This is a previous version. It was replaced on 2026-10-11. Read the current version

Effective October 5, 2026

Privacy Policy

This is an English translation of the Korean Privacy Policy. If the two differ, the Korean version prevails — except that for consumers habitually resident in the EEA, the United Kingdom or Switzerland, this English version is also binding and any difference is interpreted in the consumer’s favor.

This policy explains how Nonscale Co., Ltd. (주식회사 논스케일, the “Company”) processes users’ personal information in the BapsangLog app and website (bapsanglog.com, the “Service”). The personal location information policy required by the Act on the Protection, Use, etc. of Location Information (the “Location Information Act”) is in section 9.

Key points — please read first
· Location consent is optional. Even if you do not consent, you can still sign up, rate and browse as usual; only “Near me” and “Go to my location” are unavailable. If you consent, a record of your use of location features (when, and which feature you used — without coordinates) is kept with your account for 6 months. If you withdraw consent or turn off that feature, it is deleted immediately (section 9).
· Deleting your account does not delete the ratings you left. They are detached from your nickname and sign-in information, moved to a new random number, and kept in the Meal Score calculation. Your sign-up time is kept with them too. Without matching them against other records the Company holds, it is not possible to tell who left them. If you want your ratings deleted, please ask us by email before you delete your account. Deleted ratings are also removed from the Meal Score calculation. Deleting your account cannot be undone (sections 3 and 12).
· If you turn on “Make my Meal Scores public”, anyone can see them. Turning it on is your consent to making them public. Turning it off takes them down right away, but link previews stay for a while, and anything already posted to messengers and the like may remain on those services (section 5).
· Records of reports, actions and appeals, and the notices about them (“Notices” under MY), are kept even after you delete your account, for 1 year — records counted from when handling is completed, notices from when they were created (sections 2 and 3).
· Some information is processed outside Korea — in the USA, Singapore and elsewhere. This is also the case when you use the Service without signing in (section 7).
· Only people aged 16 or older can sign up (section 10).
· This policy takes effect 4 days after it is posted. That is shorter than the 7-day and 30-day advance notice the previous policy promised. Existing members will review this policy on the terms review screen that appears the next time they open the app or website, and what differs from the previous policy is in “What changed in this version” at the bottom (Addendum).

At a glance

When you sign in with Kakao, Naver, Google or Apple, we do not receive your email address, phone number, real name or profile photo. We receive only a member identifier.
Ratings do not reveal who left them. Only members who turn on “Make my Meal Scores public” have their nickname and scores shown.
We use location only after you consent. Exact coordinates are not sent to the Company’s servers; only coordinates rounded on your device are sent, without sign-in information, and the server does not store even those.
We do not use ads, advertising identifiers or tracking cookies, and we do not sell personal information. The Company’s servers do not send personal information to third parties except in the cases in section 5 (cases set by law, and telling a person who made a report the outcome). However, there is information your device sends directly to Kakao to draw the map (sections 6 and 9-4).
You can delete your account right away in the app or on the web.

1. What we process and why

The Company processes the personal information below. Most of it is within what is needed to provide the service you asked for (Personal Information Protection Act (PIPA) Article 15(1)4 — entering into and performing a contract), to run the Service safely (Article 15(1)6 of the same Act — the Company’s legitimate interests), or to meet obligations set by law (Article 15(1)2 of the same Act). When you sign up, we receive your indication that you have read this policy through the required item “I'm 16 or older, I agree to the Terms of Service, and I've read the Privacy Policy”. This is not consent to this policy, and the basis for this processing is not that indication but contract, legitimate interests and law. What relies on consent is location (section 9; Location Information Act Article 19) and “Make my Meal Scores public” (section 5). The basis is noted at the end of each item.

When you become a member

Sign-in identifier — the member identifier given by Kakao, Naver, Google or Apple. Used only to recognize your account. (Contract)
Sign-up time — when the account was created. Used to run the Service and to calculate Meal Scores. (Contract · Legitimate interests)
Nickname — chosen by the member. Used as the member’s name within the Service. (Contract)
Record of agreement — the version of the Terms of Service you agreed to; the version of the Location-Based Services Terms, if you agreed to them; and when and where (iOS, Android or web) you agreed, withdrew consent, paused or resumed, and turned a feature off or on. Used to confirm that agreement was obtained. (Contract · Legitimate interests)
Profile photo — only if you upload one yourself. We do not receive the photo from your social account. Extra information in the photo, such as where it was taken, is removed, and the photo is resized smaller before upload. (Contract)
Visibility setting — whether “Make my Meal Scores public” is on. Turning it on makes the information in section 5 visible to anyone; turning it on is your consent to that, and turning it off withdraws that consent (section 5). (Consent)
Location settings — whether you have paused location use, and any location features you turned off individually. Kept with your account so they apply the same way on all your devices (section 9). (Consent)

When you use the Service

Ratings — the place, entered score, highlights you chose, when you left and edited the rating, and the edit history. Used to calculate Meal Scores and to prevent manipulation. (Contract · Legitimate interests)
“Haven't been” and saved places — the places you marked. (Contract)
Reports, place fixes and blocks — what you reported (a place, a member or a public page) and why, the description you wrote, records of linking a place to a Kakao Map place, and the members you blocked. Used to handle reports and to run the Service safely. (Contract · Legitimate interests)
Records of actions and notices — actions taken under the Terms of Service (removing a nickname, taking down a photo, stopping public Meal Scores, excluding a rating from or down-weighting it in the Meal Score calculation, restricting use, terminating the agreement) and how long they last, the reason and the provision relied on, whether the action was taken automatically or by a person, and when it was taken (for illegally filmed material and child or youth sexual exploitation material, also when we became aware of it). This also includes the notices placed in in-app notices (“Notices” under MY) to tell a member subject to an action the reason, and to tell a member who made a report the outcome, and the notice of action placed at the address of a public page when a post on it is removed or placed under a temporary measure for rights infringement — whether following a request claiming infringement or, without a request, because infringement is recognized (what was removed or placed under a temporary measure, and the date of the action — Terms of Service Article 13). When a notice arrives, we also send a push notification to the devices that receive notifications, including while use is restricted. (Contract · Legitimate interests · Legal obligation)
Appeals — what you said in an appeal against an action, and the result of the review. (Contract · Legitimate interests)
Notifications — the push token of each device on which you allowed notifications and that device’s app language, whether you want to receive notifications, and records of push notifications sent. Used to send notifications. (Contract)

When you use location features

This applies only to members who agreed to the Location-Based Services Terms. Details are in section 9.

Location use records — made each time your device finds your location anew and uses it for “Near me” or your location on the map: the member, the feature used, where it was used (iOS, Android or web), and the time. Coordinates and IP addresses are not recorded. These are the records that Location Information Act Article 16(2) requires to be kept automatically. (Legal obligation)
Rounded coordinates — received without sign-in information, used only to find nearby places, and not stored. (Consent)

Created automatically while you use the Service

Access records — when you signed in, when you accessed the server and from which IP address, and device and browser information. Used to keep you signed in and to respond to misuse and outages. (Legitimate interests)
App error records — collected only when an error occurs in the app: app version, device model and operating system, a random identifier created for each app installation, the screen where the error occurred and the error details, and a record of app activity just before the error (screens opened, taps, etc.). Usage records, such as when you opened the app or how long you used it, are not collected. Used to find and fix faults (section 7). (Legitimate interests)

When you contact us first

Email inquiries, reports and requests — the sender’s email address and what they wrote. Used to reply and to handle them. (Contract for members · Legitimate interests for non-members)
Report form — what you enter in the report form, which can be used without signing in: the address of the page being reported, the reason, the description, the confirmation that you are reporting in good faith, and, if you entered them, your name and email address. Used to handle the report and, if you left an email address, to tell you the outcome. You do not have to enter your name or email address, but if you do not enter an email address, we cannot tell you the outcome separately. When you submit, a reference number is shown on screen. (Legitimate interests · Legal obligation)
Email for notices of action — the email address a posting member gave us so that, when a post is deleted or hidden following a request claiming it infringes rights, they also receive that notice by email. Used only to send that notice (Terms of Service Article 13). (Legal obligation)

What we do not collect

When you sign in, we do not receive your email address, phone number, real name, profile photo or profile nickname from Kakao, Naver, Google or Apple. Signing in only needs to confirm “is this the same person?”. “Sign in with email” on the sign-in screen can be used only with accounts the Company created separately, such as for app review, and it cannot be used to sign up. The email address and password entered there are used only to verify the sign-in. Otherwise, we learn an email address only when you email us first or enter it in the report form. We do not ask for your date of birth, and we do not collect unique identifiers such as resident registration numbers, or sensitive information.

When you look up a place on Kakao Map, the search terms and search results are not sent to our servers. We receive only the Kakao Map place ID and link of the place you choose and store them as that place’s information (to check that it is the same place, the address of that place in our list is sent along with them, but it is not stored).

2. How long we keep it

Account information (sign-in identifier, nickname, profile photo, visibility setting, location settings), records of agreement, and saved places and block lists — until you delete your account. They are deleted right away when you delete your account (section 3). In place of the deleted account, only a random number and values attached to the account — such as the sign-up and deletion times and whether you wanted to receive notifications — remain, without a nickname or sign-in information, linked to records of reports and actions. This placeholder is kept for as long as we operate the Service.
Ratings, highlights and “Haven't been” — until you delete your account. When you delete your account, they are detached from your nickname and sign-in information and moved to a new random number (the sign-up time moves with them), kept only for calculating Meal Scores and statistics, and kept for as long as we operate the Service and calculate Meal Scores (section 3).
Location use records — kept under Location Information Act Article 16(2) and deleted automatically after 6 months. If you withdraw location consent or delete your account, that member’s records are deleted immediately; if you turn off one feature, that feature’s records are deleted immediately (section 9).
Location request count log (a server log that does not record who made the request) — deleted automatically after 6 months (section 9).
Push tokens — while registered to the account. If you turn off notifications in the app, the token stays, and only notifications stop being sent. It is deleted when you sign out, when you sign in to a different account on the same device, when a notification is sent and it is confirmed that the device can no longer receive it (for example, because the app was deleted), or when you delete your account.
Push delivery records — the delivery records kept one per device contain the push token, so they are deleted 7 days after delivery is completed (or, if the notification could not be sent, 7 days after they were created); records of push notifications sent are deleted after 30 days.
Reports, place fixes, report forms, action records and appeals — 1 year after handling is completed. Kept to see whether the same problem recurs and to prepare for disputes. Action records, reports and appeals concerning a member whose use is restricted are not deleted while the restriction continues, and records of the restriction and reports about that member are kept until 1 year after the restriction is lifted or the agreement ends (account deletion or termination). An action record is not deleted until the period for appealing that action has ended and no appeal is under review.
Notices in in-app notices (“Notices” under MY) (reasons for actions, outcomes of reports and appeals) — 1 year after they are created. They remain until then even if you delete your account, and are not deleted while use is restricted.
Notices of action placed at a public page’s address (for what was removed or placed under a temporary measure for rights infringement — section 1) — kept for as long as the notice stands at that address. Once the notice is taken down (for example, when a temporary measure ends without infringement being found or an appeal is accepted), it is deleted 1 year after it was taken down. The notice does not say whose page it was, and it is not taken down when the account is deleted (section 3).
Public page links from before a change — if you turn “Make my Meal Scores public” on again and your link changes, a record of whose link the old one was is kept, visible only to the Company, for 1 year after the change, so that reports arriving with a link shared earlier can be handled. It is deleted when you delete your account.
Email inquiries, reports and requests — 1 year after handling is completed.
Email address for notices of action — until the member withdraws the designation or deletes their account.
Taken-down profile photos — photos taken down for breaking the community rules or infringing rights are deleted immediately from the storage anyone can see. The photo file is kept separately in the Company’s storage, which others cannot see, and deleted once the period for appealing ends or the result of the appeal is given. If the appeal is accepted, or if a photo taken down temporarily following a rights-infringement request is closed without infringement being confirmed, the photo is restored. If you delete your account before then, it is deleted without delay, and no later than the day after you delete your account. For illegally filmed material, falsified video material and child or youth sexual exploitation material, even the file is deleted immediately and only the action record is kept. If law requires retention (e.g. a removal order for terrorist content from an EU authority), it is kept separately, where others cannot see it, for that period (Youth Protection Policy section 4).
Access records — the last sign-in time is kept with the account and deleted when you delete your account. The IP address and device and browser information recorded for each signed-in session are kept while you stay signed in, and deleted when you sign out or delete your account. The time of server access and the IP address are also recorded in the request logs of Supabase and Vercel, which run the servers; they are deleted after 7 days at Supabase and after at most 1 day at Vercel (section 7).
App error records — up to 90 days from the day they are received (section 7).

3. When you delete your account

We delete your nickname, profile photo, sign-in identifier (including the sign-in account), records of agreement, location settings and location use records. Your saved places, your list of members you blocked, push tokens, your public Meal Score page and share link, and the email address you designated for notices of action are deleted too. Any profile photo taken down and kept separately in the Company’s storage is also deleted without delay, and no later than the day after you delete your account (section 2).

The ratings you left (place, entered score, highlights you chose, when you left and edited them, and the edit history) and “Haven't been” marks are detached from your nickname and sign-in information, moved to a new random number, and kept only for calculating Meal Scores and statistics. Your sign-up time moves with them. Without matching them against other records the Company holds (such as the operational records below), it is not possible to tell who left them, and the Company does not match them. They are kept for as long as we operate the Service and calculate Meal Scores. Even if you sign up again, your earlier records cannot be brought back. If you do not want your ratings to remain, please ask us by email to delete them before you delete your account — deleted ratings do not remain after your account is deleted (section 12). After your account is deleted, the Company does not match those ratings to anyone, so they cannot be picked out and deleted.

The reasons and descriptions in reports you sent, records of linking places to Kakao Map places, records of actions taken on your account, records of appeals you made, and notices sent to you (“Notices” under MY — you can no longer see them once your account is deleted) remain as operational records for the periods in section 2. These records are linked to the placeholder for the deleted account (a random number and the sign-up and deletion times, section 2). The sender’s nickname and sign-in information are deleted along with the above. Records of other members having blocked you remain in those members’ block lists as rows without a name. A notice of action placed at your public page’s address after action for rights infringement stays at that address even after your account is deleted — if it disappeared along with the account, it would reveal that the owner of that address had deleted their account — and the notice does not say whose page it was (section 2). Push delivery records, access records, the location request count log that does not record who made the request, and inquiries and requests sent by email are deleted once the periods in section 2 have passed.

Accounts whose agreement is terminated under the Terms of Service are handled the same way as account deletion. However, for an account deleted because the member is under 16, the ratings and “Haven't been” marks they left are deleted too, and Meal Scores are recalculated without those ratings (section 10). Members whose use is restricted can also delete their account themselves. If you cannot use the app, you can ask us by email to delete your account (Account deletion).

4. How we destroy it

When the retention period ends or the purpose of processing has been achieved, we destroy the information without delay. What is deleted immediately, such as on account deletion, is deleted on the spot; what has a set period is deleted by a daily cleanup job or by the person in charge; and taken-down photo files kept separately in the Company’s storage are deleted by the person in charge (section 2). Electronic files are deleted in a way that cannot be recovered, and anything printed on paper is shredded or burned. To prepare for outages, we back up the database once a day and keep backups for up to 7 days. So a copy of deleted information can remain in the backups for up to 7 days before it disappears with them. The Company does not use backups for anything other than recovering from outages. Destruction of location information is described separately in section 9.

5. Provision to third parties and what is made public

The Company does not sell your personal information. The Company provides personal information to third parties only in the cases below and only to the extent strictly necessary; otherwise, the Company’s servers do not send personal information to third parties.

When investigative authorities, courts or others demand it through a procedure specially provided for by law, such as a warrant (PIPA Article 18(2)2)
When a person’s life or body is clearly in imminent danger (Article 18(2)3 of the same Act)
When we become aware of illegally filmed material, falsified video material or child or youth sexual exploitation material and report it to the relevant authorities — we give only the address where the post was, and when we became aware of it and when we took action. Information that could identify the person who posted it is given only in the two cases above or in the case under Article 18 of the EU Digital Services Act (DSA) below
When we suspect a criminal offense involving a threat to the life or safety of persons and notify the relevant investigative authorities — to the extent permitted by law. Where the EU is concerned, we notify the authorities of the Member State concerned or Europol under DSA Article 18 (Terms of Service Article 14).
When a court or administrative agency orders us, under another country’s law that applies to the Service, to provide information about a specific user (e.g. DSA Article 10) — only after checking the legal basis and scope of the order, and only to the extent Korean law permits (Terms of Service Article 14)
When we have handled a report and tell the person who made it the outcome (whether action was taken — or, for place information, whether it was corrected) (Terms of Service Article 10). The outcome does not include the action taken on the reported member’s account or any other information.

However, what your device sends directly to Kakao to draw the map is as described in sections 6 and 9-4.

We do not tell a reported member who reported them (except where strictly required by law).

What you choose to make public yourself is an exception. If you turn on “Make my Meal Scores public”, your information appears in two places anyone can see. Turning it on is your consent to this.

Your public page (opened by a link) — nickname, profile photo, number of places rated, how generous you are, and the entered score and the month it was left for each place.
The pages of places you rated, under “Public Meal Scores” — nickname, profile photo, entered score and the month it was left. Tapping the name opens your public page.

It is off by default, you can turn it off at any time, and when you do, it is taken down from both places right away. If you turn it on again, your public page link changes, so links you shared before will no longer open. However, the link preview image for your public page (nickname, number of places rated, how generous you are) disappears after at most 1 hour, and previews already posted to messengers and the like may remain on those services. Your profile photo file is at a randomly generated address, so it may still open for anyone who already knows that address until you delete or change the photo. For members who do not turn it on, neither their nickname nor their photo is visible to others, and who gave what score does not appear anywhere.

Please take a look before going public. Sensitive information such as health, religion or beliefs may be inferred from a public nickname or profile photo and the places you rated. If you do not want to reveal it, do not turn on “Make my Meal Scores public”, or change or delete your nickname and photo. You can switch to “Private” at any time by tapping “Meal Scores public” in the profile row on MY.

6. Processors

To provide the Service, the Company entrusts the processing of personal information to the companies below.

Supabase Pte. Ltd. — storing data and profile photos (including location use records and records of agreement), handling sign-in, sending notifications (data: Seoul, Republic of Korea · request logs: section 7)
Vercel Inc. — providing the website and the report form, handling social sign-in (processing: Seoul, Republic of Korea as the preferred region · request logs: section 7)
650 Industries, Inc. (Expo) — relaying app notification delivery, providing app updates (USA, section 7)
Google LLC (Firebase Cloud Messaging) — delivering notifications to Android devices (USA and elsewhere, section 7)
Apple Inc. (Apple Push Notification service) — delivering notifications to iPhones (USA, section 7)
Functional Software, Inc. (Sentry) — collecting and analyzing app error records (USA, section 7)
GitHub, Inc. (GitHub Actions) — running the job that calculates Meal Scores once a day (USA, section 7)
Google LLC (Google Workspace) — storing inquiries, reports and requests exchanged through the Company’s email (admin@thenonscale.com), and the outcome notices (USA and elsewhere, section 7)

The terms of entrustment follow each company’s terms of service or data processing agreement. The Company sends only the information needed for the entrusted work (section 7) and checks that the processors handle it securely. If the processors or the entrusted work change, we will announce it in this policy.

Services your device calls directly. The map in the app and on the web is drawn with the map service of Kakao Corp. While drawing the map, your device gets the map data for the area in view directly from Kakao (if you open the map at your location or tap “Go to my location”, that area is near your location), and when linking a place to a Kakao Map place, it also sends the place search directly to Kakao (the search terms and that place’s location). This does not go through the Company’s servers, and the Company’s servers do not send coordinates to Kakao. The information Kakao receives in this way is governed by Kakao’s privacy policy.

7. Transfers outside Korea

The Company transfers personal information outside Korea as set out below. Basis for the transfer — this is entrustment of processing and storage needed to perform our contract with you (the Terms of Service), and we transfer the information after disclosing the matters below in this policy (PIPA Article 28-8(1)3). The Terms of Service apply not only to members but also to browsing or reporting without signing in, so information of people who are not members is transferred on the same basis. Information of non-members is processed outside Korea in these cases: what is recorded in server request logs (Supabase and Vercel) when you use the app or website without signing in; the app’s update checks (Expo) and error records (Sentry); and what you send by email or through the report form (server request logs and Google Workspace). The items, countries, methods, purposes and periods are as below, and they are also shown on the report form screen.

App and web — server request logs

The Service’s data is kept on servers in Seoul, Republic of Korea, but the two companies that run the servers separately collect logs of the requests to the servers in their own systems. Requests containing location and report form submissions, like other requests, leave the access time and IP address in these logs.

Supabase Pte. Ltd. · privacy@supabase.com · supabase.com/privacy

Country — USA, Singapore (logs are kept on Google Cloud)
Items — time of each request to the server, IP address, requested URL, device and browser information
When and how — sent over the network each time the app or website makes a request to the server
Purpose — running the servers, responding to outages, security
Retention — 7 days, then deleted

Vercel Inc. · privacy@vercel.com · vercel.com/legal/privacy-policy

Country — USA
Items — time of each request to the website and sign-in servers, IP address, requested URL, device and browser information
When and how — sent over the network when you open the website or sign in
Purpose — providing the website, responding to outages, security
Retention — up to 1 day, then deleted

App only — notifications, updates and error records

The four below happen only in the app; the website does not send anything to these four.

650 Industries, Inc. (Expo) · Contact: expo.dev/contact · expo.dev/privacy

Country — USA
Items — Issuing a notification token: the device’s notification token (APNs or FCM), a random identifier created for each app installation, the app identifier. Notifications: the device’s push token, the notification title and text, and the screen that opens when tapped. Checking for updates: the device’s operating system, app version, a random identifier created for each app installation, and, if the app crashed in the previous run, the error details. The IP address when the device connects directly
When and how — sent over the network when the app is opened on a device that allows notifications (issuing and checking the notification token), when a notification is sent, and when the app is opened and checks for updates
Purpose — relaying notification delivery, providing app updates
Retention — the notification token link while that token is valid, notification content until delivery is completed, and update check information until the update has been provided. Otherwise, Expo’s privacy policy applies

Google LLC (Firebase Cloud Messaging) · Contact: support.google.com/policies · policies.google.com/privacy

Country — the USA and other countries where Google has data centers or cloud regions (list of countries: datacenters.google/locations · cloud.google.com/about/locations)
Items — Issuing a notification token: the Firebase installation ID and app information such as the app identifier. Notifications: the Android device’s push token, the notification title and text, and the screen that opens when tapped
When and how — when an Android device receives a notification token, the device sends directly to Google; when a notification is sent to an Android device, it is sent over the network via Expo
Purpose — delivering notifications to Android devices
Retention — notification tokens while the token is valid, notification content until delivery is completed. Otherwise, Google’s privacy policy applies

Apple Inc. (Apple Push Notification service) · Contact: apple.com/legal/privacy/contact · apple.com/legal/privacy

Country — USA
Items — the iPhone’s push token, the notification title and text, and the screen that opens when tapped
When and how — sent over the network via Expo when a notification is sent to an iPhone (the iPhone gets its notification token directly from Apple)
Purpose — delivering notifications to iPhones
Retention — notification tokens while the token is valid, notification content until delivery is completed. Otherwise, Apple’s privacy policy applies

Functional Software, Inc. (Sentry) · compliance@sentry.io · sentry.io/privacy

Country — USA
Items — app version, device model and operating system, a random identifier created for each app installation, the screen where the error occurred and the error details, a record of app activity just before the error (screens opened, taps, etc.), and the IP address when the device connects directly
When and how — sent over the network when an error occurs in the app (if the app crashed, the next time it is opened). Nothing is sent just by opening or closing the app
Purpose — finding and fixing the causes of faults
Retention — up to 90 days from the day received, then deleted

We have narrowed what app error records send. They do not include information that could identify the signed-in account, or the URLs and contents of requests the app sent to the server.

Operations — Meal Score calculation and email

The two below are not something you send from the app or website; they are transfers that happen as the Company runs the Service.

GitHub, Inc. (GitHub Actions) · privacy@github.com · GitHub privacy statement

Country — USA
Items — a random account number created for each member, sign-up time, the places rated and entered scores, and a flag to exclude a rating from, or down-weight it in, the Meal Score calculation under the Terms of Service (only where there is one). Nicknames, profile photos, sign-in identifiers and location use records are not sent
When and how — when Meal Scores are calculated once a day, the calculation server reads the data from the database over an encrypted network connection
Purpose — Meal Score calculation
Retention — deleted once the calculation is finished (the calculation server is created fresh for each job and removed when the job ends)

Google LLC (Google Workspace) · Contact: support.google.com/policies · policies.google.com/privacy

Country — the USA and other countries where Google has data centers (list of countries: datacenters.google/locations)
Items — the sender’s email address and the contents of emails users send to the Company’s email (admin@thenonscale.com), the Company’s replies, and outcome notices sent to people who left an email address in the report form
When and how — sent over the network when you send an email and when the Company sends a reply or an outcome notice
Purpose — receiving and answering inquiries, reports and requests
Retention — 1 year after handling is completed, then deleted (section 2)

How to refuse and what happens.

Server request logs (Supabase and Vercel) — these are always created when you connect to the server through the app or website, so if you do not want this, the only way is not to use the Service.
Notifications (Expo, Google and Apple) — if you do not allow notification permission on your phone, no push token is created, and if you turn off MY → ☰ (Settings) → Notifications in the app, no notifications are sent. In that case, only notifications stop, and you can use everything else as usual.
Update checks (Expo) and app error records (Sentry) — these are needed for the app to work properly, so they cannot be turned off in the app. If you do not want them, you can use the website (bapsanglog.com) instead of the app.
Meal Score calculation (GitHub) — you can ask us to exclude your ratings from the calculation while keeping them, but excluding them would prevent us from providing the promised service, so we may not be able to accept the request (PIPA Article 37(2)4). In that case, we will tell you why. If you ask us to delete the ratings themselves, we delete them, and they are then removed from the calculation too (section 12). If you delete your account, ratings you have not had deleted remain as described in section 3.
Email (Google Workspace) — you can contact us by phone (section 14) instead of email, and you do not have to enter an email address in the report form. You can ask us to delete what you sent by email.

If you have questions, please contact us using the details in section 14.

8. What we store on your device — cookies and automatic collection

The Company does not use cookies, and does not use advertising or analytics tools or advertising identifiers. What the Service stores on your device is limited to the following.

Where	What	Why	When it is deleted
App — the device’s secure storage	Sign-in information, and the account status last confirmed (account number and nickname), used when the app is opened without a connection	Keeping you signed in	When you sign out or delete your account
App — the device’s secure storage	Notification token and its link information (if you allowed notifications)	Receiving notifications	When you delete the app or the token changes (on iPhone, see below the table)
App	App update information, a random identifier created for each installation	App updates	When you delete the app
App	The installation identifier of the app error record tool (Sentry) and error records not yet sent	Finding and fixing errors — sent only when an error occurs	Once sent, or when you delete the app
App — the device’s secure storage	App settings such as language and text size, whether you have seen the first-time introduction, and whether notification permission has already been asked for on this device	Remembering the settings you chose	When you delete the app (on iPhone, see below the table)
App (the device’s secure storage) and web (browser storage) — when not signed in	Whether you chose to use location on this device and when you chose, and, if you consented, the version of the Location-Based Services Terms you saw then (section 9)	Remembering a non-member’s location choice	When you delete the app or clear browser storage (on iPhone, see below the table)
App (the device’s secure storage) and web (browser storage)	Whether location consent has already been asked for once on this device — through the location notice on the “Explore” map or the optional item on the sign-up and terms review screens (section 9)	Not showing the notice repeatedly	When you delete the app or clear browser storage (on iPhone, see below the table)
Web — browser storage (localStorage)	Sign-in information	Keeping you signed in	When you sign out or delete your account
Web — browser storage (localStorage)	Whether you have seen the introduction shown to first-time visitors	Not showing the introduction again	When you clear browser storage

What Kakao’s map components do on your device is governed by Kakao’s policy (section 6). The Company does not track users across sites or apps, and does not place other companies’ advertising or analytics tools in the Service. So we do not respond specifically to browsers’ Do Not Track signals — the Service works the same way whether or not the signal is sent.

If you do not want this. Everything stored on the web is deleted if you clear this site’s stored data in your browser settings, and you will then be signed out. Sign-in information on the web stays even after you close the browser, so you stay signed in the next time you open it; if you do not want that, please sign out when you are done. What is stored in the app is deleted as shown under “When it is deleted” in the table above.

On iPhone. What is stored in the device’s secure storage (the Keychain) may remain on the device even after you delete the app, and if you install the app again on the same device, it uses the remaining values again — you may stay signed in, and your settings and location choice may carry over. Sign-in information and the account status are deleted if you sign out before deleting the app.

9. Personal Location Information Policy

This section is the personal location information policy under Location Information Act Article 21-2. The Company has filed as a location-based service provider (filing No. 1112, May 19, 2026). The conditions for using location features are in the Location-Based Services Terms.

9-1. Where we use location, why, and how long we keep it

“Near me” (the “Meal Scores” tab) — your location is rounded to units of about 1 km (0.01°) and sent to the server to show the Meal Scores of nearby places.
Your location on the map (the “Explore” tab) — when you open the map at your location or tap “Go to my location”, the center and extent of the map are rounded to units of about 100 m (0.001°) and sent to the server to show places near there.
Compass heading — used to show on the map the direction you are facing; used only on the device and not sent.

Exact coordinates are not sent to the Company’s servers; only values rounded on the device (on the web, in the browser) are sent. Requests containing coordinates do not carry sign-in information (account tokens). The server uses the coordinates it receives only to find nearby places and does not store them — they are discarded immediately once the request has been handled. So there is no separate retention period for personal location information.

Regardless of location consent, the “Explore” map sends the extent of the map currently on screen to load the places within it. A map extent you moved by hand is not your location. However, if you opened the map at your location, the first extent sent is near your location.

9-2. Location use records (records confirming the collection, use and provision of location information)

Under Location Information Act Article 16(2), we automatically record and keep the fact that location information was used. There are two records, and neither records coordinates or IP addresses.

Members’ location use records — made by the app or website each time the device finds your location anew and uses it for a location feature: the member, the feature used (“Near me” or your location on the map), where it was used (iOS, Android or web), and the time (to the minute — only one row per minute for the same feature). When a location already found is used again (choosing “Near me” again or refreshing the list), no new row is added, and it is recorded only in the server log below. The account is recorded with these records. The location is found by the device’s operating system or browser. These records are not given to third parties.
The server’s location request count log — made by the three server functions that receive coordinates (the “Near me” list in the “Meal Scores” tab, the places shown on the “Explore” map, and the “Around here” and “Results” lists in “Explore”) themselves, each time they receive coordinates: the time to the minute, which function, and how many times it was called. Who called it is not recorded.

Retention — both are kept for 6 months and then deleted automatically. When a member withdraws location consent, that member’s location use records are deleted immediately, and when a member turns off one feature, that feature’s location use records are deleted immediately (Location Information Act Article 24(4)); they are also deleted immediately when you delete your account. The server’s request count log does not record whose it is, so it remains for 6 months even if you withdraw consent or delete your account.

9-3. How we destroy it

Coordinates — not stored; discarded immediately once the request has been handled.
Location use records — deleted from the database automatically after 6 months, and on the spot when you withdraw consent, turn off that feature or delete your account. Copies of deleted records remain in the database backups made once a day to prepare for outages for up to 7 days and then disappear with them (section 4). The Company does not use backups for anything other than recovering from outages, and if we restore from a backup, we delete records again to reflect any withdrawals of consent, features turned off and account deletions identified after the restore.

9-4. Provision to third parties and notice

The Company’s servers send neither the coordinates they receive nor location use records to third parties. So we do not give the notice required each time information is provided (Location Information Act Article 19(3)). If we come to provide personal location information to third parties in the future, we will tell you the recipient and purpose in advance and get your consent, and we will notify you immediately each time we provide it.

However, the map is drawn with Kakao’s map service. When drawing the map, your device gets the map data for the area in view directly from Kakao, so if you open the map at your location or tap “Go to my location”, that request contains the area near your location and the device’s IP address. The size of the area Kakao receives depends on how far the map is zoomed in. The Company’s servers do not send coordinates to Kakao (section 6).

9-5. Consent, withdrawal, pausing and access

Consent is optional. We ask for it with the optional item “I agree to the Location-Based Services Terms” when you sign up and on the terms review screen. If you have not consented, a notice appears when you tap a location feature, and it also appears once when you first open the “Explore” map if you have not yet been asked on that device. Your phone or browser asks for location permission only after you tap “Agree and use location” in the notice. You can also turn on consent in MY → ☰ (Settings) → Location. Before you consent, we do not ask for location permission and do not send coordinates.
If you do not consent, the “Explore” map opens at a preset location (Seongsu, Seoul), and “Near me” and “Go to my location” are unavailable. Signing up, rating and browsing work as usual.
Withdrawing consent — you can withdraw at any time in MY → ☰ (Settings) → Location. When you do, that member’s location use records are deleted immediately, and location is not used on any of your devices.
Pausing — in the same place, you can pause location use. This is saved to your account and applies on all your devices; while paused, coordinates are neither received nor sent, and no new location use records are created for you. Existing records are not deleted.
Turning off by feature — in the same place, you can turn off “Near me” and “My location on the map” separately. When you turn one off, that feature neither receives nor sends coordinates, and that feature’s location use records are deleted immediately (Location Information Act Article 24(4)). If you turn it back on, new records are kept from then on.
Access, disclosure and correction — you can ask by email (admin@thenonscale.com) to see your location use records, to be told the reasons for and details of any provision of your personal location information to third parties, or to have errors corrected. We will not refuse without a legitimate reason, and we will handle the request without delay, and at the latest within 10 days of the day we receive it. The email address for requests is also shown in MY → ☰ (Settings) → Location.
Separately from this, you can turn off location permission for your phone or browser at any time in your device’s settings.

9-6. Users who are not signed in

The same notice appears for users who are not signed in (when you tap a location feature, and once when you first open the “Explore” map on that device). The choice is saved only on that device (on the web, in that browser); you can turn it off at any time in MY → ☰ (Settings) → Location, and once it is off, that device does not send location. Coordinates arrive without an account, so they are used only to find nearby places without knowing whose location it is, and are not stored; only the server’s location request count log (which does not record who made the request) remains. When you sign in, we ask for consent separately for your account.

9-7. Guardians of Children Aged 8 or Under, etc.

BapsangLog allows sign-up only for people aged 16 or older and does not offer services that find a person’s location to protect children. Even so, we give this notice under Location Information Act Article 26. If the guardian with a duty of protection of a child aged 8 or under, an adult under full guardianship, or a person with a severe mental disability as defined by law (“Children Aged 8 or Under, etc.”) consents to the collection, use or provision of that person’s personal location information to protect their life or body, the person is deemed to have consented. To consent, the guardian must submit to the Company a written consent form together with a document proving that they are the guardian with a duty of protection. The written consent form must state ① the name, address and date of birth of the Child Aged 8 or Under, etc., ② the guardian’s name, address and contact details, ③ the fact that the purpose is limited to protecting the life or body of the Child Aged 8 or Under, etc., and ④ the date of consent, and must bear the guardian’s name and seal, or signature. Like the person themselves, the guardian may withdraw consent, pause, or request access to and disclosure of records (section 9-5).

9-8. Location Information Officer

마영범, CEO · Phone +82-10-3118-4154 · admin@thenonscale.com (section 14)

9-9. Location information protection measures

Administrative — we appoint a Location Information Officer, limit the people who can read location use records to operations staff, and do not give read access to other jobs such as the Meal Score calculation. We do not disclose location information learned in the course of duties.
Technical — we encrypt data in transit (HTTPS), send coordinates without sign-in information and do not store them, and do not record coordinates or IP addresses in records. Location use records are kept in a database in Seoul, Republic of Korea, run by Supabase (section 6).

10. Age

People under 16 cannot sign up. This is the same in every country. We check that you are 16 or older when you sign up. If we learn of circumstances suggesting that a member is under 16, we first restrict their use and tell them why, and if they do not state their age within 14 days or are confirmed to be under 16, we delete the account. In that case, the ratings and “Haven't been” marks they left are deleted too, and Meal Scores are recalculated without those ratings (Terms of Service Article 4(3)). Members under 16 who signed up before the effective date, when people aged 14 or older could sign up, cannot agree to the Terms of Service and so cannot use features that need an account; they can sign out and browse, or delete their account at any time. If the Company learns of such a member, it does the same as above (Addendum, paragraph 4). Youth protection is covered in the Youth Protection Policy.

If you use the app in a region where the law requires checking the age provided by the app store (some US states), the app receives only an age range (e.g. 16–17) from the app store and decides on the device whether you can sign up. If you are under 16 or have not completed the app store’s age verification, you can only browse. We do not ask for your date of birth, and the age range received is neither sent to our servers or anywhere else nor stored.

11. App permissions

The app has no permissions you must allow (required). All of the permissions below are optional, and you can use the app without allowing them. Only the features that need that permission are unavailable, and even after allowing a permission, you can revoke it at any time in your phone’s settings.

Location (only while using the app) — to open the map at your location and find nearby places. Your phone asks only when you first use a location feature after agreeing to the Location-Based Services Terms (section 9). If you do not allow it, the map starts at a preset location, and “Go to my location” and “Near me” are unavailable. Location is not used while you are not using the app.
Notifications — to receive BapsangLog notifications. If you do not allow it, no notifications arrive.
Camera — to take a profile photo. Even if you do not allow it, you can choose a photo from your photo library and upload it.
Photos — to choose a photo to use as your profile photo. Only the one photo you pick in the phone’s photo picker is passed to the app; the app does not read your whole photo library.

On the web, your browser asks for location; as in the app, it asks only after you consent, and location is used in the same way as in section 9.

12. Your rights and how to use them

You can ask to access, correct or delete your personal information or to stop its processing, and you can withdraw consent. You can also receive your information as a machine-readable file (data portability), and object to processing based on the Company’s legitimate interests.

Directly in the app or on the web — change or delete your nickname and profile photo, turn off “Make my Meal Scores public”, turn off notifications, withdraw location consent, pause location or turn off individual location features (MY → ☰ (Settings) → Location), edit ratings, delete your account.
By email — if you send a request to the address in section 14, we will handle it within 10 days of the day we receive it and tell you the result. There is no charge. To receive your information as a file, please ask by email — we will send your account information (nickname, sign-up time, visibility setting, location settings), records of agreement, ratings and edit history, highlights you chose, “Haven't been” marks, saved places and block list as a machine-readable file (JSON), and your profile photo as an image file. Access to location use records follows section 9-5. The Company does not hold members’ email addresses, so email alone cannot confirm that it is you. So we handle requests after confirming your identity in a way that can only be done through your signed-in account, and we will explain how when we receive your request. You can also make a request through a representative. If we refuse a request or grant it only in part under the law, we will tell you why, and you can ask us to reconsider.
Deleting ratings — in the app and on the web you can edit ratings but not delete them. To delete them, please ask by email before you delete your account. You can ask even while your use is restricted. You can have all your ratings deleted or only those for places you choose, so please include your nickname and which you want. After confirming your identity as described above, within 10 days of the day we receive the request we delete those ratings, their edit history and the highlights you chose (and, if you delete all of them, your “Haven't been” marks too), and remove them from the Meal Score calculation. From the next calculation, which runs once a day, published Meal Scores and how generous you are in MY are worked out again from your remaining ratings. If you also want to delete your account, please do so after your ratings have been deleted — ratings after account deletion are as described in section 3 and cannot be picked out and deleted.
Appealing an action — you can appeal within 6 months of the day you received the notice of action (the day it arrived in “Notices” under MY; the deadline date is stated in the notice of action), through that notice (“Notices” under MY) or by email. For a notice that we will terminate the agreement, you must appeal within 14 days of the day you received that notice. Appeals are free, and a person reviews the action again and replies within 14 days. Details are in Terms of Service Articles 12 and 16.

Automated decision-making. Meal Scores are calculated in a way that reflects each member’s usual tendency in giving scores (How scoring works). In addition, rules applied the same way to every account automatically down-weight certain ratings (Terms of Service Article 8). The information used for this calculation is the same as in the “Meal Score calculation” item in section 7. This calculation does not produce legal effects or similarly significant effects for members. Even so, you can ask for an explanation of how your ratings are reflected (PIPA Article 37-2), and if you ask by email to the address in section 14, a person will review it and reply. We do not publish the formula or detailed parameters. Restrictions of use and termination of the agreement are decided by a person, and the notice of action states whether an action was taken automatically or by a person.

If you do not provide a sign-in identifier (that is, if you do not sign in), you cannot use features that need an account, such as rating, saving places, reporting and going public, but you can still browse and use the report form.

Legal representatives. People under 16 cannot sign up (section 10), so there is no procedure for a legal representative (such as a parent) to consent to sign-up on a child’s behalf. If you are a legal representative and learn that your child under 16 has signed up, please let us know using the contact details in section 14. After confirming that you are the legal representative and that the account belongs to someone under 16, we will delete the account and the ratings and “Haven't been” marks it left, following the procedure in Youth Protection Policy section 3. The location use records of that account follow Location-Based Services Terms Article 11. Guardians with a duty of protection for location information are as described in section 9-7.

Your responsibilities. You must protect your own account and device, and must not post other people’s personal information (photos showing faces, names, contact details, etc.) in nicknames, profile photos or reports, or otherwise infringe other people’s information.

13. Security measures

We encrypt data in transit (HTTPS), and stored data is kept under the server operators’ encryption at rest.
The database has row-level access rules, so members can change only their own information.
We limit the people who can access operational data, and their permissions, to what is necessary, and keep server secret keys only on the server.
App error records are sent with account and request information removed (section 7).
Location information has separate measures in section 9-9.
For members who have not turned on “Make my Meal Scores public”, we do not create any path — on place pages, in sorting or search results, or in error messages — by which someone could find out who gave what score.

If a data breach occurs. If we learn that personal information has been leaked, within 72 hours we will tell you the items leaked, when and how it happened, what you can do to reduce harm, the measures the Company has taken and the procedure for relief from damage, and where to contact us. Because we do not collect members’ contact details, we will notify you through app notifications and on the Service’s screens, and post it on this site for at least 30 days. Where required by law, we will report it to the Personal Information Protection Commission (PIPC) or the Korea Internet & Security Agency (KISA), and if users outside Korea are affected, we will also notify the bodies designated by the law of those countries (section 16).

14. Officers and contact details

One person serves as the Privacy Officer, the Location Information Officer and the Youth Protection Officer.

Name 마영범 · Title CEO
Privacy Officer · Location Information Officer · Youth Protection Officer
Phone +82-10-3118-4154 · admin@thenonscale.com

Please send questions, requests and complaints about personal information, location information or youth protection by phone or email as above. We recommend email, so that there is a record. People using the Service from outside Korea can contact us at the same email address.

Nonscale Co., Ltd. (주식회사 논스케일) · CEO 마영범, 양현지
11, Yeongdong-daero 106-gil, Gangnam-gu, Seoul, Republic of Korea (서울특별시 강남구 영동대로106길 11)
Business registration no. 343-88-03751 · Corporate registration no. 110111-0952223 · Location-based service business filing No. 1112
Phone +82-10-3118-4154 · admin@thenonscale.com

We will list our EU and UK representatives in Legal notice as they are appointed. Points of contact for authorities and users are listed there too.

15. Remedies

If you need counseling or dispute mediation about an infringement of personal information, you can contact the bodies below. For disputes about location information too, you can apply for mediation to the Personal Information Dispute Mediation Committee (Location Information Act Article 28(2)). You can challenge a Company decision refusing your request in the way described in section 12, and you can also bring a lawsuit in court.

Personal Information Dispute Mediation Committee — 1833-6972 (in Korea) · www.kopico.go.kr
Privacy Infringement Report Center — 118 (in Korea) · privacy.kisa.or.kr
Supreme Prosecutors' Office Cyber Investigation Division — 1301 (in Korea) · www.spo.go.kr
Korean National Police Agency Cyber Bureau — 182 (in Korea) · ecrm.police.go.kr

16. If you use the Service from outside Korea

Personal information is processed on servers in the Republic of Korea and in the countries listed in section 7. You can exercise the rights given by the law of the country where you live in the ways described in section 12. This section adds provisions that apply only to people who live in those countries, and where it differs from sections 1 to 15, this section prevails.

Language. The Korean version of this policy is the authoritative version, and an English version is provided alongside it. For people who live in the European Economic Area, the United Kingdom or Switzerland, the English version is equally authoritative, and if the two versions differ, the one more favorable to that person applies.

16-1. European Economic Area (EEA)

For people who live in the 27 countries of the European Union (EU) and in Iceland, Liechtenstein or Norway, the EU General Data Protection Regulation (GDPR) applies.

Controller and representative. The controller is Nonscale Co., Ltd. (section 14). We have no establishment in the EU, and we will list our EU representative under GDPR Article 27 in Legal notice as it is appointed. From then on, users and supervisory authorities can also contact the representative. We have not appointed a data protection officer (DPO); inquiries are handled by the Privacy Officer in section 14.

Purposes and legal bases.

Purpose	Information	Legal basis (GDPR Article 6(1))
Creating your account and keeping you signed in	Sign-in identifier, sign-up time, nickname, profile photo, access information for signed-in sessions	Contract (b)
Leaving and showing ratings, highlights, “Haven't been” marks and saved places; calculating Meal Scores	Ratings and edit history, sign-up time	Contract (b)
Keeping ratings in the Meal Score calculation after account deletion (section 3)	Ratings and edit history, sign-up time — detached from nickname and sign-in information	Legitimate interests (f)
Drawing the map and linking places to Kakao Map places — your device sends directly to Kakao (sections 6 and 9-4)	The area in view (near you, if opened at your location), place search terms, IP address	Contract (b). When opened at your location, consent (a)
Sending notifications, app updates	Push tokens, app language, notification settings and records, device operating system, app version, installation identifier	Contract (b)
“Make my Meal Scores public”	Nickname, profile photo, entered scores and the month left	Consent (a) — withdrawn by turning the switch off
Location features (section 9)	Rounded coordinates (not stored), location settings	Consent (a) — withdrawn in MY → ☰ (Settings) → Location
Keeping records of agreement and location use records	Version agreed to, time and channel; location use records	Legitimate interests (f)
Preventing manipulation, security, responding to outages	Edit history, access records, app error records	Legitimate interests (f)
Handling reports, telling the person who reported the outcome, telling members about actions and the reasons	Records and notices of reports and actions, report forms	For people who live in the EU, legal obligation (c) — EU Digital Services Act (DSA). Otherwise, legitimate interests (f)
Receiving appeals against actions and reviewing them again	The content and result of appeals, and the notices about them	Legitimate interests (f)
Answering inquiries and requests	Email address and contents	Contract (b) or legitimate interests (f)
Responding to requests from authorities under the law	The scope requested	Legal obligation (c) if under EU or Member State law; legitimate interests (f) if under the law of other countries (such as Korea)

Our legitimate interests are keeping scores fair and preventing manipulation, keeping users and the Service safe, preparing for disputes, fixing faults, and complying with Korean law that applies to the Company (such as the Location Information Act).

Right to object. You can object at any time, on grounds relating to your particular situation, to processing based on legitimate interests (f in the table above). If you object, we will stop that processing unless the Company can show legitimate grounds that override it. Please tell us by email at the address in section 14. If you do not want your ratings kept in the Meal Score calculation after deleting your account (section 3), please object or ask for your ratings to be deleted before you delete your account — we will delete the ratings and remove them from the calculation (section 12). However, app error records do not include information that could identify the signed-in account (section 7), so the Company cannot pick out and stop them for one person only. If you do not want them, please use the website (bapsanglog.com), which does not send error records.

Information not obtained from you. Sign-in identifiers come from Kakao, Naver, Google or Apple, and information about reported members comes from other people’s reports. The app store age range in some regions is used only on the device and not stored (section 10).

Recipients. The processors in sections 6 and 7; everyone, if you turn on “Make my Meal Scores public”; Kakao (maps), which your device calls directly; the person who made a report (outcome only, section 5); and authorities under the law.

International transfers. Information you send directly from the EEA to the Company is processed in the Republic of Korea. The Republic of Korea is covered by an adequacy decision of the European Commission ((EU) 2022/254). When the Company sends information to processors in other countries, it is protected by the safeguards below. DPF is the EU-U.S. Data Privacy Framework (adequacy decision (EU) 2023/1795), and the table lists it where the recipient is on the certification list. The Standard Contractual Clauses (SCCs) are European Commission Decision (EU) 2021/914, and the table lists them where they are included in our agreement with that company. Copies of the SCCs listed in the table (Supabase, Expo and Google Firebase) are available on request by email. Where the table says “Being confirmed”, we will add the safeguard to this policy once it is confirmed.

Recipient	Country	Safeguard
Supabase Pte. Ltd.	Singapore company — data in Seoul, Republic of Korea; request logs in the USA and Singapore	SCCs (Supabase data processing agreement)
Vercel Inc.	USA	DPF certification
650 Industries, Inc. (Expo)	USA	DPF certification, SCCs (Expo terms of service)
Google LLC (Firebase Cloud Messaging)	USA and elsewhere (section 7)	DPF certification, SCCs (Firebase data processing terms)
Google LLC (Google Workspace)	USA and elsewhere (section 7)	DPF certification
Apple Inc. (Apple Push Notification service)	USA	Being confirmed — Apple states that it uses SCCs for personal information transferred from the European Economic Area (Apple Privacy Policy). We will state the safeguard between the Company and Apple once it is confirmed
Functional Software, Inc. (Sentry)	USA	DPF certification
GitHub, Inc. (GitHub Actions)	USA	DPF certification

Retention is as in section 2, and what we store on your device is as in section 8. Of the items in section 8, the app’s sign-in information, notification token, update information and app settings, and the location choice made when not signed in, are used to provide features you asked for. Sign-in information on the web stays even after you close the browser, so you stay signed in the next time you open it; if you do not want that, signing out when you are done deletes it. The installation identifier of the app error record tool and error records not yet sent are kept to fix faults, and whether you have seen the introduction shown to first-time visitors and whether the location notice has already been shown are kept so that the same notice is not shown repeatedly.

Rights. You can exercise the rights of access, correction, deletion, restriction of processing, data portability (a machine-readable file), objection and withdrawal of consent in the ways described in section 12. This is free; we keep the 10-day promise in section 12 first, and in no case go beyond the 1 month set by the GDPR (extendable by 2 more months if the request is complex or there are many requests — if we extend, we will tell you why). Withdrawing consent does not affect the validity of processing carried out before the withdrawal.

What you must provide. A sign-in identifier is needed for the membership agreement; if you do not provide one, you can only browse. Everything else is optional.

Automated decision-making. As in section 12. We do not make decisions that produce legal effects or similarly significant effects based solely on automated processing.

Complaints. You can lodge a complaint with the data protection supervisory authority of the country where you live, where you work, or where the infringement occurred (list of supervisory authorities). If a data breach occurs, we will notify the supervisory authority of the country where the affected people live within 72 hours as required by law, and if the risk is high, we will also notify users.

16-2. Switzerland

For people who live in Switzerland, the Swiss Federal Act on Data Protection (FADP) applies. The purposes of processing and the recipients are as in section 16-1. Personal information is processed in the Republic of Korea and in the countries in section 7 (the USA, Singapore and elsewhere). When it is sent to processors in other countries, it is protected by Swiss-U.S. DPF certification (Vercel, Sentry, Google and Expo) or by Standard Contractual Clauses adapted to Swiss law (Supabase). Apple states that it also uses SCCs for personal information transferred from Switzerland; the safeguard between the Company and Apple, and the safeguard for transfers from Switzerland to GitHub (Meal Score calculation), will be added to this policy once confirmed. You can request access, data portability, correction, deletion and objection in the ways described in section 12, and you can lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC, www.edoeb.admin.ch). We will notify the FDPIC as soon as possible of a breach that poses a high risk.

16-3. United Kingdom

A short summary for members aged 16–17
· The main things we collect are your sign-in number, the nickname and photo you choose, and the scores you leave. Other things are also kept, such as records of what you agreed to, information about the phone that gets your notifications, and access records (section 1). We do not collect your email, name or phone number.
· Other people can see your scores and nickname only if you turn on “Make my Meal Scores public”. It is off at first. Before you turn it on, talk it over with a trusted adult.
· We use your location only if you agree. Your exact location is not sent to us; only a rounded location (about 100 m for the map, about 1 km for “Near me”) is sent, and we do not store even that. We keep a record of when you used location features for 6 months. In Settings, you can pause it, turn it off for each feature, or withdraw your agreement.
· We do not show you ads, and we do not sell your information.
· If you delete your account, your account is deleted. The scores you left stay in the Meal Score calculation with your nickname and sign-in information removed. If you want your scores deleted too, tell us by email before you delete your account.
· If you have questions, ask us at admin@thenonscale.com. If you are not happy with our answer, you can tell the ICO.

For people who live in the United Kingdom, the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR) apply. Purposes and legal bases, recipients, information not obtained from you, what you must provide, and automated decision-making are as in section 16-1 (legal obligation means cases set by UK law). We will list our UK representative under UK GDPR Article 27 in Legal notice as it is appointed; from then on, users and the ICO can also contact the representative.

Children. Under UK law, people under 18 are children. Sign-up is for people aged 16 or older, so there may be members aged 16–17, which is why we have included the summary above. Our defaults are set as follows — public visibility is off, location is not used until you consent, we do not do profiling for advertising or marketing, and we do not sell personal information.

International transfers. Information you send directly from the UK to the Company is processed in the Republic of Korea. The UK has recognized the Republic of Korea as providing adequate protection (The Data Protection (Adequacy) (Republic of Korea) Regulations 2022). The safeguards the Company uses when sending information to processors in other countries are below. The UK-US data bridge is the UK extension of the DPF (The Data Protection (Adequacy) (United States of America) Regulations 2023), and the table lists it where the recipient is on that certification list. Where the table says “Being confirmed”, we will add the safeguard to this policy once it is confirmed. Copies of the UK Addendum listed in the table are available on request by email.

Recipient	Country	Safeguard
Supabase Pte. Ltd.	Singapore company — data in Seoul, Republic of Korea; request logs in the USA and Singapore	UK Addendum to the EU Standard Contractual Clauses (Supabase data processing agreement)
Vercel Inc.	USA	UK-US data bridge
650 Industries, Inc. (Expo)	USA	UK-US data bridge (certification stated by Expo)
GitHub, Inc. (GitHub Actions)	USA	UK-US data bridge
Functional Software, Inc. (Sentry)	USA	Being confirmed
Google LLC (Firebase Cloud Messaging · Google Workspace)	USA and elsewhere (section 7)	Being confirmed
Apple Inc. (Apple Push Notification service)	USA	Being confirmed

What we store on your device. Everything in section 8 is necessary for features you asked for, for signing in, for security, or for finding technical faults. We do not store anything for usage statistics.

Rights. You can exercise the rights of access, correction, deletion, restriction of processing, data portability and withdrawal of consent in the ways described in section 12. We keep the 10-day promise in section 12 first, and in no case go beyond the 1 month set by UK GDPR Articles 12(3) and 12A (extendable by 2 more months if complex). You can object to processing based on legitimate interests (section 16-1, “Right to object”).

Complaints. You can first make a complaint to the Company (Data Protection Act 2018, section 164A). If you send it by email to the address in section 14, we will acknowledge it within 30 days, look into it without delay and tell you the outcome. You can also make a complaint to the Information Commission (ICO) (section 165 of the same Act) — ico.org.uk/make-a-complaint · 0303 123 1113 (from outside the UK +44 303 123 1113). You can also seek a remedy in court. If a data breach occurs, we will notify the ICO within 72 hours as required by law, and if the risk is high, we will also notify users.

16-4. Other countries

Japan. We give this notice under the Act on the Protection of Personal Information of Japan (APPI).

Entrusting to third parties in a foreign country — the Company is in the Republic of Korea and entrusts processing to the processors in section 7 (in the USA, Singapore and elsewhere). For each processor, we are checking whether our agreement with that company (such as the safeguards in the table in section 16-1) contains measures that meet the standards set by APPI Article 28. We will add the processors checked, their measures, and how the Company monitors them to this policy once checked, and will tell you on request.
The personal information protection system of the countries where it is processed — the Republic of Korea has the Personal Information Protection Act, overseen by the Personal Information Protection Commission. The USA has no comprehensive federal privacy law, but has sector-specific federal laws and state laws. Singapore has the Personal Data Protection Act 2012 (PDPA), overseen by the Personal Data Protection Commission (PDPC). The Company takes the security control measures in section 13 after reviewing these systems.
You can request disclosure (access), correction, suspension of use and so on of retained personal data in the ways described in section 12, free of charge. If a data breach occurs, we will report it to the Personal Information Protection Commission of Japan (PPC) and notify the individuals concerned as required by law.

Singapore. The Privacy Officer in section 14 serves as the Data Protection Officer under the PDPA (admin@thenonscale.com). If we assess that a breach is notifiable, we will notify the PDPC within 3 days and notify the people affected.

Philippines. The Privacy Officer in section 14 serves as the data protection officer (DPO) under the Data Privacy Act of 2012. If a data breach occurs, we will notify the National Privacy Commission (NPC) and the people affected within 72 hours as required by law, and you can lodge a complaint with the NPC.

Thailand. You can exercise the rights under the Personal Data Protection Act B.E. 2562 (2019) (PDPA) — access, correction, deletion, suspension of processing, objection, data portability and withdrawal of consent — in the ways described in section 12, and you can lodge a complaint with the Personal Data Protection Committee of Thailand.

Canada (including Quebec). The person responsible for the protection of personal information is the Privacy Officer in section 14 (마영범, CEO, admin@thenonscale.com). Features that find your location are off at first, and turn on only when you consent in one of these places: the optional item on the sign-up and terms review screens, “Agree and use location” in the location notice, or MY → ☰ (Settings) → Location (section 9). Personal information is mainly processed outside Canada (in the Republic of Korea, the USA, Singapore and elsewhere) (section 7). While it is processed outside Canada, authorities of those countries, such as courts and investigative authorities, may access it under those countries’ laws. People who live in Quebec can lodge a complaint with the Commission d'accès à l'information du Québec (CAI), and others with the Office of the Privacy Commissioner of Canada (OPC).

Australia. Personal information is mainly processed outside Australia (in the Republic of Korea, the USA, Singapore and elsewhere) (section 7). Please first send complaints to the contact details in section 14; if you are not satisfied with our answer, you can make a complaint to the Office of the Australian Information Commissioner (OAIC).

United States. The Company does not sell personal information, does not share it for targeted advertising, and does not do profiling for decisions that produce legal effects. The coordinates in units of about 100 m sent for your location on the map may count as precise geolocation, which is sensitive information under the privacy laws of several states. So we use location only after getting your consent through the optional item on the sign-up and terms review screens or through the location notice (section 9), and use it only to provide the feature you asked for. You can request access, correction, deletion and data portability in the ways described in section 12, and if your request is refused, you can ask us to reconsider. We do not knowingly collect personal information of children under 13 (sign-up is for people aged 16 or older, section 10).

For California residents. This policy sets out the categories of information we process (section 1), the recipients (sections 6 and 7), how to access and correct your information (section 12), how we respond to Do Not Track signals (section 8), how we notify you when this policy changes (section 17), and its effective date. The Company does not sell personal information or share it for targeted advertising.

日本でご利用の方へ — 外部送信に関する公表事項

本サービス(アプリ・ウェブ)は、ご利用の端末から次の事業者へ情報を送信します(電気通信事業法第27条の12に基づく公表)。

送信先	送信される情報	利用目的
株式会社カカオ(Kakao Corp.) プライバシーポリシー	表示している地域(位置情報の利用に同意し、地図を現在地から開いたり現在地へ移動したりした場合は現在地の周辺)、場所検索の検索語とその店舗の位置、IPアドレス、端末・ブラウザの情報	地図の表示、店舗とカカオマップの場所の照合(アプリ・ウェブ)
Functional Software, Inc.(Sentry)	アプリのバージョン、端末の機種・OS、インストールごとに生成した識別子、エラーの内容とエラー直前のアプリの操作記録、IPアドレス	不具合の把握と修正(アプリのみ・エラーが起きたときのみ送信)
650 Industries, Inc.(Expo)	プッシュ通知トークン、インストールごとに生成した識別子、アプリの識別子、OS・アプリのバージョン、IPアドレス	通知の配信、アプリの更新(アプリのみ)
Google LLC(Firebase Cloud Messaging)	Firebaseのインストール識別子、アプリの情報	Android端末への通知の配信(アプリのみ)
Apple Inc.(Apple Push Notification service)	プッシュ通知トークンの発行に必要な端末の情報、アプリの識別子	iPhoneへの通知の配信(アプリのみ)

通知は端末の設定で許可しないか、アプリの「MY → ☰(Settings) → Notifications」で止められます。地図の表示と不具合の記録はサービスの動作に必要なため、アプリ内で止めることはできません。ウェブ版(bapsanglog.com)はSentry・Expo・Google(Firebase)・Appleへ送信しません。各事業者による取り扱いは、それぞれのプライバシーポリシーをご覧ください。お問い合わせは admin@thenonscale.com までお願いします。

17. Changes to this policy

When we change this policy, we will post the content before and after the change on this page from 7 days before it takes effect. If the change is important to your rights — for example, if the items collected or the purposes increase, or a transfer outside Korea is added — we will post it from 30 days before, and separately notify members through app notifications or notices on the Service’s screens. Earlier versions that took effect can be viewed exactly as posted in the Version history. Versions withdrawn before they took effect are not included in the version history; we will send their text on request by email.

Addendum

This policy takes effect on October 5, 2026.
The version effective October 7, 2026, posted on September 30, 2026, is withdrawn before it takes effect, and this policy replaces that version and the Privacy Policy in effect from September 12, 2026 (the “previous policy”). What differs from the previous policy is in “What changed in this version” at the bottom.
To take effect at launch on the same day as the Terms of Service, the Location-Based Services Terms and the Youth Protection Policy, this policy is posted on October 1, 2026 and takes effect four days later. So this time, we cannot keep the 7-day and 30-day advance notice promised by the previous policy and section 17. The processing this policy newly describes is of two kinds.
- Newly created records — location use records, records of consent and withdrawal, notices of action and appeals, names and email addresses in the report form, outcomes sent to people who made reports, the email for notices of action, and keeping taken-down profile photos. These are created only from when a member newly consents to location, uses a new feature, or there is an action, report or appeal.
- Processing done before but not described in the previous policy — server request logs being kept in the USA and Singapore; transfers outside Korea for notifications and updates (Expo, Google and Apple), Meal Score calculation (GitHub) and the Company’s email (Google Workspace); Meal Scores also appearing on place pages when “Make my Meal Scores public” is on; and so on. We are announcing these for the first time now.
Existing members will be informed of this policy through the terms review screen that appears the next time they open the app or website. Until they agree to the Terms of Service and confirm this policy on that screen, they can only read the terms and this policy, sign out and browse, or delete their account. Members under 16 who signed up before the effective date, when people aged 14 or older could sign up, cannot agree, and can delete their account at any time (section 10). Members whose use is restricted will be informed through that screen after the restriction is lifted.
The location consent in section 9 applies in the app and website updated for this policy. Web pages opened before the effective date ask for consent once they are refreshed, and the app asks once it is updated to a version that follows this policy. In any version, the server does not store coordinates.
We will send the text of the withdrawn version and of the previous policy on request by email.

Version history