1. Scope and principles
This Policy applies to the Hangaloi mobile app, product website, and trip-sharing pages provided by RYNYUL. Hangaloi does not require registration with a name, phone number, or email address and uses Firebase Anonymous Authentication.
Trip records and photos you select are stored on your device by default. Only when you create a sharing link is a copy of the trip record, excluding your photos, uploaded to our server and made accessible to anyone with the link.
2. Information we process
| Category | Information | How it is handled |
|---|---|---|
| Account and operations | Firebase anonymous user ID, internal user ID, invite code, AI usage token status, operating system, device language, app version and build number, launch count, and creation/update timestamps | Generated or transmitted when the app starts and stored on our server. |
| Location | Current or user-selected map coordinates, accuracy, measurement time, and search area | Used for weather, nearby places, maps, and directions when you grant permission or select a map location. Current location is generally processed in memory during use; we do not store an account-level location history. A selected map search point may be saved on your device to restore an active trip. |
| Trip and preference data | Selected area, preference responses, recommended/selected/excluded places, visit order and time, mood, memo, trip title and date, and place-curation snapshot | Stored in app-private storage by default. Preferences and official place/weather information are processed through our server when generating AI place guidance. |
| Photos | Trip photos captured with the camera or selected from your photo library | Copied only to app-private storage and excluded from shared trip data. |
| Optional shared trip data | Trip title, region and date; place name, address, coordinates and image URL; mood, memo and recommendation content; share ID; creation/expiration time; and share/view counts | Stored on our server only when you choose to create a sharing link. |
| Automatically generated data | IP address, access time, user agent, error/security logs, app-instance and device identifiers, and app-usage events | May be generated through server operations and the Firebase App Check and Analytics SDKs. We do not use it for advertising tracking. |
3. Purposes of processing
- Anonymous user identification, app integrity checks, abuse prevention, and service security
- Location-based weather, tourism information, congestion estimates, nearby places, maps, and directions
- Personalized place recommendations and AI place guidance based on official information
- Restoring and managing active and completed trip logs stored on your device
- Creating and serving trip-sharing links at your request
- Usage analysis, quality improvement, troubleshooting, and service operations
Place recommendations automatically compare your stated preferences and exclusions with location and place categories. They assist travel choices and do not make decisions that have legal or similarly significant effects on you.
4. Retention and deletion
| Information | Retention period | Deletion method |
|---|---|---|
| Anonymous account and operational data | Retained while you use the service and deleted without undue delay upon a deletion request or service termination, unless applicable law requires longer retention. | Deleted from our database in a manner designed to prevent recovery, and the Firebase anonymous account is deleted. |
| On-device trip records and photos | Until you delete them in the app or uninstall the app | Deleted from app-private storage and removed with the app according to operating-system behavior. |
| Shared trip records | For 10 years from link creation or until you request deletion | Shared data and its linkage are deleted from our database. |
| Location, search, and AI request data | Processed transiently for the request. We do not separately store location history or raw AI requests in our service database. Security logs and external-provider retention follow each provider’s policy. | Removed from memory after the request; logs are deleted or anonymized after their retention period. |
5. Trip sharing and public access
Hangaloi uploads a copy of a trip record only when you actively use the sharing feature. Because a sharing page can be opened without signing in, anyone with the link can view and forward it. Do not include information you do not want disclosed in trip titles, places, moods, or memos.
- Included: trip title, region and date; places and coordinates; moods and memos; recommendation and official place information
- Excluded: user-captured/selected photos, exact visit times, total trip duration, and Firebase user ID
- To delete a sharing link, contact us below and include the link URL.
6. Service providers and international processing
We use the technologies listed below to provide the service. Network identifiers and the minimum information needed for a feature may be sent to each provider. Some providers may process data in data centers outside Korea; transmission occurs over encrypted networks when you use the relevant feature.
| Provider | Purpose | Data involved |
|---|---|---|
| Google LLC (Firebase, Google Analytics, Gemini) | Anonymous authentication, app integrity checks, usage analytics, and AI place guidance | Anonymous user/app-instance identifiers, device/app/usage-event data, and official place/weather information with preferences |
| NAVER Cloud Corp. / NAVER Corp. | Maps, location search, reverse geocoding, directions, and blog search | Coordinates, origin/destination, place/region search terms, and network/device information |
| Korea Tourism Organization, Korea Meteorological Administration, and public-data providers | Tourism, weather, and tourism-congestion data | Selected area or coordinates and query parameters such as place, category, and date |
| Apple Inc. / Google LLC | Camera, photo and location permission controls, app distribution, and operating-system services | Device, purchase, and diagnostic information under the relevant OS and app-store policies |
Specific processing locations and retention periods are governed by each provider’s data-processing and privacy terms. We review provider privacy and security practices and limit transfers to what is necessary.
7. App permissions
- Location (optional): Used for current weather, nearby places, maps, and directions.
- Camera (optional): Used when you capture a photo for your trip log.
- Photo library (optional): Used when you select a photo for your trip log.
You can use the service without granting optional permissions, except for features that require them. You can change or revoke permissions at any time in device settings.
8. Your rights and choices
You may request access, correction, deletion, restriction of processing, or withdrawal of consent concerning your personal information. Because accounts are anonymous, we may ask for reasonable verification such as information available in the app or a sharing link.
- You can delete on-device trip records using the app’s delete feature.
- You can revoke location, camera, and photo permissions in operating-system settings.
- Requests concerning server account data and sharing links can be submitted by email below.
We respond within the period required by applicable law and will explain any lawful restriction. Users in Korea may also contact the Personal Information Infringement Report Center (118) or the Personal Information Dispute Mediation Committee (+82-1833-6972).
9. Security measures
- Encrypted transport (HTTPS) and request validation using Firebase ID Tokens and App Check
- Server-side storage of service keys and external API credentials, separate from the app
- Least-privilege access, input validation, and security-log review
- Storage of trip photos and default trip records in app-private storage
No internet transmission or electronic storage method is completely secure. If a security incident is confirmed, we will notify users and authorities as required by law and take steps to mitigate harm.
10. Children's privacy
Hangaloi is not directed to children under 14 and does not knowingly collect their personal information. If we learn that a child’s information was processed without the consent of a legal guardian, we will delete it without undue delay. Please contact us if you become aware of such processing.
11. Changes to this Policy
We may revise this Policy when the service or applicable law changes. We will announce material changes in the app or on the website before they take effect and update the effective date above. Where prior versions exist, we will also provide a change history.
12. Privacy contact
Send privacy questions, rights requests, or sharing-link deletion requests to the contact below.
- Controller
- RYNYUL
- Team
- Hangaloi Privacy
- privacy@rynyul.com