MemoPlayer Privacy Policy

Effective 1 Oct 2026 (some items 5 Oct 2026) · Consolidated with the previous website policy (www.memoplayer.com, 17 Dec 2023). This document prevails if they overlap.

Convenience translation. If this conflicts with the Korean text, the Korean version governs.

MemoPlayer (hereinafter "the Company") complies with the Personal Information Protection Act, the Act on Promotion of Information and Communications Network Utilization and Information Protection, and other applicable laws of the Republic of Korea, and does its best to protect the rights of data subjects.

This website (link.memoplayer.com) does not use its own tracking cookies; however, third-party services such as Google AdSense ads and YouTube videos may use cookies. You can turn off personalized ads in Google My Ad Center (myadcenter.google.com). The items below apply mainly to the MemoPlayer mobile app.

1. Purpose of Processing

• Authentication & Management: Verification via Google Account integration, customer support, and membership retention.
• Service Execution: Provision of official and user content (market) and clubs, and handling of intellectual property infringement claims.
• Financial Transactions: Management of in-app points, execution of Google Play billing, refunds, and subscription lifecycle management.
• System Integrity & Abuse Prevention: Enforcing application integrity, detecting fraudulent access, restricting re-registration of malicious users, and penalizing Terms of Use violations.

2. Categories of Processed Data

• Google Account UID & Email Address — Used for authentication, linking purchases to your account, and resolving disputes. Destroyed promptly when the account is deleted, subject to statutory retention periods (account deletion requests have a 30-day grace period).
• Public Identifiers (Handle/Profile) — Used to identify creators and members in the market and clubs. Retained until account deletion (UGC may be anonymized and archived post-deletion).
• Anonymous Firebase UID — Used only to keep your session before you link an account.
• Play Billing Token Hashes & Digital Wallet Ledgers — Retained for a mandatory period of 5 years pursuant to the Act on the Consumer Protection in Electronic Commerce, etc.
• Crash reports (error details, device model, OS and app version, app installation ID) — Used to find and fix app errors (Firebase Crashlytics). Deleted 90 days after collection (Firebase retention policy).
• App installation ID (Firebase Installations ID) with records of downloaded content and home additions — Used to count each download once per device and to answer related support requests. Deleted 5 years after collection (within 5 days after the period ends); download totals are kept without identifiers.
• Club messages (sender, recipient, content, time sent) — Used to deliver messages between club members. Only the latest 20 messages per conversation are kept; a conversation is deleted after 60 days without new messages. Club notices keep the latest 5.
• Android ID — Used to check for fraudulent or duplicate accounts. Deleted when the account is deleted.
• Hashed app installation ID (signup bonus record) — Prevents the signup bonus from being paid twice on the same device. Kept for 5 years from collection, including after account deletion.
• Memo content sent to the app from the website’s “Create memos on the web” page — Used to deliver the memo to the app. Deleted automatically 20 minutes after sending.
• Hashed IP address (a one-way value that cannot be turned back into the IP) with request count and time for web memo send/fetch requests — Used to block automated abuse that repeats requests in a short time. Counted in 10-minute windows and deleted automatically after about 20 minutes (within 2 hours at the latest). The IP address itself is not stored.
• UGC, nicknames, club memberships, dispute records, FCM tokens, and AdMob advertising IDs — Kept under internal policies for operations and abuse prevention (FCM tokens are deleted when the account is deleted; advertising IDs follow AdMob’s policy).

Do not post other people’s sensitive personal information (e.g., exam registration numbers or real-name contact details) in the market or clubs.

3–4. Methods of Collection, Processors, and Cross-Border Transfers

Data is voluntarily provided by the user via Google authentication, submissions, and direct inquiries. The Company initiates processing only upon obtaining explicit, affirmative consent to this Privacy Policy and the Terms of Use within the application interface. Third-party SDKs (Firebase, Google Play, AdMob) may automatically generate data while you use the app. Primary processors include Google LLC and its global affiliates (Firebase Authentication, Realtime Database, Storage, Functions, Cloud Messaging, Analytics, Crashlytics, Remote Config, Installations, App Check; Google Play; AdMob), which involves transferring data outside Korea (mainly to the United States). The Company does not provide personal data to third parties for marketing without your prior consent, except where required by a lawful warrant or a specific legal provision.

5. Retention and Destruction Protocols

Personal data is destroyed without delay once its purpose is fulfilled or the account is deleted, except for the following records, which are kept for the periods shown: Records of contracts and purchase withdrawals (5 years); Records of payment and supply of goods (5 years); Records of consumer complaints or dispute resolution (3 years).
Abuse-prevention retention: For accounts terminated for severe Terms violations, the Company may retain minimal identifiers for up to 1 year to prevent re-registration abuse. Longer retention applies only where permitted by law (e.g., ongoing legal process). Permanent retention is not the default.

6–9. Data Subject Rights, Targeted Advertising, Security, and Minors

Data subjects may exercise rights (access, rectification, erasure, suspension) via app settings (see Account Deletion) or the contact email. Erasure may be limited by statutory retention. You can limit or reset the Android advertising ID used for rewarded ads in your device settings. The Company applies HTTPS, Firebase Security Rules, and Play Integrity.
Where the Company has met its statutory security duties, liability for breaches caused solely by user negligence or by intrusions beyond reasonable control may be limited under applicable law. Criminal liability cannot be waived by contract.
The market and clubs are not directed at children under 14. Age checks rely on Google Account and Play Family Policies.

10–11. Privacy Officer & Notification Procedures

Corporate Privacy Officer / Legal Inquiries: biya27@naver.com. You may also contact the KISA Privacy Infringement Report Center (118), the Personal Information Dispute Mediation Committee (1833-6972), the Supreme Prosecutors’ Office (1301), or the Korean National Police Agency Cyber Bureau (182). Changes to this policy are announced in the app or on this website at least 7 days before they take effect (30 days for changes that are adverse to users).

Addendum. This policy takes effect on 1 Oct 2026.

Addendum (announced 28 Sep 2026). The crash report, download count record, club message, and device identifier items in Section 2 and the added processors take effect on 5 Oct 2026.

Addendum (announced 29 Sep 2026). The web memo items in Section 2 (memo content and hashed IP address) take effect on 6 Oct 2026.