Effective October 24, 2026

Privacy Policy

This is an English translation of the Korean Privacy Policy. If the two differ, the Korean version prevails — except that for consumers habitually resident in the EEA, the United Kingdom or Switzerland, this English version is also binding and any difference is interpreted in the consumer’s favor.

This policy explains how Nonscale Co., Ltd. (주식회사 논스케일, the “Company”) processes users’ personal information in the BapsangLog app and website (bapsanglog.com, the “Service”). The personal location information policy required by the Act on the Protection, Use, etc. of Location Information (the “Location Information Act”) is in section 8.

Key points — please read first
· When you sign in, we do not receive your email address, phone number or real name (section 1).
· Your scores, nickname and bio are visible to others only when you turn on “Public profile” (it is off at first). Anyone can see reviews and the photos attached to them, and if you have not turned on “Public profile”, they are shown without a name (section 5).
· We use location only when you consent. Coordinates are rounded before they are sent and are not stored, and records of your use of location features (without coordinates) are kept for 6 months (section 8).
· Even if you delete your account, ratings you have not deleted remain in the Meal Score calculation as pseudonymized information. If you do not want them to remain, delete them with “Delete my score” on the place page before you delete your account, or check “Also delete my ratings” when you delete your account (section 3).
· Some information is processed outside Korea (in the USA and elsewhere). Apps that include the update check send an installation identifier, your IP address and other details to Expo (USA) each time they open, to check for a new version (section 6).
· We do not use ads or tracking, and we do not sell personal information. Only people aged 16 or older can sign up (section 9).

1. What we process and why

The Company processes the personal information below, which users enter, which we receive from the service they sign in with, or which is created automatically while they use the Service. The bases are contract (Personal Information Protection Act (PIPA) Article 15(1)4), legitimate interests (running the Service safely and fairly — Article 15(1)6 of the same Act), law (Article 15(1)2 of the same Act) and consent.

Category	Items	Purpose	Basis
Sign-up and account	Sign-in identifier (the member number from Kakao, Naver, Google or Apple), sign-up time, nickname, an optional bio, a profile photo you upload yourself (extra information such as where it was taken is removed), records of agreement (the version of the terms you agreed to, and when and where you agreed, withdrew consent and so on), “Public profile” and location settings	Identifying members, running the Service, confirming agreement, applying settings	Contract · Legitimate interests. “Public profile” and location settings: consent
Ratings and activity	Ratings (place, entered score, highlights chosen, where it was left (app or web), when it was left and edited, and the edit history), reviews (text of up to 300 characters, up to 5 photos (uploaded at a reduced size, with extra information such as where they were taken removed), when it was left and edited, whether an operator hid it), “Haven't been” marks, saved places, foodies you follow, reviews you hid with “Hide this review”, members you blocked	Providing the Service (including calculating Meal Scores and showing reviews), preventing misuse	Contract · Legitimate interests
Reports, actions, appeals and handling requests	What you reported, the reason and the description; actions under the Terms of Service (type, duration, reason and provision relied on, whether automatic, when) and the notices about them (in “Notices”, and where a post actioned for rights infringement appeared); appeals and their outcome; the email address given to receive notices of action; records of rating deletions; records of handling requests and of provision under law (operational logs); whose public page link it was, for links from before a change	Handling reports, telling members the reasons for and outcomes of actions, showing that we handled requests as asked, preparing for disputes	Contract · Legitimate interests · Law
Notifications	Push tokens of devices on which you allowed notifications, with the operating system, app language and so on; whether you want to receive notifications; records of notifications sent	Sending notifications	Contract
Location (section 8)	Rounded coordinates (not stored), location use records (member, feature used, where it was used, time)	Finding nearby places, records required by law	Consent · Law
Created automatically	Access records (access time, IP address, device and browser information, server providers’ request logs — section 6), sign-in records (when it happened, the member’s account number and account identifier (not an email address), the sign-in method, the IP address, and what happened), app error records (only when an error occurs — section 6), app update check and error records (when the app opens — section 6), the value of the web sign-in cookie (section 7)	Keeping you signed in, providing app updates, security, responding to outages, keeping sign-in records under the Protection of Communications Secrets Act	Contract · Legitimate interests · Law
What users send us first	Email inquiries and requests (the sender’s email address and contents), the report form (the address of the page being reported, reason, action requested, description, good-faith confirmation, and your name and email address if you entered them), where a report form was sent from (a value made by transforming the IP address so that it cannot be turned back, and the time it was sent — the IP address itself is not stored, and this is kept separately from the report)	Replying and handling, telling you the outcome, preventing misuse of the report form	Contract (members) · Legitimate interests · Law

The [Required] item at sign-up, “I'm 16 or older, I agree to the Terms of Service, and I've read the Privacy Policy”, indicates that you have read this policy; it is not consent. What relies on consent is “Public profile” (section 5) and location (section 8); everything else is processed without consent on the bases in the table above (PIPA Article 22(3)).

What we do not collect. When you sign in, we do not receive your email address, phone number or real name, or the photo and nickname of your social account (“Sign in with email” on the sign-in screen is used only by accounts the Company created, such as for app review). We also do not ask for your date of birth, unique identifiers, or sensitive information such as health or religion. Please do not write such information in nicknames, bios, reviews, report descriptions or emails, or show it in photos.

A bio is optional. You can use other features without adding one, and edit or remove it in My at any time.

2. How long we keep it

Item	Period	Basis
Account information, records of agreement, lists of saved places, blocks, follows and hidden reviews	Until you delete your account (follows and hidden reviews also earlier, once what they point to is gone — for example, when you unfollow or undo). Records of whose public page link it was, for links from before a change: 1 year, to handle reports (deleted when you delete your account)	Contract · Legitimate interests
Bio	Until you remove it or delete your account	Contract
Ratings, highlights chosen, “Haven't been” marks	Until you delete them or delete your account. Ratings not deleted when you delete your account remain as pseudonymized information (section 3)	Contract · Legitimate interests
Reviews (including their photos)	While that rating exists. Deleted along with it when you delete the review or its photos, or the rating, or delete your account (photos are taken off screens right away, and their files are deleted by the next day). A review hidden by an operator is visible only to the writer until the writer deletes it or deletes their account	Contract
Push tokens, records of notifications sent	Tokens until you sign out or delete your account, or until that device can no longer receive notifications (delivery records that contain a token: 7 days after delivery is completed); records of notifications sent, 30 days	Contract
Records of reports, report forms, actions and appeals; notices in “Notices”; notices of action placed where a post appeared	1 year after handling is completed (notices: after they are created; notices placed where a post appeared: after they are taken down). Not deleted while use is restricted or during the appeal period, and records of a restriction and reports about that member are kept until 1 year after the restriction is lifted or the agreement ends. They remain even if you delete your account	Legitimate interests · Law
Profile photos taken down by an action	Kept where others cannot see them, then deleted when the appeal period ends or the outcome is given (if you delete your account, by the next day; illegally filmed material and the like, immediately)	Legitimate interests
Sign-in records	3 months from when they are created (even if you delete your account)	Law (Protection of Communications Secrets Act Article 15-2 · Article 41(2)2 of its Enforcement Decree)
Location use records, the server’s location request count log	6 months (a member’s records are deleted immediately when they withdraw consent, turn off that feature or delete their account)	Law (Location Information Act Article 16(2))
Rating deletion records (the member’s number, reason, how identity was checked, number deleted and time — not which places or the scores)	3 years from the deletion (even if you delete your account)	Legitimate interests (showing that we deleted as requested, counting the daily limit)
Operational logs (records of handling requests, records of provision under law)	1 year. Records of providing communication confirmation data: 7 years	Law (Protection of Communications Secrets Act · Telecommunications Business Act) · Legitimate interests
Access records, app error records, app update records	Access information for signed-in sessions: until you sign out or delete your account. Server providers’ request logs: 7 days at Supabase · up to 1 day at Vercel. App error records: 90 days. App update records: as long as Expo needs them to provide updates and run security (Expo has not published a specific period)	Contract · Legitimate interests
Email inquiries and requests	1 year after handling is completed	Contract · Legitimate interests
Where a report form was sent from (section 1)	Deleted after a day. The remaining values cannot be used to find the IP address	Legitimate interests
Email address for notices of action	Until the designation is withdrawn or you delete your account	Law

Backups kept to prepare for outages may hold copies of deleted information for up to 7 days before they disappear, and backups are used only to recover from outages. Deleted posts that law requires us to preserve are kept separately, where others cannot see them, for that period.

3. Account deletion and pseudonymized information

You can delete your account right away in My → ⚙ (Settings) → Delete account, or, if you cannot use the app, ask us by email (Account deletion). When you delete your account, we delete your account information (including your bio) and records of agreement, location use records, reviews (including their photos), lists of saved places, blocks and hidden reviews, the follows you made and the follows of you, push tokens, and your public page. Operational records such as reports, actions and appeals, “Notices” and rating deletion records remain for the periods in section 2, linked to a placeholder for the account that keeps only a random number, the deletion time and values attached to the account such as notification settings, without a nickname, sign-in information or sign-up time. We keep this placeholder for as long as we operate the Service. Accounts whose agreement is terminated under the Terms of Service are handled the same way.

Ratings you have not deleted (the rating items in section 1) and “Haven't been” marks are detached from your nickname and sign-in information, moved to a new number, and kept only for calculating Meal Scores and statistics. Your sign-up time moves with them. Reviews and their photos are not moved but deleted. If you do not want your ratings to remain, delete them with “Delete my score” on the place page before you delete your account, or check “Also delete my ratings” when you delete your account. After your account is deleted, we do not match whose ratings they are, so they cannot be picked out and deleted, and even if you sign up again, your earlier records cannot be brought back. For accounts deleted because the member is under 16, ratings are deleted too (section 9).

Pseudonymized information. Ratings kept in this way are pseudonymized information (PIPA Article 2(1)(c)): without matching them against other information, it is not possible to tell whose they are. Under Article 28-2 of the same Act, the Company uses them only for compiling statistics — calculating each place’s Meal Score and overall statistics.

• Items — the new number, sign-up time, the ratings and “Haven't been” marks above, and the values produced when calculating Meal Scores from those ratings (converted scores, how generous the rater is, etc.)
• Period — for as long as we operate the Service and calculate Meal Scores
• Provision to third parties — none. The processor entrusted with the Meal Score calculation (section 6) calculates on the Company’s behalf
• Protection — we do not record which original number corresponds to which new number, and we do not match them against operational records. We keep a record of processing and apply the measures in section 10
• The rights to access, correct, delete and suspend processing, among others, do not apply to pseudonymized information (Article 28-7 of the same Act)

4. How we destroy it

When the retention period ends or the purpose has been achieved, the information is destroyed without delay by a cleanup job or by the person in charge. Sign-in records, location use records and operational logs kept under law are kept separately on the bases and for the periods in section 2, and then destroyed. Electronic files are deleted in a way that cannot be recovered, and anything printed on paper is shredded or burned.

5. Provision to third parties and what is made public

The Company does not sell personal information. The Company gives personal information to third parties only in the cases below, and only as much as is strictly necessary.

• When law has a special provision — demands from investigative authorities or courts through a procedure set by law, such as a warrant; a decision by the Dispute Mediation Division of the Korea Communications Standards Commission (KCSC) to provide information (Article 44-6 of the Act on Promotion of Information and Communications Network Utilization and Information Protection, etc. (the “Network Act”)); reporting illegally filmed material and the like (we give only the address of the post and the relevant times)
• When a court or authority orders it under another country’s law that applies to the Service — after checking the basis and scope, and only to the extent Korean law permits (Terms of Service Article 14)
• When a person’s life or body is clearly in imminent danger, or when we suspect such a crime and notify investigative authorities (to the extent permitted by law)
• When we tell a person who made a report the outcome of handling it (Terms of Service Article 10) — the action taken on the reported member’s account is not included

We do not tell a reported member who reported them unless the law requires us to.

“Public profile”. If you turn it on, your nickname, profile photo, follower count, number of places rated (including the number newly rated recently) and how generous you are — and, for each place, your entered score, the month you left it and your review of that place — appear under “Public Meal Scores” on the pages of places you rated, in the “Foodies” tab (including “Latest”) and on your public page, where anyone can see them. Any bio you write also appears on your Foodie card, Foodie profile and public page. Turning it on is your consent to this. It is off at first, and you can turn it off at any time with “Public profile” at the top of “My”; when you do, it is taken down right away and the follows of you are deleted too. Link previews already posted to messengers and the like may remain, and your profile photo may still open for anyone who already knows its address until you delete or change it. Ratings you newly leave or edit become visible to others one hour later (in the meantime a text-only review is shown without your name, while a review with photos waits together with its photos), and others may still be able to guess where you have been. Others see only your follower count, and who follows you is not visible even to you.

Reviews. Regardless of “Public profile”, anyone — including people who are not signed in — can see reviews and the photos attached to them on that place’s page. If you have not turned on “Public profile”, only “BapsangLog member” and the month the review was left or edited are shown, without a name, and the review is not linked to other reviews by the same person. People who saw your reviews while “Public profile” was on can tell who wrote them even after you turn it off, and even a review without a name may reveal who wrote it through its text or photos. A review with photos becomes visible to others one hour after it is left or edited. You can see your own review right away. Please keep your face and other people’s faces and personal information out of photos.

Before going public. Sensitive information such as health or religion may be inferred from a public nickname, bio or photo, the places you rated, and your reviews (including their photos). If you do not want that, do not turn on “Public profile”, or edit or delete your nickname, bio, photo and reviews. Place pages on the web can be collected by search engines, so the reviews shown there (including photos) and the nicknames, photos and scores of members who have gone public may remain in search engines’ copies, and the Company cannot take back those copies. Your public page and “Foodies” are marked so that search engines do not include them.

6. Processors and transfers outside Korea

The Company entrusts the processing of personal information to the companies below, and some of it is processed outside Korea. The transfer outside Korea is entrustment of processing and storage needed to perform our contract with users (the Terms of Service — including use without signing in), and we transfer the information over the network after disclosing the matters below (PIPA Article 28-8(1)3).

Recipient · contact	Work entrusted	Country of processing	Items transferred outside Korea	When transferred	Retention
Supabase Pte. Ltd. privacy@supabase.com	Storing data and photos, handling sign-in, managing the queue of notifications to be sent, running the servers, responding to outages and security (request logs)	Data in the Republic of Korea (Seoul); server request logs in the USA and Singapore	Server request logs — time of the request, IP address and the approximate area and network provider estimated from it, requested URL, device and browser information, and, for signed-in requests, the account and session numbers	Each time the app or website makes a request to the server	7 days
Vercel Inc. privacy@vercel.com	Providing the website and the report form, delivering review photos, handling social sign-in, calculating Meal Scores, sending notifications, responding to outages and security (request logs)	Processing in the Republic of Korea (Seoul) as the preferred region; server request logs in the USA	Server request logs — time of the request, IP address, requested URL, device and browser information	When you open the website, sign in or send the report form, and when the app loads review photos	Up to 1 day
Google LLC (Firebase Cloud Messaging) support.google.com/policies	Delivering notifications to Android devices	USA and other countries where Google has data centers or cloud regions	Firebase installation ID and app information, push token, notification title and text	When the device receives a notification token, and when a notification is sent	Tokens while valid, notifications until delivery is completed
Apple Inc. (Apple Push Notification service) apple.com/legal/privacy/contact	Delivering notifications to iPhones	USA	Push token, notification title and text	When a notification is sent	Tokens while valid, notifications until delivery is completed
Functional Software, Inc. (Sentry) compliance@sentry.io	Collecting and analyzing app error records	USA	App version, device model and operating system, a random identifier created for each installation, the error details and the actions just before it, IP address (not stored; only the estimated area is kept)	When an error occurs in the app (the website does not send them)	90 days
650 Industries, Inc. (Expo) expo.dev/contact	Providing app updates	USA (including countries where Expo’s sub-processors are located)	A per-installation identifier, operating system and app version, update check and error records, IP address	When the app opens to check for or download an update, and when an update error occurs (the website does not send them)	As long as needed to provide updates and run security (Expo has not published a specific period)
Google LLC (Google Workspace) support.google.com/policies	Company email and storing operational logs	USA and other countries where Google has data centers	Addresses and contents of emails exchanged, operational logs	When emails are exchanged or entries are made in the logs	Emails 1 year after handling is completed; operational logs for the periods in section 2

How to refuse and what happens. Server request logs and sign-in handling are essential to the Service, so if you do not want them, the only way is not to use the Service. To be left out of the Meal Score calculation, delete your ratings (section 9); if you do not want app error records or app update checks, use the website (they cannot be turned off in the app). Notifications can be stopped with your phone’s permission or with “Off” in My → ⚙ (Settings) → Notifications; only notifications stop, and everything else stays the same (on Android, the notification component may obtain a token from Google regardless of permission). You can also contact us by phone (section 11) instead of email. However, records of handling requests remain in the operational logs even if you ask by phone, and this cannot be refused.

Under their data processing agreements, the processors use the information entrusted to them only for the entrusted work, protect it at a level the same as or higher than this policy, and impose the same obligations when they entrust it to others in turn (Apple follows its developer agreement; Expo follows its terms of service and privacy policy, and there is no separate processing agreement with Expo). The Company checks this, and if the processors or the entrusted work change, we will announce it in this policy. The companies they entrust work to in turn are published by each company — Supabase · Vercel · Google Firebase · Google Workspace · Sentry · Expo.

Map. The map is drawn with the map service of Kakao Corp. Your device gets the map data for the area in view directly from Kakao (near your location, if you open the map at your location or move it there with “Go to my location”), and the IP address and other information Kakao receives in doing so are governed by Kakao’s privacy policy. Kakao is subject to the same Korean Personal Information Protection Act as the Company, and the Company’s servers do not send coordinates to Kakao.

7. Cookies, what we store on your device, and app permissions

The Company uses only one cookie, which is strictly needed for social sign-in on the web. It holds a one-time value that checks that it is the browser where sign-in was started; it is deleted as soon as you finish signing in, or after 15 minutes if you do not, and if you block it, only social sign-in on the web is unavailable. What the Kakao components that draw the map do on your device is governed by Kakao’s policy (section 6). We do not use advertising, analytics or tracking cookies, advertising identifiers, or other companies’ advertising or analytics tools, and we do not track you across sites or apps, so the Service works the same way regardless of Do Not Track signals.

The app and the browser store your sign-in state, the settings you chose (including your location choice when not signed in), markers so that notices are not shown repeatedly, app error records not yet sent along with their installation identifier, and the installation identifier used to check for app updates. Sign-in information is deleted when you sign out (on the web, it stays even after you close the browser), and the rest when you clear the app’s or site’s data. On iPhone, these values remain even after you delete the app and may carry over if you install it again, so please sign out before deleting the app. Images saved with “Save image” are made on the device and put in your photo library (on the web, a downloaded file), and are not sent to the Company’s servers.

App permissions. There are no permissions you must allow. If you do not allow one, only that feature is unavailable, and even after allowing a permission, you can revoke it in your phone’s settings.

• Location (only while using the app) — to open the map at your location and find nearby places. We ask only after you agree to the Location-Based Services Terms (on the web, your browser asks).
• Notifications — to receive BapsangLog notifications.
• Photos — to choose, in the phone’s photo picker, one profile photo, or up to 5 photos for a review. The app does not read your whole photo library.
• Adding to Photos — asked only when you put an image saved with “Save image” into your photo library; the app does not read your photo library.
• Camera — used to take a profile photo only in the first released version of the app (October 2026); later versions of the app do not ask.

8. Personal Location Information Policy

This section is the personal location information policy under Location Information Act Article 21-2. The Company has filed as a location-based service provider (No. 1112). The conditions for location features are in the Location-Based Services Terms.

• Purposes and retention — “Near me” in “Ranking” shows nearby places, highest Meal Score first, and your location on “Map” opens the map at your location, or moves it there with “Go to my location”, to show places near you. The device (on the web, the browser) rounds the coordinates to units of about 100 m and sends them without sign-in information, and the server uses them only to find places and discards them immediately, so there is no separate retention period. The app may first use a location the device found recently. Regardless of consent, “Map” loads places for the area shown on screen, and that area is near your location when you open the map at your location or move it there with “Go to my location”.
• Records confirming the collection, use and provision of location information — under Location Information Act Article 16(2), each time location is used, we automatically record the member, the feature used, where it was used (iOS, Android or web) and the time (location use records). The server records only the number of requests for each feature, without who made them. Neither contains coordinates or IP addresses, and both are kept for 6 months.
• Destruction — records are deleted automatically after 6 months, and when you withdraw consent, turn off that feature or delete your account, that member’s (or that feature’s) records are deleted immediately (Location Information Act Article 24(4)). Copies in backups are as in section 2.
• Provision to third parties and notice — we do not provide personal location information to third parties, and we do not give location use records to them either, except when they are required through a procedure set by law, such as a warrant (section 5). If they were provided in that way, you can learn the reasons and details by asking for disclosure as below. If we come to provide them, we will tell you the recipient and purpose in advance and get your consent, and we will notify you immediately each time we provide them (Location Information Act Article 19(3)). Your device gets map data directly from Kakao, so if you open the map at your location or move it there with “Go to my location”, that request contains the area near your location and your IP address (section 6).
• Consent, withdrawal, pausing and access — consent is optional. You can consent with the [Optional] item “I agree to the Location-Based Services Terms” on the sign-up and terms agreement screens, with “Agree and use location” in the notice shown when you use a location feature, or in My → ⚙ (Settings) → Location; before that, we do not ask for location permission. In the same place, turn off “Agree to location use” to withdraw, use “Pause location” to pause, and turn off “Near me” in Ranking and “My location on the map” separately. If you ask by email (admin@thenonscale.com) to see your records, to be told the reasons for and details of provision to third parties, or to have errors corrected, we will handle the request within 10 days at the latest.
• Users who are not signed in — we ask with the same notice, and the choice is kept only on that device (on the web, in that browser); coordinates are received without an account and are not stored (only the request count log remains).
• Guardians of Children Aged 8 or Under, etc. — sign-up is for people aged 16 or older, but under Location Information Act Article 26, if the guardian with a duty of protection of a child aged 8 or under, an adult under full guardianship, or a person with a mental disability under the Act on Welfare of Persons with Disabilities who is registered as a person with a severe disability consents in order to protect that person’s life or body, the person is deemed to have consented. The guardian submits a written consent form to the Company (section 11) together with a document proving that they are the guardian with a duty of protection, and may exercise all of the person’s rights (withdrawal, pausing, access, disclosure and correction). However, BapsangLog’s location features are not a service for protecting life or body, so we do not use location on the basis of this consent (Location-Based Services Terms Article 11).
• Location Information Officer — 마영범, CEO · Phone +82-10-3118-4154 · admin@thenonscale.com
• Protection measures — we limit the people who can read the records to operations staff, and we do not disclose location information learned in the course of duties (section 10).

9. Your rights and how to use them

You can ask to access, correct or delete your personal information or to stop its processing, withdraw consent, and receive your information as a machine-readable file.

• Directly in the app or on the web — change and delete your nickname, bio and profile photo, turn off “Public profile”, turn off notifications, withdraw location consent and pause location, edit and delete ratings and reviews, including their photos (“Delete my score” for each place), unfollow, “Hide this review”, unblock, delete your account.
• By email — if you send a request to admin@thenonscale.com, we will handle it free of charge within 10 days of the day we receive it and tell you the result. We do not hold members’ email addresses, so we confirm your identity in a way that can only be done through your signed-in account. Please also ask by email for your information file (account information and the ratings, reviews (including their photos), lists, etc. you left) and for access to location use records (section 8); you can also ask through a representative. If we refuse a request or grant it only in part, we will tell you why, and you can ask us to reconsider.
• Deleting ratings — “Delete my score” on a place page deletes the score, highlights chosen, review and edit history you left for that place, and also removes them from the Meal Score calculation. This cannot be undone, and there is a limit on how many you can delete per day. To delete all of them, check “Also delete my ratings” when you delete your account. To delete ratings while your use is restricted, or to delete all of them without deleting your account, please ask by email.

Automated decision-making. Meal Scores are calculated in a way that reflects each member’s usual tendency in giving scores (How scoring works), and, so that one or two accounts cannot sway them, rules applied the same way to every account automatically down-weight certain ratings (Terms of Service Article 8). This calculation uses the ratings members leave (places rated and entered scores), grouped by account number; it does not use nicknames, bios, profile photos, sign-in identifiers, location use records or reviews (including their photos). Nicknames, bios and reviews containing words that cannot be used are automatically not accepted. This calculation and this filtering are not decisions that significantly affect rights or obligations (PIPA Article 37-2), but you can ask by email for an explanation, or submit your views and ask for a review again, and a person will look into it and reply within 10 days. We do not publish the formula, the detailed parameters or the list of filtered words, and restrictions of use and termination are decided by a person.

Under 16 and legal representatives. People under 16 cannot sign up, and there is no procedure for a legal representative to consent on their behalf. The app may use the age range provided by the app store to decide whether you can sign up and use features that leave something; that age range is used only on the device and is neither stored nor sent. If we learn of circumstances suggesting that a member is under 16, we restrict their use, and if they do not state their age within 14 days or are confirmed to be under 16, we delete the account and its ratings, reviews and “Haven't been” marks (Terms of Service Article 4 · Youth Protection Policy section 2). A legal representative who learns that their child has signed up should let us know using the contact details in section 11.

Your responsibilities. Please protect your own account and device, and do not post other people’s personal information (photos showing faces, names, contact details, etc.).

10. Security measures

• Administrative — we run an internal management plan approved by the CEO and check it every year. We limit the people who handle personal information to those who need to, have them sign a confidentiality pledge, and train them.
• Technical — we encrypt data in transit and stored data, divide access rights so that members can change only their own information, and limit who can access operational data, and their permissions, to what is necessary. For members who have not turned on “Public profile”, we create no path by which someone could find out who gave what score, and reviews without a name (including their photos) carry no information that would let someone link reviews by the same person.
• Physical — data is kept in the processors’ data centers (section 6), and we do not keep servers in our office. Files downloaded for a task are deleted when the task is done.

If a data breach occurs. If we learn that personal information has been leaked, lost, stolen, forged, altered or damaged, within 72 hours we will tell you the items, when and how it happened, what you can do, the Company’s measures and the relief procedure, where to contact us, and your rights such as claiming damages. We will do the same when we learn of a possible breach as defined by law. Because we do not collect contact details, we will notify you through app notifications and the Service’s screens, post it on this site for at least 30 days, and report it to the bodies designated by law.

11. Officers and contact details · Remedies

One person serves as the Privacy Officer, the Location Information Officer and the Youth Protection Officer. Please send questions, requests and complaints about personal information, location information or youth protection by phone or email as below. We recommend email, so that there is a record.

Name 마영범 · Title CEO
Phone +82-10-3118-4154 · admin@thenonscale.com

Nonscale Co., Ltd. (주식회사 논스케일) · CEO 마영범, 양현지
11, Yeongdong-daero 106-gil, Gangnam-gu, Seoul, Republic of Korea (서울특별시 강남구 영동대로106길 11)
Business registration no. 343-88-03751 · Corporate registration no. 110111-0952223 · Location-based service business filing No. 1112

The Company’s information is also in Legal notice.

If you need counseling or dispute mediation about an infringement of personal information, you can contact the bodies below. For disputes about location information too, you can apply for mediation to the Personal Information Dispute Mediation Committee (Location Information Act Article 28(2)). You can challenge a Company decision in the way described in section 9, and you can also bring a lawsuit in court.

• Personal Information Dispute Mediation Committee — 1833-6972 (in Korea) · www.kopico.go.kr
• Privacy Infringement Report Center — 118 (in Korea) · privacy.kisa.or.kr
• Korean National Police Agency Cyber Bureau — 182 (in Korea) · ecrm.police.go.kr

12. If you use the Service from outside Korea

Wherever you live, you can exercise the rights given by the law of your country in the ways described in section 9. The Korean version of this policy is the authoritative version, and an English version is provided alongside it.

European Economic Area · United Kingdom · Switzerland. For people who live there, the EU General Data Protection Regulation (GDPR), the UK GDPR and the Data Protection Act 2018, and the Swiss Federal Act on Data Protection apply, and the English version is equally authoritative (if the two differ, the one more favorable to that person applies). The controller is Nonscale Co., Ltd. (section 11). We have no establishment in these regions, and we will list our EU and UK representatives in Legal notice as they are appointed. The legal bases are as follows — contract for providing the service you asked for; consent for “Public profile” and location; legitimate interests for keeping ratings in the calculation after account deletion, preventing manipulation, security and records under Korean law; and legal obligation for handling reports and responding to requests from authorities as required by EU or Member State law, such as the EU Digital Services Act. A sign-in identifier is needed for the membership agreement (without one, you can only browse) and comes from the sign-in service, and information about reported members comes from other people’s reports. The recipients are the processors in section 6, everyone who sees the information you made public and reviews, Kakao (maps), the person who made a report (outcome only), and authorities under the law.

The Republic of Korea is covered by adequacy decisions of the EU and the UK. When we send information to processors in other countries, it is protected by Data Privacy Framework (DPF) certification (for the EEA and Switzerland, Vercel, Sentry and Google; for the UK, Vercel under the UK-US data bridge) or by Standard Contractual Clauses (Supabase — including versions adapted with the UK Addendum and to Swiss law — and, in the EEA, also Google Firebase). Safeguards for other recipients (Apple and Expo, and in the UK also Sentry and Google) will be added as they are confirmed, and copies of the Standard Contractual Clauses are available on request by email.

You can exercise the rights of access, correction, deletion, restriction of processing, data portability, objection and withdrawal of consent free of charge in the ways described in section 9. You can object at any time to processing based on legitimate interests, and we will stop unless the Company can show overriding legitimate grounds. We reply within 1 month at the latest (2 more months if the request is complex), and withdrawing consent does not affect the validity of processing carried out before. We do not make decisions with significant effects based solely on automated processing (section 9). You can lodge a complaint with a supervisory authority (list of EEA supervisory authorities), the UK Information Commissioner’s Office (ICO) or the Swiss Federal Data Protection and Information Commissioner (FDPIC), and if you make a complaint to the Company in the UK, we will acknowledge it within 30 days and tell you the outcome.

For members aged 16–17. Your scores, nickname and bio are visible only when you turn on “Public profile”, and it is off at first. Anyone can see reviews and their photos. Do not write your name, school, contact details or where you live in your bio or reviews, or post photos showing your face. If you have questions, ask us by email (section 11).

United States. The Company does not sell personal information or share it for targeted advertising. Map coordinates that may count as precise geolocation are used only after we get your consent, and only for the feature you asked for (section 8).

日本でご利用の方へ — 外部送信に関する公表事項

本サービス(アプリ・ウェブ)は、ご利用の端末から次の事業者へ情報を送信します(電気通信事業法第27条の12に基づく公表)。

送信先	送信される情報	利用目的
株式会社カカオ(Kakao Corp.) プライバシーポリシー	表示している地域(位置情報の利用に同意し、地図を現在地から開いたり現在地へ移動したりした場合は現在地の周辺)、IPアドレス、端末・ブラウザの情報	地図の表示(アプリ・ウェブ)
Functional Software, Inc.(Sentry)	アプリのバージョン、端末の機種・OS、インストールごとの識別子、エラーの内容と直前の操作記録、IPアドレス	不具合の把握と修正(アプリのみ・エラー時のみ)
650 Industries, Inc.(Expo)	インストールごとの識別子、OS・アプリのバージョン、更新確認・エラーの記録、IPアドレス	アプリの更新の提供(アプリのみ)
Google LLC(Firebase Cloud Messaging)	Firebaseのインストール識別子、アプリの情報	Android端末への通知の配信(アプリのみ)
Apple Inc.(Apple Push Notification service)	プッシュ通知トークンの発行に必要な端末の情報、アプリの識別子	iPhoneへの通知の配信(アプリのみ)

通知は端末の設定か、アプリの「My → ⚙(Settings)→ Notifications」で「Off」を選ぶと止められます。地図の表示、不具合の記録、アプリの更新確認はアプリ内では止められません(ウェブ版はSentry・Expo・Google(Firebase)・Appleへ送信しません)。お問い合わせは admin@thenonscale.com まで。

13. Changes to this policy

When we change this policy, we post the content before and after the change on this page from 7 days before it takes effect. For an important change — such as an increase in the items collected or the purposes, or an added transfer outside Korea — we post it from 30 days before, and separately notify members through app notifications or the Service’s screens. Earlier versions that took effect can be viewed exactly as posted in the Version history, and we will send the text of versions withdrawn before they took effect on request by email.

Addendum

1. This policy takes effect on October 24, 2026.
2. The previous policy provided that changes would be announced 7 days (30 days if important) in advance, but this policy takes effect on the day it is posted.
3. Keeping sign-in records for 3 months (section 2) starts on November 4, 2026. Until then, sign-in records are deleted once 7 days have passed since they were created.
4. This policy replaces the Privacy Policy in effect from October 22, 2026 (the “previous policy”). The previous policy can be viewed exactly as posted in the Version history.
5. We will send the text of the Privacy Policy in effect from September 12, 2026, which was published on the web before version files, on request by email.