ACTLEV Privacy Policy
UsefulFactory (business registration no. 376-20-02198, "we") processes the personal information of users of the ACTLEV app (the "Service") in accordance with the Personal Information Protection Act of Korea and other applicable laws. This policy explains what we process and why, how long we keep it, and your rights. The Korean version is the governing text.
1. Information we process and why
- Sign-up, sign-in and account management — if you sign up with Google: email address, Google profile name, Google account identifier and mobile phone number (verified at sign-up). If you sign up with an ACTLEV account: account name, password (stored encrypted; we cannot see the original password) and mobile phone number (verified at sign-up, account-name recovery and password reset). The verification code is sent by SMS, WhatsApp or KakaoTalk, whichever you choose.
- Preventing fraudulent sign-ups and abuse — so that one phone number can back only one account, we keep an irreversibly transformed value (HMAC) of the number. During sign-in, Google (Firebase Authentication) also processes your IP address, device/browser information and an app integrity token (Google Play Integrity) for security.
- Operating the Service — service account identifiers, consent times and SMS request records.
- Crash analysis — when the app crashes it sends the time, app version, operating system version, device model and error details. This is not linked to your account, and addresses and tokens are masked before sending.
2. Information that stays on your device
Your activity — posts, comments, messages, profile, verification photos and videos, notification settings — is currently stored only on your device and is not sent to our servers. We request camera and microphone access to record photos and videos and notification access for notifications. We do not collect location. If any of these features is connected to our servers, we will update this policy first.
3. Retention
- When you delete your account, it stops working immediately. So that a deletion you did not ask for (for example after your account was hacked) can be undone, it is kept locked for 30 days and then the sign-in account and server records are destroyed without delay. During that time the same phone number or Google account cannot be used to sign up again.
- For accounts restricted for breaking our rules, we keep the transformed phone number value and the restriction record to prevent signing up again.
- Crash reports are deleted automatically 30 days after we receive them.
- Where a law requires us to keep information, we keep it for the period the law requires.
4. Sharing with third parties
We do not provide your personal information to third parties, except where required by law or requested by investigative authorities following legal procedures.
5. Processors and transfers abroad
We entrust processing to the companies below, and your information is transferred abroad in the process. Transfers happen over an encrypted network (HTTPS) when you sign up, sign in or use the app.
- Google LLC (Firebase Authentication) — authentication, storing account information, sending SMS codes. Countries: the United States and other countries where Google data centers are located. Items: the account information in section 1. Retention: as in section 3. Contact: https://support.google.com/policies/contact/general_privacy_form
- Cloudflare, Inc. (Workers, D1) — running the sign-in server, storing account records and crash reports. Countries: the United States and other countries where Cloudflare data centers are located. Items: service account identifiers, consent and SMS request records, transformed phone number values, crash reports. Retention: as in section 3. Contact: privacyquestions@cloudflare.com
- Meta Platforms, Inc. (WhatsApp Business Platform) — sending the verification code when you choose WhatsApp. Countries: the United States and other countries where Meta data centers are located. Items: mobile phone number, verification code message. Retention: up to 30 days after delivery (Meta policy). Contact: https://www.facebook.com/help/contact/540977946302970
- Kakao Corp. and SOLAPI — sending the KakaoTalk notification message when you choose KakaoTalk (processed in Korea). Items: mobile phone number, verification code message. Retention: according to each company’s sending-record policy after delivery.
- If you do not want your information transferred abroad, you can choose not to sign up or delete your account; in that case you cannot use the Service.
6. How information is destroyed
When the retention period ends, an automatic job deletes the information from the sign-in system (Firebase) and our server records (Cloudflare D1) so that it cannot be recovered.
7. Your rights
You may at any time ask to access, correct, delete or stop the processing of your personal information. In the app, open Profile → Settings to see your connected account and delete it; if you cannot use the app, email usefulsfactory@gmail.com. We act without delay after confirming it is you. The account deletion page explains the steps in detail.
8. Children
The Service is intended for users aged 16 and over and does not accept sign-ups from children under 14. If we learn that we have collected information from a child under 14, we delete the account and the information.
9. Security measures
- Encryption of all transfers (HTTPS)
- Passwords are stored hashed by Firebase; our servers do not store email addresses, phone numbers or passwords in the clear
- Phone numbers are kept only as an irreversible transformed value
- Server access is separated by purpose (read-only for sign-in checks, a separate permission for the deletion clean-up), and secret keys are stored separately
10. Cookies and advertising
The Service does not use cookies, and currently does not collect advertising identifiers or show personalized ads. If we introduce advertising, we will update this policy first.
11. Privacy officer and contact
Privacy officer: Representative, UsefulFactory / Contact: usefulsfactory@gmail.com
For reports or advice about privacy violations in Korea you may also contact the Personal Information Infringement Report Center (privacy.kisa.or.kr, 118), the Personal Information Dispute Mediation Committee (www.kopico.go.kr, 1833-6972), the Supreme Prosecutors’ Office (www.spo.go.kr, 1301) or the Korean National Police Agency (ecrm.police.go.kr, 182).
12. Changes
If we change this policy, we announce it in the app or on this page at least 7 days before it takes effect (30 days for changes that are unfavorable to users).