entrusted purpose, ensuring safeguards for personal information, and managing and supervising providers.
Changes to entrusted tasks or providers are disclosed through this Privacy Policy.
6. Overseas transfers of personal information
The Company entrusts some processing to overseas providers to provide the Service, and personal information may consequently be transferred abroad.
These transfers involve outsourced processing or storage necessary to enter into and perform a contract with the data subject. The following information is provided under Article 28-8 of the Personal Information Protection Act.
6-1. Push notification delivery
| Item | Details |
|---|---|
| Recipient | 650 Industries, Inc. (Expo) |
| Contact | support@expo.dev |
| Country | United States |
| Information transferred | Push notification tokens, device-related information, and information needed for delivery |
| Information that may appear in notifications | Other members’ display names, group names, theme names, and other information necessary for notifications |
| Timing and method | Transmitted over networks when a push notification is sent |
| Purpose | Relay of push notification delivery |
| Retention and use | Tokens: as long as necessary to provide notifications; notification content: as long as necessary to transmit it |
| How to refuse | Do not enable notifications, or disable them in app or device settings |
| Effect of refusal | Push notifications will not be received; other service features remain available |
6-2. Service error analysis
| Item | Details |
|---|---|
| Recipient | Functional Software, Inc. d/b/a Sentry |
| Contact | compliance@sentry.io |
| Country | United States |
| Information transferred | Error and crash information, app version, OS and device information, and technical diagnostic information needed to analyze errors |
| Timing and method | Transmitted over a network when app errors occur |
| Purpose | Error analysis, incident response and stability improvements |
| Retention and use | Up to 90 days from collection |
| How to refuse | Stop using the Service and, for members, withdraw membership; processing requests may be sent to hello@puzzlog.app |
| Effect of refusal | The app has no separate setting to disable error reporting, and Service use is restricted |
6-3. Service servers and data storage
| Item | Details |
|---|---|
| Recipient | Amazon Web Services, Inc. |
| Contact | aws-korea-privacy@amazon.com |
| Country | United States |
| Information transferred | Member account information, User Content such as photos and videos, group information, inquiry history, and other personal information stored on service servers and storage to provide the Service |
| Timing and method | Transmitted over networks and stored while the Service is used |
| Purpose | Operation of service servers and storage for photos, videos, and other data |
| Retention and use | Retained and destroyed according to the category-specific retention periods and withdrawal grace period in Section 1 |
| How to refuse | Stop using the Service and, for members, withdraw membership; processing requests may be sent to hello@puzzlog.app |
| Effect of refusal | Online features that use the servers and storage are restricted |
6-4. Web delivery, security, and traffic routing
| Item | Details |
|---|---|
| Recipient | Cloudflare, Inc. |
| Contact | privacyquestions@cloudflare.com |
| Countries | The United States and countries and regions where Cloudflare operates its global network, depending on the user's access route (list) |
| Information transferred | Access IP addresses, access times, request addresses and paths, device and browser information, response status and other access and security information, and personal information contained in routed requests and responses |
| Timing and method | Transmitted and processed over networks when users access web pages or APIs routed through Cloudflare |
| Purpose | Web delivery, routing of service requests and responses, and prevention of unauthorized access and attacks |
| Retention and use | Until the earlier of termination of the outsourcing agreement or the date processing is no longer necessary to provide the contracted services. Security Events and Security Analytics data are retained for 31 days. Following termination of the agreement or completion of the outsourced service, personal information is deleted or returned to the Company unless retention is required by law |
| How to refuse | Stop using the relevant web pages or online features; personal information processing requests may be sent to hello@puzzlog.app |
| Effect of refusal | Web pages and online features routed through Cloudflare cannot be used. Features that store and process information solely on the device are separate from this routing |
6-5. Customer inquiry emails
| Item | Details |
|---|---|
| Recipient | Zoho Corporation Pte. Ltd. (contracting entity) / Zoho Technologies (US data center operator) |
| Contact | privacy@zohocorp.com |
| Country | United States |
| Information transferred | Sender's email address, inquiries, reports, privacy rights requests, attachments and replies |
| Timing and method | Transmitted over networks and stored when inquiry emails are sent and received |
| Purpose | Customer support and sending, receiving and storing emails |
| Retention and use | According to the retention period for email inquiries and privacy rights requests in Section 1 |
| How to refuse | Do not use email inquiries; processing requests may be sent to hello@puzzlog.app |
| Effect of refusal | Email inquiries and replies are restricted; other service features remain available |
The Company implements safeguards required by applicable law during overseas transfers.
7. Automatic collection of information
① To provide and improve a stable Service, the Company may automatically generate and collect access and usage information and technical diagnostic information about errors. Usage statistics are processed on the Company’s own service servers, separately from error reports. Section 1 describes the collected categories.
② The information is used to:
- Produce statistics on service access and usage.
- Analyze use of individual features.
- Analyze usage patterns and improve features.
- Analyze the causes of errors and crashes.
- Respond to incidents and improve stability.
- Improve performance and service quality.
③ If information can identify a person when combined with other information, the Company handles it under the Personal Information Protection Act.
④ The Company displays advertisements on Service screens. When it displays an advertisement, the Google LLC AdMob advertising SDK included in the app sends the following information directly from the user’s device to Google. The Company does not link this information to member accounts.
- Categories: advertising identifiers (iOS Identifier for Advertisers, Android Advertising ID), IP address, device information (device model, OS version, language, display settings), app information (app identifier, version), and ad interaction records such as impressions and clicks
- Method: sent automatically by the SDK when an advertisement is displayed
- Purposes: ad serving and measurement, invalid click prevention, and personalized advertising where the user allows it
- Retention: in accordance with Google’s Privacy Policy
- How to refuse: on iOS, turn off tracking for the app under Settings > Privacy & Security > Tracking, or choose “Ask App Not to Track” when the app requests permission. On Android, delete or reset the advertising ID under Settings > Privacy > Ads. If you refuse, non-personalized advertisements are shown instead of personalized ones. The app has no setting to turn off advertisements or the related transmission itself.
Google’s processing of advertising-related information is described in the Google Privacy Policy (https://policies.google.com/privacy) and Google’s advertising technologies notice (https://policies.google.com/technologies/ads).
8. Security safeguards
The Company implements necessary technical and organizational safeguards under applicable law, including the Personal Information Protection Act, such as managing access permissions, access controls, transmission protection, and access log management.
9. Possible disclosure of sensitive information and how to keep it private
① The Company does not require members to enter sensitive information such as health information, political opinions, religion, or beliefs as separate information fields.
② Photos and videos registered by members may nevertheless contain sensitive information about themselves or others. If content is shared to a group, that group’s members can view it.
③ Members can limit display to others by not joining groups, deleting registered content, or leaving groups.
④ When a member requests withdrawal, their content is hidden from other members even during the deletion grace period.
⑤ The Company does not separately analyze sensitive information in User Content or use it to infer sensitive characteristics such as health, political opinions, religion, or beliefs.
10. Data subjects’ rights and how to exercise them
① Data subjects may request access, correction, deletion, suspension of processing, withdrawal of consent, and other rights under applicable law.
② Members can use app features to delete photos or videos, leave groups, change display names, disable notifications, and request withdrawal.
③ Even during the 30-day grace period after requesting withdrawal, members may request immediate deletion. After necessary identity verification, the Company promptly deletes information except information that must be retained under other laws. The account and User Content cannot then be recovered.
④ Other privacy requests, including immediate deletion, may be emailed to the privacy officer. The Company communicates the result within the periods and procedures prescribed by applicable law.
⑤ Data subjects may also exercise rights through an authorized representative. The Company may verify the identity or authority of the person making the request where necessary.
⑥ If access, correction, deletion, suspension, or other rights are restricted by applicable law, the Company explains the reasons to the data subject.
11. Privacy officer
The Company designates the following privacy officer to oversee processing and protection and to handle privacy inquiries, complaints, and remedies.
| Item | Details |
|---|---|
| Privacy officer | Choi Junwoo (최준우) |
| hello@puzzlog.app |
Data subjects may use this contact for privacy inquiries, complaints, remedies, exercise of rights, or immediate deletion requests arising from use of the Service.
12. Remedies for privacy infringements
Data subjects may contact the Company or request advice or dispute mediation from the following bodies regarding privacy infringements.
| Organization | Contact | Website |
|---|---|---|
| Personal Information Dispute Mediation Committee | 1833-6972 | www.kopico.go.kr |
| Personal Information Infringement Report Center | 118 (no area code within Korea) | privacy.kisa.or.kr |
13. Changes to this Privacy Policy
① This Privacy Policy applies from October 24, 2026.
② If the policy changes, the Company publishes the changes and effective date on the service information website or similar channels. Changes that materially affect data subjects’ rights are separately communicated through reasonable means such as in-app notices.
③ Where previous policies exist, the Company makes them available through the service information website or similar channels so data subjects can review them.