jelly memo Privacy Policy
한국어 · Age eligibility notice (Korean)
1. Controller and scope
Bsovi Co., Ltd. is the data controller. This policy applies to the jelly memo mobile and web services. Separate policies may apply to the corporate website and other products.
2. Information we process
| Category | Information | Purpose | Retention |
|---|---|---|---|
| Email account and authentication | Email address, Firebase user ID, email verification status, and sign-in and security records | Registration, sign-in, account security, synchronization, and support | Quarantined for 30 days after account deletion is scheduled, then deleted, or longer when required by law |
| Social account and authentication | Service-specific identifiers issued by Google or Kakao, the app-specific identifier issued by NAVER (response.id), Firebase user ID, email and basic account information when provided, and sign-in and security records | Social registration and sign-in, recognizing the same account, account linking and reauthentication, and account security | The original Kakao identifier is immediately hashed. The NAVER app-specific identifier, linkage hashes, and Firebase user ID are kept while the account is active, quarantined for 30 days after deletion is scheduled, then deleted |
| Temporary OAuth information | Hash of a random state value, PKCE challenge, provider type, authorization code, and temporarily issued access token | Prevent forged or replayed sign-in requests and verify provider authentication results | State records last no more than five minutes and are deleted immediately after successful use. Authorization codes and access tokens are used only during server exchange and are not stored in the database |
| Age-policy information | Minimum age band, selected country or jurisdiction, policy version, confirmation time, and consent state | Apply age-appropriate features and privacy defaults | Stored only on the device until policy recheck or app-data deletion. The exact date of birth entered is discarded immediately after calculating the age band and is neither transmitted nor stored on our servers |
| User content | Memo titles, text, tags, links, attached images, settings, timestamps, versions, and sync status | Create, store, restore, and synchronize memos and prevent conflicts | Until the user deletes the content or account. Trash items are generally permanently deleted after 30 days |
| Advertising and technical data (adult mode) | IP address, device, OS and app information, ad impressions and interactions, and consent status | Adult-user advertising, frequency control, fraud prevention, statistics, and compliance | According to Google policies and user settings |
When age is unknown or the user is under 18, account access, cloud sync, sharing, remote image upload, location, messaging, advertising, and analytics are not started. Memo services are not provided to users who do not meet the age requirement.
In adult account mode, Kakao identifiers are SHA-256 hashed before account mapping. NAVER sign-in uses an app-specific identifier (response.id), not the user's NAVER login ID. A NAVER email address is a separately consented field; even when provided, it is not currently used for account mapping and is not separately retained after the authentication response is processed. Google sign-in credentials are handled by the Firebase Authentication SDK, and the app does not request additional Google permissions such as Contacts or Drive.
Memo text, attached images, and locations saved in memos are encrypted with the user's account encryption key before supported synchronization stores them on the server. Operational metadata such as document IDs, modification times, versions, deletion status, and internal device identifiers may be stored separately for synchronization control. We do not sell personal information.
3. Device permissions
Photo, camera, file, QR, and notification permissions are requested through the operating system only when the user selects a related feature. The current Android release does not request location or Bluetooth permissions. Users may deny a permission and continue using features that do not require it. Information processed only on the device and not transmitted to our servers is not collected by us.
4. Service providers and international processing
| Provider | Services | Purpose | Location and timing |
|---|---|---|---|
| Google LLC | Firebase Authentication, Cloud Firestore, Cloud Storage, Cloud Functions, Firebase Hosting, Google Sign-In | Authentication, synchronization, storage, account operations, hosting, and security | May be processed continuously while using the services in the United States and other countries where Google operates facilities |
| Kakao Corp. | Kakao Login | User authentication, consent confirmation, and issuance of a service-specific user identifier | South Korea when Kakao sign-in requests and responses are processed |
| NAVER Corp. | NAVER Login | User authentication, consent confirmation, and provision of an app-specific user identifier and consented email address | South Korea when NAVER sign-in requests and responses are processed |
| Google LLC | Google Mobile Ads, User Messaging Platform, Google AdSense | Ad delivery and measurement, fraud prevention, and privacy choices | Google processing locations when requesting ads or handling consent |
International transfers use encrypted connections. Retention follows the periods above and provider policies. See the Google Privacy Policy, Firebase Privacy and Security, Kakao Privacy Policy, and NAVER Privacy Policy.
The account, cloud, and advertising providers above are activated only in adult mode. Their initialization and network requests are blocked for users whose age is unknown or under 18.
On the web version, Google AdSense may process cookies, local storage, IP addresses, browser and device information, and ad request, impression, and interaction data for ad delivery and measurement. Ads are requested only when consent through a Google-certified consent management platform or another applicable legal basis has been established, and are not displayed when consent or applicable advertising and age-protection requirements are not met. Users can review advertising privacy choices and data processing information in Google Ads Settings and Google's partner sites policy.
5. Age eligibility
jelly memo account services are provided to users confirmed as adults through a neutral age check. The exact date of birth is discarded on the device immediately after calculating the minimum age band and is neither transmitted nor stored on our servers.
Memo services are not provided to users whose age is unknown or under 18. Account creation, sign-in, cloud sync, sharing, remote image upload, location, messaging, advertising, and analytics are unavailable. The current product has no parental-verification flow that opens remote features for a minor, and a stored consent state alone cannot remove this restriction.
Only users confirmed as adults may use account, cloud, and advertising features. Rechecking age separates any remote session and adult profile and applies the resulting age policy immediately.
6. User rights and account deletion
Users may request access, correction, deletion, restriction, withdrawal of consent, or account deletion.
- In the app, choose Settings → Account → Delete account, reauthenticate with the password or the same Google, Kakao, or NAVER account, and complete the confirmation shown on screen.
- If you cannot sign in, email bsovi@bsovi.com with the subject `jelly memo account deletion request`. We will request only the minimum information needed to verify account ownership.
When deletion is scheduled, account access and existing sessions stop immediately. Account data, encrypted memos and versions, node-view data, settings, security keys, uploaded files, and social-account mappings are quarantined for 30 days and then permanently deleted. Information that must be retained by law is separated and kept only for the required period. Users who keep their account can delete individual memos, photos, or saved location information with the corresponding in-app controls.
7. Deletion and security
- Information is deleted using methods intended to prevent recovery when its purpose or retention period ends.
- When account deletion is scheduled, account access and existing sessions stop immediately. Account data, encrypted memos, versions, node-view data, settings, security keys, uploaded files, and social-account mappings are quarantined for 30 days and then permanently deleted automatically.
- Information retained by law is separated and kept only for the required period.
- We use reasonable safeguards including encrypted transmission, user-content encryption, access restrictions, authentication checks, security rules, and deletion procedures. Users should not disclose account passwords or recovery information to others.
8. Changes and contact
We may update this policy when features, laws, or providers change. Material changes will be announced in the app or on the website before they take effect, and the latest effective date will appear above.
Operator: Bsovi Co., Ltd.
Email: bsovi@bsovi.com