Privacy Policy
This is an English translation provided for convenience. The Korean version is the binding text; if the two differ, the Korean version prevails.
1. Personal data we collect and why
| Category | Data | Purpose |
|---|---|---|
| Sign-up and login | Email address (may be absent for Kakao sign-ups), login method (Kakao, Apple, Google or email), sign-up and access times | Identifying the account, login, recording consent to the Terms |
| Connected social accounts | Account ID, username and profile picture URL of each connected account; the access token issued by the platform (stored encrypted) | Publishing posts, reading comments and replying on the user's behalf |
| Posts | Uploaded photo and video files, captions, scheduled time, publishing results (platform post ID, URL and error details) | Publishing, scheduling, reporting results |
| Comments | Text, author name, author account ID and time of comments on connected accounts' posts; the actions the user took (reply, hide, delete, block) | Showing comments in one inbox, replying, excluding blocked people |
| Device | Push notification address (Expo push token), device type and model, app version | Sending push notifications, informing about supported versions |
| Collected automatically | Request logs (time, result, trace ID), error logs | Incident response, security |
We never collect social account passwords. Accounts are connected through each platform's official authorization screen.
2. Retention periods
- Account information, connected accounts, post records and comments: until the account is deleted. Deleted immediately on account deletion.
- Uploaded photo and video files: 7 days after publishing finishes, then deleted automatically.
- Raw notifications sent by platforms (webhooks): 30 days.
- Deletion records: only the fact of processing is kept, in a form that cannot identify a person (hash).
- Records that the law requires us to keep are kept for the required period.
3. Processors and international transfers
| Processor | Task | Location |
|---|---|---|
| Supabase | User authentication, database | Republic of Korea (Seoul region) |
| Amazon Web Services (Lightsail) | Server hosting | Republic of Korea (Seoul region) |
| Cloudflare | Photo and video file storage (R2), information pages | Globally distributed storage (including outside Korea) |
| Expo | Push notification delivery | United States |
| Sentry | Error collection | United States |
Posts and comments are exchanged with the platforms the user connected (Meta Platforms: Instagram and Threads; Google: YouTube; TikTok) according to the user's instructions. Each platform processes personal data under its own policy.
4. Disclosure to third parties
We do not disclose personal data to third parties, except when publishing to a platform at the user's instruction. We may disclose data to the extent required by a lawful request.
5. Your rights and how to delete data
- In the app's settings you can disconnect social accounts, change notification settings and delete your account yourself.
- Account deletion runs immediately in the app, in this order: disconnect accounts → delete files → delete the account and everything attached to it. Details are on the Data Deletion page.
- If you remove UpNChat's access or request data deletion from the Instagram or Threads side, we delete the data related to that account and give you a confirmation code.
- Requests for access, correction or suspension of processing can be sent to the contact below.
6. Security measures
- Access tokens for social accounts are encrypted on the server (AES-256-GCM) and are never sent to the app.
- All communication is encrypted with HTTPS. The database has row-level security (RLS) enabled and is accessed only by the backend.
- Raw error messages from platforms stay on the server; the app receives only a summary.
7. Children under 14
We do not accept sign-ups from children under 14 years of age.
8. Privacy officer and contact
Privacy officer: JEON HOSEON (Representative) · Email: support@upnchat.com
Operator: Jaroma (sole proprietorship) · Business registration no. 188-14-00200 · 102-503, 400 Ansim-ro, Dong-gu, Daegu, 41087, Republic of Korea
9. Changes
Changes to this policy are announced on this page and in the app 7 days before they take effect (30 days for material changes).
Effective date: 2026-10-06 (version 2026-10-06)