GrowHabit Privacy Policy

Effective Date: November 11, 2026 | Last Modified: November 11, 2026

Article 1 (Purpose of Collection and Use of Personal Information)

The Service collects and uses personal information for the following purposes:

• Member Management: Identity verification for membership services, personal identification, prevention of unauthorized use, prevention of unauthorized access, confirmation of intent to register, restoring sign-in when moving to a new device (Android)
• Service Provision: Storage and management of habit data, provision of customized content, display of rankings and ranking profiles (Showcase), service usage records and statistical analysis
• Paid Services: Confirming purchases of subscriptions, the Lifetime Membership and the Supporter Membership and providing the related access, granting Purchase Rewards (welcome gifts and Supporter rewards) and removing them upon refund, and handling payment-related inquiries and disputes
• Service Improvement: Development of new services, improvement of existing services, provision of customized services through statistical analysis
• Customer Support: Delivery of announcements, handling inquiries and complaints, record keeping for dispute resolution
• Advertising and Marketing Communications: Showing ads to free users (including personalized ads, Article 11) and sending marketing information such as benefits and events to users who have opted in (Article 12)
• Abuse Prevention: App integrity checks (App Check) and prevention of abuse of the inquiry and report features
• User Report Handling: Receiving, reviewing and acting on reports about other users (such as an inappropriate nickname), and hiding reported users from the reporting user's screens

Article 2 (Personal Information Items Collected)

1) Information Collected During Registration

• Required Items: Email address, password, nickname (for email registration). If you sign up with Google or Apple social login, you sign up with the social account information below and set your nickname in the app after signing up.
• Social Login: Social account information (email and profile information from Google, Apple accounts)
• Note on Social Login: When you sign in with Google or Apple, they may also provide your name and profile photo. This information is stored with the sign-in record that links your social account, but the Service does not display it or use it for any other purpose, and it is deleted when you withdraw from the Service. If you choose "Hide My Email" when signing in with Apple, we receive the relay email address provided by Apple.

2) Information Automatically Collected During Service Use

• Access IP address, access time, service usage records
• Device information (device model, OS version, app version, device identifier)
• Habit performance records and in-app activity records
• Push notification tokens (FCM registration token, APNs token)
• Device language (locale) and time zone settings
• Advertising identifiers (Android Advertising ID (ADID), iOS Identifier for Advertisers (IDFA)) — see Article 11 for details
• Crash diagnostic information (error logs and device status information generated when the app terminates abnormally)
• App install referral information (Install Referrer)
• App integrity check information (the result token Firebase App Check obtains through Google Play Integrity on Android and Apple App Attest on iOS to confirm that the app is a genuine installation) — used to prevent unauthorized use of app content
• App configuration request information (the per-installation identifier Firebase Remote Config uses when the app downloads settings such as update notices)
• Subscription and purchase status information (purchased products such as subscriptions, the Lifetime Membership and the Supporter Membership, whether access is active, renewal/expiration dates, etc.)
• Country (store country: the country/region set for the device's App Store or Google Play account, one of Korea, the USA, Canada, Australia, or New Zealand) — used to show a flag on the ranking screen. This is country-level information only; we don't use location permission, GPS, or IP address to determine your device's location for this item (see Article 11 for the approximate location the ad provider estimates from your IP address, and Article 3, 2) for the country in payment transaction records). See Article 5 for details

3) Information Collected When Contacting Customer Support

When a user submits an inquiry through customer support (the in-app inquiry form, guest inquiry, email, etc.), the Service collects the following information for the purpose of handling and responding to inquiries and providing technical support.

• Member Inquiries: Inquiry content, attached photos (optional, up to 3; the app removes location and other photo metadata before sending), app version, OS information, device model, user identifier
• Non-Logged-In (Guest) Inquiries: Email address, inquiry content, app version, OS information, device model

In-app and guest inquiries are collected only if the user checks "[Required] I agree to the collection and use of my info to handle my inquiry" on the inquiry screen. You may decline, but then you can't submit an inquiry in the app. In that case, you can contact us at the email address in Article 15. App version, OS information, device model and user identifier are sent automatically with the inquiry.

4) Payment, Subscription and Purchase Reward Information

The Service offers in-app subscriptions (monthly, yearly) and one-time purchase products (the Lifetime Membership and the Supporter Membership). Actual payment processing and payment method information (such as card numbers) are handled by Apple Inc. (App Store) or Google LLC (Google Play); the Company does not directly collect or store payment method information.

• Items Collected: Purchased product identifier, subscription and purchase status (active, expired, cancelled, refunded), subscription start/renewal/expiration dates, platform transaction identifier
• Purchase Reward Records: Records of granting and removing welcome gifts and Supporter rewards (the Supporter title and badge and the Supporter Set), including the store transaction identifier and product on which the grant was based, the dates of granting and removal, and the items granted, as well as whether the removal notice upon refund has been shown
• Redeem Codes (Promotional Codes): Codes are issued and validated by Apple or Google and are redeemed on each store's code entry screen opened from [My Profile] > [Redeem Code]. The Company does not receive the code itself and only confirms the resulting access through RevenueCat.
• Processing Parties: Verification and management of subscription and purchase status is processed through RevenueCat, Inc., and actual in-app purchases are processed by Apple Inc. and Google LLC. (See Article 6 on entrustment of processing and Article 7 on overseas transfers for details.)

5) Information Collected from Anonymous (Non-Member) Users

The Service provides a feature that allows users to start using it anonymously without separate registration. Anonymous users are subject to the collection of the following information, in the same manner as registered members.

• Habit data and habit performance records, in-app activity records
• Push notification tokens, device information, device language and time zone
• Advertising identifiers, crash diagnostic information
• Country (store country)

Anonymous users may convert to a registered account through Google or Apple social login. The method of deleting an anonymous user's personal information follows Article 9.

6) Information Related to Consent to Receive Advertising Information

When a user consents to receiving marketing information at the time of registration, in the consent prompt shown after sign-up or account upgrade, or in the in-app notification settings, the Service collects and retains the following information.

• Whether the user consents to receiving marketing (advertising) information by push notification, and the dates of consent and withdrawal
• Whether the user has given separate consent to the transmission of advertising information at night (from 9:00 p.m. to 8:00 a.m. the following day), and the dates of consent and withdrawal
• Whether the user consents to receiving advertising information by email, and the dates of consent and withdrawal (only for full accounts with a verified email address)

Consent to receive marketing information is optional, and the Service may be used without restriction even if such consent is not given. For details, please refer to Article 12.

7) Information Collected When Deleting an Account

To improve the Service, the following information is collected when a user deletes their account.

• The reason for leaving (the option selected) and the date and time of deletion
• If "Other" is selected, the reason entered by the user (entering text is optional)

8) Information You Enter or Create While Using the Service

To provide the Service, we store on our servers the following information that you enter in the app or that is created as you use the Service.

• Habit information: Habit names, plant names, cue (trigger) text, goals and units, reminder days, times and base time zone, and performance records such as completions
• Diary (paid subscribers): Diary text, the selected mood, and the dates it was written or edited — visible only to you and never shown to other users
• Grower type quiz result: The resulting type, the versions of the questions and scoring rules, and the completion time — your individual answers are not stored on our servers and are kept only on your device
• Progress and reward information: Level, titles (including the Supporter title), achievement progress, Seed earning and spending history and balance, owned items, and rewards earned from rewarded ads along with the total number of ads watched
• Subscription cancellation survey: If you answer it on the cancellation screen, the reason you selected and any text you enter when choosing "Other" (entering text is optional) — stored with our subscription management provider, RevenueCat, Inc. (see Article 7)
• Decoration and garden information: The background, table, pot, plant, diary, completion tool, sign and BGM equipped for each habit, the garden background and BGM, where plants are placed in the garden and whether they are shown, and wishlisted items
• Ranking profile: The habit you chose as your Showcase, and a random public profile ID used to refer to you when your profile is shown to other users (separate from your account identifier)
• Sign-in restore information for new devices (Android full accounts): The public key and registration details of a restore key used to sign you in automatically to the same account on a new Android device — the private key is kept by Google on your device and in your Google account backup, and the Company never receives it
• Report and hide information: When you report another user in the rankings, we store the reporting user and the reported user, the reason (inappropriate nickname or other), the text you enter if you choose "Other" (up to 100 characters), the reported user's nickname at the time of the report, and the date, time and handling status of the report. We also store the list of users you have hidden and when you hid them. The reported user is not told who reported them

9) Information Collected When You Request Account Deletion on the Web

If you request account deletion through the deletion request page on our website without installing the app, we collect the following:

• Email address — used to send a verification email; stored on our server only as a one-way hash
• A one-way hash of your IP address — to prevent repeated requests and abuse
• The language of the request page, and the date, time and result of the request

Article 3 (Retention and Use Period of Personal Information)

In principle, personal information is destroyed without delay after the purpose of collection and use is achieved. However, the following information is retained for the specified periods for the reasons stated below:

1) Information Retained by Internal Company Policy

• Account Restriction (Sanction) Records: Records such as the reason for and period of a restriction are kept until the member withdraws from the Service (they remain after the restriction ends and are deleted upon withdrawal)
• Withdrawn Member Information: Deleted as soon as the withdrawal is processed (reasons for leaving and original subscription status notification records received after withdrawal follow the items below, and payment transaction records and refund or payment dispute inquiry records are kept under 2) below)
• Customer Inquiry and Response Records: 90 days after the response is completed (inquiries awaiting a reply are kept until we reply, and are deleted immediately when you delete your account). However, refund or payment dispute inquiries are kept for 3 years after they are resolved (see 2) below), and if you delete your account before we classify an inquiry as a dispute, that inquiry is deleted with your account
• Non-Logged-In (Guest) Inquiries: 30 days after receipt (may be deleted sooner once we reply; includes our reply emails). However, refund or payment dispute inquiries are kept, including the email address, for 3 years after they are resolved (see 2) below)
• Anonymous (Trial) Account Information: Until 30 days after the trial ends (33 days after sign-up). If the account isn't upgraded to a full account by then, the account and all its data are deleted automatically
• Reasons for Account Deletion: The selected reason option is unlinked from the account so it can no longer be attributed to anyone, and is kept for Service improvement statistics. Reasons entered as free text may contain personal information and are deleted 1 year after account deletion
• Consent to Receive Marketing Information and the Dates of Consent and Withdrawal: Until consent is withdrawn or the member withdraws from the Service
• Country (Store Country): Until the user requests that processing be stopped or the member withdraws from the Service (updated to the device's latest value whenever the app is opened)
• Authentication Records (email address, IP address and time recorded when sign-up, sign-in and other authentication requests are processed): 90 days
• Habit Information, Diaries, Grower Type Quiz Results, Progress and Reward Information, Decoration and Garden Information and Ranking Profile under Article 2, 8), and Purchase Reward Records under Article 2, 4): Until you delete them yourself or withdraw from the Service (diaries are also deleted when the related habit is deleted)
• Sign-in Restore Information for New Devices: Until you sign out or withdraw from the Service (signing out deletes the restore key on the device and the public key on our server)
• Report Records: 1 year from the most recent report. Deleted immediately if the reporting user or the reported user withdraws from the Service; duplicate-prevention records for reports (request numbers) are kept for 7 days
• Hidden User List: Until you unhide the user or withdraw from the Service. Deleted immediately if either the hiding user or the hidden user withdraws
• Web Account Deletion Requests (hashed email and IP, language, result): 30 days after the request; records used to prevent repeated requests are kept for 2 days
• Sign-ups Without Completed Email Verification (email address): Deleted 7 days after sign-up (up to 30 days if delayed, for example by resending the verification email)
• Withdrawal Verification Records (hashed account identifier, time of withdrawal): 90 days after withdrawal — used only to prevent duplicate deletion processing and to confirm completion of deletion requests to external services such as RevenueCat
• Original Subscription Status Notification Records (the original payment and subscription status notifications sent by RevenueCat, Inc., our subscription management provider, including the account identifier, store transaction identifier, product, amount paid and currency, and country): Records that have been processed are deleted 7 days after processing, and records that could not be processed and need review are kept for up to 30 days before deletion. When a member withdraws, that account's records are deleted together; records of notifications that arrive after withdrawal are deleted once the same period has passed
• Apple Sign-in Unlinking Requests (encrypted Apple token): Until Apple confirms the unlinking, at most 37 days
• Records Used to Prevent Duplicate or Abusive Inquiries: The submission time, request number, an unreadable converted value (hash) of the content and, for members, the user identifier are kept for 7 days. An unreadable converted value of the connecting IP address, used to prevent abuse of guest inquiries, is kept for 1 day
• Confirmation of Consent to Marketing and Nighttime Advertising Information: We notify you of your consent every 2 years. Your consent stays in effect unless you withdraw it (see Article 12)

2) Information Retained by Related Laws

Applicable laws require the following records to be kept for the periods below. The duty to keep e-commerce transaction records comes from Article 6 of the Act on Consumer Protection in Electronic Commerce and Article 6 of its Enforcement Decree.

• Records of Contracts or Subscription Withdrawals: 5 years (E-Commerce Act)
• Records of Payment and Supply of Goods: 5 years (E-Commerce Act)
• Records of Consumer Complaints or Dispute Resolution: 3 years (E-Commerce Act)
• Records of Display and Advertisement: 6 months (E-Commerce Act)
• Website Visit Records: 3 months (Communications Secrets Protection Act)

The Service's paid products are sold only through in-app purchases on the Apple App Store and Google Play. Payment method information and payment processing records are kept by Apple Inc. and Google LLC, which process the payments, and subscription and purchase status is kept by our subscription management provider, RevenueCat, Inc., each under its own privacy policy. As a business subject to the record-keeping duty under the laws above, the Company keeps the following records separately from other personal information.

• Payment Transaction Records: The facts of contracts, payments, renewals, cancellations, refunds and transfers for in-app purchases (account identifier, store transaction identifier, product, store, dates and times, amount paid and currency, and the country estimated from the location at the time of payment as reported by our subscription management provider) are recorded when we receive the payment notification and kept for 5 years from that transaction (for subscriptions, from the last renewal, cancellation, refund or similar event). Names, email addresses and payment method information are not included in these records.
• Refund or Payment Dispute Inquiry Records: The content of member and guest inquiries that we classify as refund or payment disputes, and our responses (including the email address for guest inquiries), are kept for 3 years after they are resolved.

These records are kept for these periods even after you withdraw from the Service, are not used for any purpose other than legally required retention and handling disputes, and are destroyed without delay when the period ends.

Article 4 (Provision of Personal Information to Third Parties)

The Service does not, in principle, provide users' personal information to third parties. However, exceptions are made in the following cases:

• When users have given prior consent
• When required by law or requested by investigative agencies according to procedures and methods prescribed by law for investigation purposes
• When provided in a form that cannot identify specific individuals for purposes such as statistical compilation

Where the Company provides personal information to a third party with the user's consent, it will, in advance, inform the user of and obtain consent for the following matters:

• The party to whom the personal information is provided
• The purpose for which the recipient will use the personal information
• The items of personal information provided
• The period for which the recipient will retain and use the personal information

Article 5 (Disclosure of Information Within the Service, Including Rankings)

To motivate users in forming habits, the Service provides a ranking (leaderboard) feature that allows users to compare their records with those of other users. A user's habit performance records are automatically aggregated into weekly and monthly rankings as the user uses the Service, and accordingly the following information about that user is disclosed to other users.

• Nickname
• Level and title
• Activity records such as the number of completed habits, the number of fully bloomed plants, and the number of habits in progress
• Country (the store country described in Article 2, shown as a flag)

Because the above information is shown to other users through screens such as the ranking screen, users are advised not to include their real name, contact information, or any other information that can identify an individual in their nickname. The nickname can be changed in the in-app [My Profile] menu (the first change after setting it is free, and later changes cost Seeds).

There is no in-app setting to turn off the flag. Users who don't want their country shown to other users may ask the Personal Information Protection Officer (Article 15) to stop processing their country information (see Article 9).

Along with the information above, the rankings show each user's rank and the image of the title they have equipped. Only full accounts appear in the rankings; activity on trial (anonymous) accounts is counted but is shown only after the account is upgraded to a full account. Users who haven't set a nickname yet are shown with a name in the form "Grower #0000," created from part of their account identifier. No flag is shown if there is no country information or if its processing has been stopped. Habit names, plant names, diaries and Grower type quiz results are not shown to other users.

Tapping a user in the rankings opens that user's ranking profile (postcard), which shows the information above together with a decorated scene of one of that user's habits (the Showcase: the type of background, table, pot and plant, the plant's growth stage and whether it has bloomed, and the look of the diary, completion tool and sign). You can choose your Showcase in [My Profile] > [Change Showcase]; if you don't, it is chosen in an order set by the Service, such as your first habit in progress in your habit order. The Showcase does not show habit names, plant names, the text on the sign or your records. Ranking profiles of trial (anonymous) accounts and restricted accounts are not shown to other users; otherwise, other users who have already seen you in the rankings can open your ranking profile again even after you drop out of the ranked list.

If another user's nickname or other displayed information is inappropriate, you can report it with [Report] on that user's ranking profile (postcard). The reported user is then shown as "Hidden user" in your rankings, and you can unhide them at any time by tapping the hidden entry. The reported user is not told who reported them. Our operations team reviews reports and may take action such as resetting the nickname or restricting the account (see Article 2 8) and Article 3).

Sharing

You can turn a diary entry, a habit completion record (polaroid), a bloomed plant or your garden into an image and share it with other apps. Share images are created on your device and are not uploaded to our servers; they are sent only to the app or service you choose, and only when you choose to share. A share image may include your habit name, plant name, diary text and mood, dates and records such as completion counts, so please check that it contains nothing you don't want to make public before sharing. Once sent, the image is handled under the policies of the app or service you chose. The app link sent with the image (go.forallpeoplecorps.com) contains only the type of share and the app language, never your user identifier, habit names or other personal information. Because some apps drop text sent with an image, the same link is also copied to your device's clipboard.

Article 6 (Entrustment of Personal Information Processing)

The Service entrusts certain personal information processing tasks to external specialized providers for the smooth provision and stable operation of the Service, as described below. When entering into entrustment contracts, the Company stipulates the necessary matters to ensure that personal information is managed securely. The Company also confirms, through its contracts and the providers' own privacy policies, that its processors and the advertising and analytics providers that receive personal information protect it to a standard equivalent to this Policy.

Although Supabase Inc. is a U.S. company, the database in which the Service's personal information is stored is located within the Republic of Korea (Seoul region); therefore, such data is not transferred overseas. The Supabase processing code (Edge Functions) called by the app and by our website is also pinned to run in the Seoul region. If the content of entrusted tasks or the trustee changes, we will disclose it through this Privacy Policy.

Article 7 (Overseas Transfer of Personal Information)

The Service transfers users' personal information overseas as described below. Users may refuse the overseas transfer of personal information; however, refusal may limit the use of some services, such as push notifications, ad-supported free features, subscription management, and email verification or password reset.

If you don't want your personal information transferred overseas, you can tell the Personal Information Protection Officer (Article 15) by email. Features that can't be provided without an overseas transfer will be limited, and if you no longer wish to use the Service at all, you can withdraw using the methods in Article 9.

If you live outside the Republic of Korea, your personal information is transferred to and stored and processed in the Republic of Korea, because the Service's database is located there (Seoul region). It may also be processed in the USA and other countries through the providers listed below.

1) Google LLC

• Transferee: Google LLC (Privacy contact: support.google.com/policies)
• Country of Transfer: The USA and other countries where Google operates data centers
• Items Transferred: Push notification tokens, device information, advertising identifiers, crash diagnostic information, service usage records, IP address, app install referral information, app integrity check tokens, the per-installation identifier used for app configuration requests, the user's email address and reply content when we respond to a customer inquiry
• Additional Items Transferred: The title and body of push notifications sent by our servers (such as the habit names, plant names and cue text you entered), and connection information such as the IP address included in the app's network time checks and in font (Google Fonts) requests from the website, the evening content web pages and service emails
• Date and Method of Transfer: Transmitted over the information and communications network at the time of service use
• Purpose of Use: Push notification delivery, app crash diagnostics and analysis, service usage analytics, app integrity checks, app configuration delivery, advertising delivery, replying to customer inquiries
• Retention and Use Period: Until the entrustment purpose is achieved or the entrustment contract ends (in accordance with Google's privacy policy)

2) RevenueCat, Inc.

• Transferee: RevenueCat, Inc. (Privacy contact: www.revenuecat.com/privacy)
• Country of Transfer: USA
• Items Transferred: User identifier, device information, subscription and purchase status information (purchased products such as subscriptions, the Lifetime Membership and the Supporter Membership, subscription and purchase status, renewal/expiration dates, platform transaction identifier)
• Additional Items Transferred: Subscription cancellation survey responses (the reason selected, and any text entered when choosing "Other")
• Date and Method of Transfer: Transmitted over the information and communications network at the time of using or checking subscription products
• Purpose of Use: Verification and management of in-app subscription and purchase status, and confirming purchases to grant and remove Purchase Rewards
• Retention and Use Period: Until the entrustment purpose is achieved or the entrustment contract ends (in accordance with RevenueCat's privacy policy)
• Upon Account Deletion: When a member withdraws from the Service or a trial account is deleted automatically, the Company asks RevenueCat to delete that user's subscriber record. Payment records held by Apple and Google, which processed the payments, are retained under their own policies.

3) Resend, Inc.

• Transferee: Resend, Inc. (Privacy contact: resend.com/legal/privacy-policy)
• Country of Transfer: The USA and other countries where Resend operates email delivery infrastructure (such as Japan)
• Items Transferred: Email address and information included in the email body (email verification and password reset links, account restriction reason and period, the fact and date of consent to advertising information, the confirmation link for a web account deletion request and the deletion completion notice)
• Date and Method of Transfer: Transmitted over the information and communications network at the time an email is sent
• Purpose of Use: Sending service emails such as sign-up email verification, password reset, account restriction notices, notices confirming consent to advertising information, and confirmation and completion notices for web account deletion requests
• Retention and Use Period: Until the entrustment purpose is achieved or the entrustment contract ends (in accordance with Resend's privacy policy)

4) Apple Inc.

• Transferee: Apple Inc. (Privacy contact: www.apple.com/legal/privacy)
• Country of Transfer: The USA and other countries where Apple operates servers
• Items Transferred: iOS push notification tokens (APNs tokens), the title and body of push notifications (such as habit names, plant names and cue text), app integrity check requests (App Attest), and connection information such as the IP address included in App Store lookups used to check for app updates
• Date and Method of Transfer: Transmitted over the information and communications network when a push notification is sent (via Firebase Cloud Messaging) or when app integrity is checked
• Purpose of Use: Delivering push notifications to iOS devices, app integrity checks, checking for app updates
• Retention and Use Period: Until the entrustment purpose is achieved or the entrustment contract ends (in accordance with Apple's privacy policy)

5) Netlify, Inc.

• Transferee: Netlify, Inc. (Privacy contact: www.netlify.com/privacy)
• Country of Transfer: The USA and other countries where Netlify operates servers
• Items Transferred: IP address, browser and device information and access time when you visit the website or evening content web pages
• Date and Method of Transfer: Transmitted over the information and communications network when you visit a web page
• Purpose of Use: Providing the website and evening content web pages
• Retention and Use Period: Until the entrustment purpose is achieved or the entrustment contract ends (in accordance with Netlify's privacy policy)

6) Cloudflare, Inc.

• Transferee: Cloudflare, Inc. (Privacy contact: www.cloudflare.com/privacypolicy)
• Country of Transfer: The USA and other countries where Cloudflare operates its network
• Items Transferred: IP address, device and browser information (User-Agent) and request time when the app downloads content (images, videos and audio), when you visit the website, or when a marketing or share link is opened — the app's content requests may include an app integrity check token but never a user identifier
• Date and Method of Transfer: Transmitted over the information and communications network when content is downloaded, the website is visited, or a link is opened
• Purpose of Use: Storing and delivering app content and the website, and routing marketing and share links
• Retention and Use Period: Until the entrustment purpose is achieved or the entrustment contract ends (in accordance with Cloudflare's privacy policy)

7) Slack Technologies, LLC

• Transferee: Slack Technologies, LLC (Privacy contact: slack.com/trust/privacy/privacy-policy)
• Country of Transfer: The USA
• Items Transferred: When reports about the same user reach a certain number, the alert sent to our operations team contains the reported user's public profile ID, the nickname at the time of the report, the report reason category and the number of reports — it does not contain the reporting user's information, the text entered for an "Other" reason or any account identifier
• Date and Method of Transfer: Transmitted over the information and communications network when a report is received
• Purpose of Use: Delivering user reports to our operations team
• Retention and Use Period: Until the entrustment purpose is achieved or the entrustment contract ends (in accordance with Slack's privacy policy)

Article 8 (Destruction of Personal Information)

When personal information becomes unnecessary due to the expiration of the retention period or achievement of processing purposes, the Service destroys such personal information without delay.

Destruction Procedures and Methods

• Destruction Procedure: Information whose retention period has ended or whose purpose has been achieved is destroyed without delay. When a member withdraws, the data linked to the account is deleted from the database together. Information kept after being unlinked from the account (such as reasons for leaving), information kept for a period set in Article 3 (such as withdrawal verification records and original subscription status notification records received after withdrawal) and information that must be kept under applicable laws is stored separately from other information and destroyed when its period ends.
• Destruction Method: Electronic file information is deleted using technical methods that make records irreproducible, and any personal information printed on paper is destroyed by shredding or incineration.

Article 9 (Rights of Users and How to Exercise Them)

Users can exercise the following rights at any time:

• Request to view personal information
• Request for correction in case of errors
• Request for deletion
• Request to stop processing

If a user requests that processing of their country (store country) information be stopped, the Company will delete that user's country information without delay and stop showing their flag in rankings, and will not store their country information again while the request remains in effect, even when the app is opened.

How to Delete Your Account and Personal Information

Users may request deletion of their account and the personal information held by the Company (account withdrawal) through one of the following methods. Upon completion of withdrawal, personal data held by the Company — such as habit data and push notification tokens — will be deleted. (However, records kept for a period set in Article 3 and information that must be retained under relevant laws will be kept for the applicable period.) Advertising identifiers are not stored on our servers; you can reset or delete them in your device settings (Article 11).

• Within the app: [My Profile] > [Delete Account] menu
• Via web page: https://growhabit.forallpeoplecorps.com/deletion-request-en/

Anonymous (non-member, trial account) users have no email or other information we can use to verify them, so their accounts can't be deleted through the web page. During the trial (3 days after sign-up), they can delete their account and data in the app from [My Profile] > [Delete Account]; after the trial ends, they can delete it right away from [Delete trial account] on the trial-ended screen shown when the app opens. Anonymous accounts that aren't switched to a full account within 30 days after the trial ends are deleted automatically, along with all their data. Other rights may be exercised through the methods above or by contacting the Personal Information Protection Officer via written communication or email, and we will take action without delay.

When you delete your account, the Company asks Apple to revoke the Sign in with Apple connection (token) if you signed up with Apple, asks our subscription management provider (RevenueCat) to delete your subscriber record (see Article 7), and deletes the public key used to restore sign-in on a new device from our server. Deleting your account does not cancel an App Store or Google Play subscription, so please cancel it yourself in the store where you subscribed.

If a user requests correction of an error in their personal information, the Company will not use or provide such personal information to any third party until the correction is completed. In addition, where the inaccurate personal information has already been provided to a third party, the Company will notify that third party of the result of the correction without delay so that the correction is carried out.

If the Company refuses a user's request to exercise their rights for justifiable reasons — such as where it falls under grounds for restriction under applicable laws, or where there is a risk of unfairly infringing the life, body, property, or other interests of another person — the Company will notify the user of the reason and the method of objecting thereto within 10 days from the date of receiving the request.

Article 10 (Measures to Ensure the Security of Personal Information)

The Service takes the following measures to ensure the security of personal information:

1) Technical Measures

• Personal information stored on our servers is protected by the cloud provider's encryption at rest, and database access is restricted so that each user can access only their own information and information designated to be public, such as rankings.
• Security programs are installed and regularly updated and inspected to prevent leakage and damage of personal information due to hacking or viruses.
• SSL and other encrypted communications are used for secure transmission of personal information.

2) Administrative Measures

• Minimizing and training personnel handling personal information.
• Limiting access rights to personal information to a minimum.
• Maintaining access records to personal information processing systems.

Article 11 (Collection of Advertising Identifiers and Personalized Advertising)

The Service collects and uses mobile advertising identifiers to provide ad-supported free features, and personalized advertising may be delivered through them.

• What are Advertising Identifiers: The Advertising ID (ADID) on Android and the Identifier for Advertisers (IDFA) on iOS. These are device-level identifiers that users can reset or restrict.
• Purpose of Collection and Use: Advertising delivery and effectiveness measurement, provision of personalized advertising, prevention of fraudulent ad impressions
• Processing Party: Advertising is delivered through Google LLC's AdMob. (See Article 6 on entrustment of processing and Article 7 on overseas transfers.)
• Collection by the Ad Provider: When delivering ads, Google (AdMob) may directly collect advertising identifiers, device information, IP addresses, approximate location estimated from IP addresses, and ad-related usage information such as ad impressions and clicks. This processing is governed by Google's privacy policy.

How to Opt Out of Personalized Advertising and Control Advertising Identifiers

• Android: In Settings > Google > Ads, you can select "Delete advertising ID" or "Opt out of Ads Personalization."
• iOS: In Settings > Privacy & Security > Tracking, you can deny apps' tracking requests. You may also decline tracking in the App Tracking Transparency (ATT) consent prompt, which the app shows after explaining its purpose on an in-app screen.
• About the iOS Tracking Request: Before showing the system tracking permission request, the app first explains its purpose on an in-app screen. Ad rewards and the terms of using the Service are the same whether or not you allow tracking.

Even if a user restricts the use of advertising identifiers, the Service itself remains usable, but advertising may be delivered in a form less relevant to the user.

Use of Cookies on Web Pages

Cookies may be used solely on the Service's promotional web pages (websites). A cookie is a small piece of information that a website server sends to a user's browser; users can refuse cookies through their browser settings. The mobile app does not use cookies.

Article 12 (Transmission of Advertising Information and Use for Marketing)

In order to send users advertising information such as events and benefits, the Service obtains users' consent at the time of registration, in the consent prompt shown after sign-up or account upgrade, or in the in-app notification settings, as described below.

• Consent Items: [Optional] Consent to receive advertising information (events/benefits) by push notification, [Optional] consent to receive advertising push notifications at night, and [Optional] consent to receive advertising information by email (only for full accounts with a verified email address). You can give or withdraw each consent separately.
• Purpose of Use: Informing and transmitting advertising information such as events, promotions, and benefits, and providing customized benefits
• Method of Transmission: In-app push notifications, and email (if you consented to email)
• Separate Consent for Nighttime Hours: In accordance with Article 50 of the 「Act on Promotion of Information and Communications Network Utilization and Information Protection」, separate consent is obtained when advertising information is transmitted during nighttime hours (from 9:00 p.m. to 8:00 a.m. the following day).

Consent to receive marketing information is optional, and there is no restriction whatsoever on the use of the Service even if such consent is not given. Even after giving consent to receive such information, users may withdraw their consent at any time in the in-app notification settings menu or through the unsubscribe link in the notice email, and upon withdrawal, the transmission of advertising information is immediately stopped. The Company retains the dates of users' consent and withdrawal, and notifies users of such fact upon consent or withdrawal.

We notify you of your consent and its date every 2 years, along with how to withdraw it. Your consent stays in effect unless you withdraw it. Promotional app push notifications are labeled "(Ad)" at the beginning of the title and body, and promotional emails at the beginning of the subject line, and promotional emails include an unsubscribe link that withdraws your consent with one tap.

However, the transmission of mandatory or operationally necessary information — such as announcements required for the operation of the Service, notices of amendments to the terms, and responses to customer inquiries — does not constitute advertising information and may therefore be transmitted regardless of the above consent.

Article 13 (Protection of Personal Information of Children Under 14)

The Service is only for people aged 14 or older, and we do not collect personal information from children under 14. We confirm that users are 14 or older when they sign up, as follows.

• Email sign-up: A required checkbox on the sign-up screen confirming that you are 14 or older
• Google or Apple social login, and starting a trial (anonymous) account: Continuing after the notice on the sign-in screen stating that, by continuing, you confirm you are 14 or older and agree to the Terms of Service and Privacy Policy

If we learn that personal information of a child under 14 has been collected, we delete that account and the personal information without delay. A parent or legal guardian who believes their child's personal information has been collected can ask us to delete it by email (Article 15).

Under this age requirement, the Service is also not directed to children under 13 as protected by the U.S. Children's Online Privacy Protection Act (COPPA), and we do not knowingly collect their personal information.

Article 14 (Changes to the Privacy Policy)

This Privacy Policy is applied from the effective date, and when there are additions, deletions, or corrections of changes according to laws and policies, we will notify you through in-app announcements or email 7 days before the implementation of changes (30 days before for changes that materially affect your rights, such as the items collected, purposes of use or retention periods).

Article 16 (Remedies for Personal Information Infringement)

Users can apply for dispute resolution or consultation to the Personal Information Dispute Mediation Committee, Korea Internet & Security Agency's Personal Information Infringement Report Center, etc., to receive relief for personal information infringement.

• Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
• Personal Information Infringement Report Center: 118 (privacy.kisa.or.kr)
• Supreme Prosecutors' Office: 1301 (www.spo.go.kr)
• National Police Agency: 182 (ecrm.cyber.go.kr)

Article 17 (Rights of California Residents — CCPA/CPRA)

If you are a California resident, the following provisions apply to you in accordance with the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA).

Do Not Sell or Share My Personal Information

The Company does not sell your personal information for monetary consideration. However, the use of advertising identifiers for personalized advertising may be considered "sharing" of personal information for cross-context behavioral advertising under the CCPA/CPRA. You may opt out of such sharing at any time by restricting your advertising identifier through your device settings or by declining the App Tracking Transparency (ATT) request, as described in Article 11.

Your Rights as a California Consumer

• Right to Know: To request disclosure of the categories and specific pieces of personal information collected, the sources, the purposes, and the categories of third parties with whom it is shared.
• Right to Delete: To request deletion of personal information the Company has collected about you.
• Right to Correct: To request correction of inaccurate personal information.
• Right to Opt Out of Sale/Sharing: To opt out of the sale or sharing of your personal information.
• Right to Limit Use of Sensitive Personal Information: To limit the use and disclosure of sensitive personal information.
• Right to Non-Discrimination: To not receive discriminatory treatment for exercising any of the above rights.

To exercise these rights, please contact the Personal Information Protection Officer (Article 15) or use the account deletion methods described in Article 9. We will not discriminate against you for exercising any of your CCPA/CPRA rights.

Article 18 (Rights of Users in Canada — PIPEDA and Quebec Law 25)

If you live in Canada, the following applies to you under the Personal Information Protection and Electronic Documents Act (PIPEDA), Quebec's Act respecting the protection of personal information in the private sector (as amended by Law 25), and other applicable laws.

• Access and Correction: You can ask to access the personal information we hold about you and how it has been used and disclosed, and to correct inaccurate or incomplete information. We will respond within the period required by law (generally 30 days from receiving your request).
• Withdrawing Consent: You can withdraw your consent at any time, subject to legal or contractual restrictions. If you do, features that require that processing may no longer be available.
• Data Portability: If you live in Quebec, you can ask, to the extent provided by law, to receive computerized personal information you provided to us in a structured, commonly used format.
• Processing Outside Canada: Your personal information is stored in a database in the Republic of Korea (Seoul) and may be processed in the USA and other countries through the providers listed in Articles 6 and 7. In that case, courts and government authorities in those countries may be able to access it under their laws.
• Personalized Advertising: On iOS, until you allow tracking in the App Tracking Transparency (ATT) prompt, your activity information is not used for personalized ads based on the advertising identifier (IDFA). On Android, for users whose store country is Canada, ads are always served with personalization turned off (ads unrelated to your interests only), and the app has no setting to turn it on. See Article 11 for how to control the advertising identifier itself.
• Automated Decisions: The decisions described under "Automated Decisions" in Article 19 also apply to users in Canada. If you live in Quebec, you can ask us to tell you the personal information used to make a decision, the reasons and principal factors that led to it, and your right to have that information corrected, and you can submit your comments to a member of our team who can review the decision (using the email address in Article 15).
• Questions and Complaints: You can contact the Personal Information Protection Officer (Article 15). If you're not satisfied with our response, you can file a complaint with the Office of the Privacy Commissioner of Canada (www.priv.gc.ca) or, if you live in Quebec, the Commission d'accès à l'information du Québec (www.cai.gouv.qc.ca).

Article 19 (Rights of Users in Australia — Privacy Act 1988 and APPs)

If you live in Australia, the following applies to you under the Privacy Act 1988 and the Australian Privacy Principles.

• How We Collect Information: We collect the personal information described in Article 2 directly from you or automatically as you use the app, and we receive social login information and subscription and payment status through Google, Apple and RevenueCat. We use it for the purposes in Article 1.
• Access and Correction: You can ask to access and correct your personal information, and we will respond within a reasonable period (usually 30 days).
• Overseas Disclosure: Your personal information is stored in a database in the Republic of Korea (Seoul) and may be processed in the USA, Japan and other countries through the providers listed in Articles 6 and 7.
• Automated Decisions: We use computer programs to make the following decisions, without a person reviewing each one. (1) Automatic deletion of anonymous (trial) accounts: based on the sign-up time and whether the account has been upgraded to a full account, accounts that aren't upgraded in time are deleted along with their data (see Article 3). (2) Automatic deletion of sign-ups without completed email verification: based on the sign-up time and whether the email address has been verified (see Article 3). (3) Granting, expiring and revoking paid access: based on the subscription and purchase status we receive from Apple, Google and RevenueCat (the products purchased and whether they were renewed, expired or refunded). (4) Eligibility for the Welcome Offer: based on when you signed up or upgraded to a full account and your purchase history. In addition, when reports about a user reach a set number, a program asks our team to review them. Actions taken in response to reports, such as resetting a nickname or restricting an account, are decided by our team after review.
• Complaints: You can send a privacy complaint to the email address in Article 15, and we will usually respond within 30 days. If you're not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (www.oaic.gov.au).

Article 20 (Rights of Users in New Zealand — Privacy Act 2020)

If you live in New Zealand, the following applies to you under the Privacy Act 2020 and its Information Privacy Principles.

• How We Collect Information: We collect the personal information described in Article 2 directly from you or automatically as you use the app, and we receive social login information and subscription and payment status through Google, Apple and RevenueCat. We use it for the purposes in Article 1 and have it processed by the providers listed in Articles 6 and 7.
• Access and Correction: You can ask to access and correct your personal information, and we will let you know our decision within 20 working days of receiving your request. If we decide not to correct it, you can ask us to keep a statement of the correction you asked for together with that information.
• Processing Outside New Zealand: Your personal information is stored in a database in the Republic of Korea (Seoul) and may be processed in the USA, Japan and other countries through the providers listed in Articles 6 and 7. These providers process it only to perform the services we have entrusted to them.
• Privacy Breaches: If a privacy breach that could cause you serious harm occurs, we will notify the Office of the Privacy Commissioner and affected users as soon as practicable, as required by law.
• Complaints: You can send a privacy complaint to the email address in Article 15. If you're not satisfied with our response, you can complain to the Office of the Privacy Commissioner (www.privacy.org.nz).