EOUL Privacy Summary

Effective and revised: 2026-10-31 · Korean Privacy Policy v1.31

This summary sets out EOUL’s principal privacy practices. Read the full Korean policy, changes and previous versions and the relevant consent screen before agreeing. The security disclosures previously published as supplements are included in this edition. Historical fixed copies and consent records are preserved. Required separate consent follows the applicable consent procedure; supplier conditions marked as unverified remain subject to confirmation.

New post attachments are checked before public storage; a multi-image upload is checked as a batch before any image is stored. A clear violation refuses that upload; a technical failure asks for a retry without new public storage. A completed uncertain classification is distinct from a failed check and does not alone establish a violation. The check adds no account warning, ban or strike. Human review is available through in-app inquiries. The check can make mistakes and does not guarantee safety.

Profile backgrounds and room covers are included only after the new scope has been properly disclosed, a lawful processing/overseas-transfer basis is established and the feature is enabled. The policy's effective date alone does not enable these checks or change old consent. Ordinary private-chat image uploads are not added. Google analyzes visual content and text within the image; the new image result does not output/store extracted text. Prior moderation records keep their existing retention rules. Eligible completed results may be cached for up to 24 hours using a one-way key derived from image bytes and upload context, without image bytes, extracted text or individual model reasons; rejected/incomplete results are not cached. A rejected photo is not kept in a new evidence store just for this gate.

General inquiries are retained for 90 days after receipt. A cleanup job runs every 10 minutes and removes the inquiry body, responses, and internal notes together. Open status does not extend retention automatically. Staff may record a reason and a dated hold, with each hold ending no later than 366 days after it is set. Inquiries linked to a case follow that case’s retention policy. Existing general inquiries receive a transition period of at least 30 days when this policy is introduced.

Market-report case evidence and linked inquiries are retained separately for three years from case receipt. Other identity/recovery cases retain their 90-day policy. Accessing a case or deleting its source does not restart the period. Staff may set a dated hold with a recorded reason. Where statutory transaction-record retention applies, only records actually processed by the service fall within the relevant five-year or three-year category; not every DM is automatically a statutory transaction record.

Pre-report market evidence

To address listings changed or deleted before a report, EOUL separately retains minimum private evidence at public listing creation, important changes, deletion and the first inquiry from that listing. Evidence can include the title, description, price, an independent photo copy, seller identifier, minimum verified seller name/trading contact and event times. A minimal counterpart/conversation link can connect a report to the listing as it appeared then; ordinary chat history is not automatically copied in full. Unpublished drafts and rejected listings are not indiscriminately archived as public-market evidence.

Each event record is retained for six months from that event. Deleting an old listing captures its then-current evidence for six months from deletion. Reading evidence or retrying the same event does not restart its lifetime. Where an actual transaction is confirmed, the confirmation basis and transaction time are recorded and the evidence follows a five-year period from that transaction time. A seller's sold flag alone is not confirmation. These are service evidence policies, not a blanket declaration that every listing or DM has a statutory five-year term.

Deleting a listing removes its public original and linked translation; retained evidence is a separate private copy with restricted staff access and access/confirmation records. Photo evidence is copied independently of the public original URL. An existing counterpart can report the deleted listing through the associated conversation. Evidence already submitted in a market-report case follows the separate three-year case policy, including after listing/account/room deletion. Minimum seller identity and trading-contact evidence linked to the case remains until the case’s three-year deadline, with reason-based restricted staff access. Viewing does not restart retention; an existing longer verified-transaction period or justified dated hold may remain.

Who can join

Members must be 19 or older and currently enrolled at a Korean university/graduate school or a university-affiliated language program. Applicants may choose phone identity verification or, if they hold an ARC, ARC verification. The phone route is available regardless of nationality when the contracted provider can verify the applicant’s Korean phone subscription in their own name. School affiliation is reviewed separately after registration.

Purposes and data

Account management, identity/age/school verification, duplicate-account and abuse prevention, community/chat/course reviews, translation, notifications, support and security. We process account credentials, name, birth date, nationality and relevant verification results; optional profile/schedule/content data; submitted school documents and review metadata; IP, device, login, push and advertising data. Passwords and duplicate-account identifiers are stored as one-way values. A verified recovery email is required for ARC registration. Phone registration does not require a recovery email, regardless of nationality, and can be completed without one. An email optionally submitted through an older app or another supported path is stored only with valid email-verification proof. Adding or changing a trading-contact number preserves any existing recovery email. School email is not mandatory for registration.

ARC verification

We read your ARC to verify your name, birth date, gender and nationality. Your registration number, issue date and serial number are sent to CodeLine (APICK) for a check against issuing records. The original photo and raw numbers are not permanently stored. The internal temporary verification record holds verification status, check time, request identifier and cost information for up to 30 minutes for registration and duplicate-request prevention. This period does not cover all operational logs or external providers’ records. Account details, a one-way duplicate-account hash and consent time follow the Privacy Policy retention periods. A different ID may be temporarily processed by external OCR/classification before being rejected; its details are not saved as account information. If you decline, you cannot register through this route. Separate consent for the ARC number does not replace data-minimization requirements. EOUL must assess the need for the full number, ways to reduce processing and alternatives such as phone identity verification. Temporary OCR and transmission remain processing even without permanent storage.

Before a photo is taken and external OCR begins, you separately agree to identity-document processing and overseas transfers. The server records the displayed notice version, language and receipt time, binds them to the verification session, and checks them before front/back OCR and the issuing-record check. Missing or outdated consent blocks this processing. Session evidence expires within six minutes; subsequent verification tickets expire within 30 minutes after issue. Registration stores only the notice version, language and server receipt time as account consent evidence, retained under the account consent policy for up to three years after account-identity cleanup.

School documents

Review and issuing-record checks may also process/store document number, issue/expiry dates, affiliation and verification method/result. Originals expire 30 days after approval/rejection or verification expiry and are included in withdrawal cleanup. Google OCR may assist review; the operator makes the final check. See Privacy Policy §§2.7, 3 and 6 for retention/transfers.

Retention and withdrawal

Identity-verified members can choose immediate deletion (no recovery) or optional 14-day recovery storage. Immediate deletion is selected by default in the current app. Immediate deletion clears account-identifying fields and ends all sessions while processing your request; it does not mean that files, caches, backups and separate evidence are physically erased at once. Choosing recovery storage sets a deletion date 14 days after the request; repeating the request does not extend it. Accounts that have not completed identity verification are deleted immediately; if records that outlive the account exist (sanctions, inquiries or written content), account-identifying fields are cleared at once instead so those records are not deleted with it. Logging in alone does not restore an account. Before the deadline, you must verify your password and expressly confirm “Restore and log in”. After the deadline, recovery is unavailable and the daily job clears account-identifying fields. Earlier app versions use the previous 14-day storage period; login alone does not restore the account, and the recovery confirmation may require an app update. Separate retained data follows the purposes, periods, exceptions and rights procedures below. Account-identity cleanup also deletes timetables and personal calendars, notification settings and history, saved post and lecture-review lists, the blocks you set (board, chat room, matching), revoked-device push records, free-translation allowance, ad-reward and translation-usage records and translation results only you used; app feedback is deleted by the next scheduled purge. Staff roles and connections to external review tools are revoked; the permission-change history is kept for three years. Blocks other members set against you are their data and stay; reaction counts stay on posts. The selected deletion mode determines when account-identifying fields are cleared. Posts, comments and reviews may remain with a withdrawn-member author label, including attached images; clearing account fields does not anonymize personal information within retained content or matching hashes; delete unwanted content before withdrawal or contact support. Member-deleted posts/comments are removed from the service database; separate reports/moderation copies follow their retention periods. Image deletion is asynchronous and delivery caches may remain until expiry. For reported images, the necessary evidence copy is secured before deleting the original; temporary copy or storage failures can delay file deletion. Private evidence copies follow their separate retention period. We do not promise simultaneous erasure of every backup copy.

Retention clarification: the three-month identity-hash/signup-IP archive starts on the deletion reference date: the request time for immediate deletion or the scheduled date for 14-day recovery storage. The voluntary-withdrawal re-registration restriction ends seven days after that reference date. These three-month and seven-day periods are service policies, not universal statutory periods. Other registration checks still apply: matching verified names, birth dates and genders can restrict a new account even for a different person. Names are normalized only for spaces and letter case; verified Korean and English ARC names are compared. This rule does not automatically merge or recover accounts. If you have no existing account and are restricted, request review at support@eoul.app. Images attached to retained posts also remain. Login records: 12 months for security. Minimum records of personal-data system access by administrators and other staff handling personal data are kept for two years; minimum records of access permissions granted, changed or revoked are kept for three years. Detailed administrator operation logs are kept for 90 days and detailed database before/after change records for 365 days under separate operational policies. Consent times: up to three years after account-identity cleanup. Pending proceedings and permanent sanctions have exceptions. Failed-translation source text: 90 days from the last failure; successful translation results and linked recovery copies: 30 days for post bodies/comments, 7 days for DM, and 14 days for group messages, measured from successful generation; other standalone/staff-provided translations retain the 90-day period. Reading a result does not restart its lifetime. Hash-only spending guards remain during operation. Google advertising privacy options are separate from marketing-message consent.

Original messages in surviving ordinary DM and group rooms are retained for up to five years from message creation. Existing room-deletion rules for leaving, empty rooms and locking take priority: when a room is deleted, its originals are deleted with it even before five years. Empty rooms are not kept merely to complete five years. Locked rooms keep their existing 90-day period from locking, and matching rooms keep their existing expiry policy. The five-year cap is a service history policy, not a blanket statutory duty. Explicit deletion and privacy-rights requests are handled separately; evidence already submitted in a report follows the separate case policy. Translation expiry does not delete originals. A withdrawn member's messages stay for the same periods and can be reported by the other members during them. Confirmed violating images, and private evidence copies of reported post and chat images (reporting itself does not remove the original), are held privately for 180 days. Moderation, report-investigation and translation-feedback records are normally held for three years, subject to pending proceedings/permanent-sanction exceptions. School files expire 30 days after completed review or verification expiry. Permanent-ban identifiers are retained while re-registration blocking remains in force. One-way identifiers can still be used to match the same person and are treated as personal data; hashing alone does not make them anonymous.

Actual case reasons, administrator review summaries and previously generated similar-case vectors are not reused as new similar-case reference material. Existing moderation case records and vectors retain their three-year policy and applicable exceptions; this change does not bulk-delete them. New reference material consists of synthetic policy examples.

Chat reports

Selecting a message for a report stores only that one message after the server checks that it belongs to the room, was written by the reported member and is visible to the reporter. Text, images, polls and event cards can be selected. A card identifier may remain in the internal report copy, but the card contents are not newly retrieved or sent for external review. Header/member-list reports without a selected message, and older app submissions without a message selection, retain the reason and any entered detail without adding chat-message copies. Recent conversations are not appended or searched using the detail text.

Selected text or images may be reviewed by an external AI service. The supplied material uses fixed role labels and removes or replaces message/member identifiers and some known nickname/contact expressions. This does not guarantee removal of all personal information or anonymization of text or images. Legacy reports without a confirmed selected message, reason-only reports and poll/event-card reports receive manual review with no automatic external AI call. When an administrator expressly requests translation of a legacy report, only the latest text from the reported member and at most one immediately adjacent reporter text are used, limited to 500 characters each. Other participants’ messages, old images and card identifiers are excluded. This translates an excerpt; administrators can still review the full retained internal evidence.

Chat-report AI results assist administrator review and do not themselves automatically hide messages or sanction the reported member. Immediate protective unmatching for matching-room reports remains separate. Existing report copies are not bulk-deleted by this change; retention and exceptions follow Korean Policy §3.4.

Security processing

This section covers remembered-device and app-integrity processing, first supplemented on 27 October 2026. Historical documents and consent records remain available under the edition in which they were recorded.

Remembering a login device. This is optional and does not replace your password. After a successful password login, the app may securely store a username and random token for up to five accounts. The server keeps the token hash, linked account identifier and username, credential version and expiry for up to 90 days from issue; reuse does not extend this period. Ordinary logout does not forget the device. Use “Forget this device” to remove the current local choice; ending all sessions also removes that account’s server remembered-device records. Password changes/resets and account-identity cleanup invalidate existing proofs, although server records not expressly deleted can remain until their original expiry. Clearing a server record does not erase every local copy on other devices.

Installation and request integrity. The app creates a random installation identifier and uses a device fingerprint to protect phone-verification session creation and ARC verification start, resume and cancellation. For these checks, EOUL receives the installation identifier, device fingerprint, request method and path, a hash of the request body, and proof information such as an Apple key identifier. These checks help prevent modified-app requests, abuse and replay. Short-lived request challenges and replay checks are separate from remembered-login records. For App Attest, EOUL also keeps the key identifier, public key, fingerprint hash and signature counter needed to verify later requests. EOUL also records the last successful assertion verification and when retention observation began, without inventing earlier activity. There is currently no operating automatic purge for the installation-level key record. A concrete retention period, continuing necessity and safe key re-registration are under review. Account deletion does not unconditionally delete these installation records; the applicable retention requirements remain under review. Requests for erasure and other rights are accepted through support. This does not mean that EOUL receives or stores the device's private key.

Google Play Integrity. Android uses Google's platform service to check app/device integrity and the app's Play licence status. Google's data safety notice describes processing of request hashes, app package/version/signing-certificate information, app licence status for accounts signed in on the device, and device-attestation information. EOUL supplies a hash rather than the original request content for the integrity request. Google states that data is encrypted and deleted after a fixed retention period, but that notice does not give a numeric period or an Integrity-specific processing-country list. Its general privacy policy describes processing on servers around the world; this does not identify the country used for each check.

Apple App Attest. The initial key attestation contacts Apple's service to validate the app/device proof. Later request signatures are generated on the device and verified by EOUL's server. Apple explains that the private key stays in the Secure Enclave and is not directly readable by the app or EOUL; see its App Attest documentation. Apple's general privacy policy describes international processing and general US storage, but does not establish an App Attest-specific country or numeric retention period. EOUL's own key record and 90-day remembered-device proof are separate from Google's or Apple's records; neither period is a promise that a provider deletes its records at the same time.

Providers, transfers and advertisements

Before agreeing, read Privacy Policy §§5–6 through the link below for each recipient’s data, contact and retention periods.

• Google LLC (Cloud Vision): ARC and school-document images for text extraction. School PDFs are reviewed manually and are not sent to this API. • Google LLC (Gemini API): ARC images for authenticity checks; post images and, only after the new activation conditions are met, profile-background/room-cover images; posts/comments/reviews, profile bios and room names/descriptions for moderation/translation; requested chat translation content; ordinary text translations do not append previous chat messages. Selected chat-report text/images may be reviewed within the limited scope described above. Administrator-requested legacy-report translation uses at most the two text excerpts described above; legacy/reason-only/card reports have no automatic external review. Similar-case reference material uses synthetic policy examples, not actual case reasons or administrator summaries. Current moderation input may still be processed externally to create a search representation for retrieving those examples. • Cloudflare, Inc.: storage/delivery of images and school-document PDFs, IP and security data. R2 currently uses the Asia-Pacific (APAC) location with default jurisdiction; this does not guarantee a particular country. CDN/security processing uses a separate global network. • Supabase Pte. Ltd.: account/service database stored in Seoul; Singapore contracting entity and possible access by overseas support/operations staff. The contracting entity’s country does not identify every access country. • 650 Industries, Inc. (Expo): push tokens, notification titles/bodies, notification-routing data such as room/message/post identifiers, and app updates. Expo Push Service servers are hosted in the United States; this does not establish all app-update, support or onward Google/Apple processing countries. • Functional Software, Inc. (Sentry): error paths/stacks, performance information and account identifiers in some diagnostics. Current US region; Developer error-event retention is 30 days. Default PII collection is disabled and request/user fields are removed before sending. Separate downsampled trace metrics have a 396-day retention setting; this is not a promise that all Sentry data expires in 30 days.

Encrypted transfers occur when features are used, to providers’ processing countries or through overseas operational access. Google API has no specified region. R2 location, global CDN processing and Supabase support access are different scopes; contracting countries do not establish the full transfer-country list. See Korean Policy §6 for confirmed settings and remaining country-specific information. Service data follows §3; separate provider records follow contracts and provider policies. Withdrawal does not immediately erase all external records. Personal data written in content may also be sent.

Declining transfers essential to operation can restrict registration/use. Optional translation and push have separate feature impacts. Requests/withdrawal: support@eoul.app. Google's advertising SDK may collect information directly from the device; this is described separately from EOUL providing its collected member data and from necessary registration outsourcing. See §16. Non-personalized ads can still use device identifiers/cookies.

Discord is a separate operations-notification tool. Its current payload contains operational counts/ratios and safety alerts without member identifiers, target-content identifiers, original post/chat content, individual decision reasons or links to a member. These notifications are distinguished from the personal-data processors and overseas recipients above. If information identifying a person or readily linkable to a person is added, the legal basis and notice will be reviewed before that processing begins.

EOUL requests non-personalized Google AdMob ads. Google Mobile Ads SDK may directly collect advertising/device identifiers, IP address and IP-derived approximate location, device/OS information, app/ad interactions, diagnostics and performance data, depending on SDK, permissions and settings. Purposes include ad delivery, frequency limits, aggregate measurement, fraud prevention and SDK diagnostics. EOUL's current ad request code does not pass member names, identity documents, nationality, school, posts or chat content as additional advertising data. Direct SDK collection is distinguished from EOUL providing its collected member data.

CodeLine/APICK’s published privacy policy includes personal/credit data of subjects using its members’ paid services, as well as member account data. It lists five years for contract/payment/supply, tax and electronic financial records; three years for complaints/disputes; six months for advertising records; and three months for access records. These are record-specific periods, not a stated retention period for every raw ARC request, response, log or backup. The policy does not identify the ARC API’s processing countries or item-specific retention. Privacy contact: Jo Seung-hyeon, 070-7799-2700, spark@codeline.kr. The policy is dated 1 January 2024 (announcement), effective 15 January 2024.

Domestic identity providers include CodeLine/APICK, PortOne and NHN KCP for the applicable routes. AWS infrastructure is in the Korean region. Google advertising data follows Google’s own purpose-specific retention policy and privacy policy; non-personalized advertisements can use cookies/identifiers for fraud prevention and frequency capping. Advertising information can be transmitted when the SDK runs and when ads are requested or displayed. Depending on the SDK, permissions and settings, this can include device identifiers, IP-derived approximate location, app/ad interactions, diagnostics and performance information. This does not mean collection of the device’s GPS location. The Google ad-content rating limit is T (Teen); it is not a Korean statutory content rating. The app checks Google UMP status and only requests ads after canRequestAds is true and initialization is complete. Unknown/error/timeout states block requests. Google's privacy-options menu appears in Profile when the SDK requires it for the user's region/status. Changing a choice invalidates cached ads and checks the new result before requests resume. A UMP result does not establish every applicable Korean-law processing basis. Device settings and non-personalized ad requests do not stop every advertising-data transfer. Android ad-ID controls and iOS tracking settings can restrict identifiers/tracking, subject to OS version, but do not stop all IP/diagnostic collection. Google's direct collection follows its privacy and purpose-specific retention policies. Account withdrawal, available SDK privacy controls and marketing-message consent have different effects. Additional member-data sharing or new advertising partners would require a separate assessment of applicable notices and consent.

Expo’s official push FAQ states that notification contents are kept in memory and queues only as long as needed to deliver them to Google/Apple push services, not in databases. Staff may see contents while actively debugging. This does not define retention of push tokens, delivery records or app-update data; Google/Apple apply their own policies after handoff.

Paid Gemini API and Cloud Vision

EOUL uses the paid Gemini API through an operating Google Cloud project linked to an active billing account. Under the paid-service terms, Google does not use submitted inputs or generated responses to improve its products, and a data processing addendum applies. Abuse-monitoring policy provides for 55-day retention of prompts, context and outputs; authorized staff may review flagged activity/content. Policy-enforcement model use is distinct from general product improvement. Paid use does not mean immediate erasure of every external record. See the Gemini terms and abuse-monitoring policy.

Google states that Cloud Vision content is not used to train or improve Vision models. Online immediate-response operations process images in memory without persisting them to disk; request metadata may be logged temporarily. Asynchronous batch operations have different retention. See the Vision data usage FAQ. Processing locations remain subject to Korean Policy §6.

Content safety and automated decisions

Publishing sensitive details that identify someone else, such as their health, political views, religion or sex life, is prohibited by the community rules, including where the surrounding context identifies them despite a hidden name. User content can contain sensitive personal details. EOUL does not build a health-diagnosis profile; safety analysis can nevertheless involve such content, and moderation records follow the stated retention periods. A member’s own submission does not exempt legally sensitive data from the applicable restrictions. Such processing requires separate consent or statutory authorization, including for current storage, translation and moderation. Automated rules/AI may reject an invalid ID, check age, classify content or limit content visibility. Account warnings, suspensions, permanent bans and strikes require a separate human decision on actual evidence and context. Reports, uncertain classifications and upload refusal alone do not establish an account violation. Matching is unavailable during beta. Posts within a school are still visible to other members, rather than private to the author. Omit or remove sensitive details you do not want shared before posting; use edit/delete or contact support for published content. Separate report/moderation copies follow §3.

You can request reasons, an explanation and human reconsideration. Whether a statutory refusal right applies depends on the particular decision, its significance and legal basis. Not every AI moderation action is a statutory obligation. The ban screen shows available reasons, severity, strike count and source. Request an individual explanation of the information used and decision process through the contact routes. The one-submission limit for an in-app suspension appeal does not limit statutory privacy or automated-decision requests. Hidden-post notices use “Contact us” to open an in-app inquiry, with replies shown in notifications and “My inquiries”; a dedicated hidden-post appeal form is not promised. You can also use support@eoul.app. The sole operator/CPO handles reconsideration; a separate independent reviewer is not promised. Formal processing, extensions and refusal notices follow the full policy and applicable law.

Your rights and security

Request access, correction, deletion, restriction, consent withdrawal or an explanation through the app or support@eoul.app. A registration email is not required for every member, and emailing an ARC photograph is not the default verification requirement. Issuing-authority records may need correction at the source. The ten-day response target is an operational goal, not a universal legal deadline. Access controls, encryption, administrative authentication and audit records protect service data. Minimum access records concern administrators and other staff handling personal data, rather than ordinary members’ app-use records. They identify the actor, time, access origin, affected person and task; permission history records the actor, affected account, time, scope and permissions before/after the change. These minimum records do not copy content, original identity documents or complete database before/after records. Unrecorded historical access origins are not filled in by inference. Statutory minimum access retention is two years for this service’s system processing unique identification data, and permission-history retention is three years under Articles 8(1) and 5(3) of Korea’s Standards for Ensuring the Safety of Personal Information. Deleting detailed operational records does not delete these separate minimum records. Security logs can contain full IP addresses. Error monitoring disables default PII and removes request/user fields before sending; this is not blanket masking of every IP string in diagnostics. Current AWS application logs are kept for 30 days and recovery logs for 14 days, separate from database login/audit records. Backup retention follows the applicable operational configuration.

Student-to-student trading

For students trading or exchanging their own belongings. Business sales are prohibited. EOUL is not a party to the transaction and does not handle payments, delivery or refunds. Check the terms, other person and item; report suspected fraud. EOUL’s legal obligations and liability still apply.

Trading-contact phone numbers and verification records are stored in encrypted form. The selected display country, the identity provider’s domestic/foreign classification, language, trading-contact number and recovery methods are managed separately. Under current operation, a seller with valid proof from an approved identity-verification scope and a linked trading-contact number does not need a separate seller-email check; the server checks those conditions before allowing a trading listing. EOUL does not automatically publish a private seller’s ID or contact details. Information for dispute handling is provided under applicable statutory conditions; direct provision to a buyer under Korean E-Commerce Act Article 20-4 requires the seller’s consent. A general terms agreement or report alone does not authorize such disclosure.

Mismatch, recovery and trading reports may form encrypted case records containing the request, copies of posts, chats or images designated by the applicant, counterpart identifiers and handling records. Only material the applicant can access is linked, and administrator access, downloads and actions are logged. Phone numbers and raw person identifiers are not automatically added to general inquiries. Market-report case records and their linked original inquiries are retained for three years from receipt. Other identity-mismatch and recovery case records retain the 90-day policy. These records are managed separately from deletion of the original content or account. This is an operational retention period, not a universal statutory period. Extensions require a recorded reason and end date, no later than 366 days from each setting; cleanup runs every ten minutes after expiry. Trading listings are enabled for eligible verified accounts. The current operational policy does not require a separate seller-email check when the seller has readable proof from an approved identity-verification scope and a linked trading-contact number. The server also checks identity/school status and acceptance of the trading rules. This operational status does not establish every external provider’s contractual or legal processing condition.

International laws

GDPR/PIPL applicability depends on their territorial and activity-based conditions, not nationality alone. PIPL representation is not subject to a general 10,000-user threshold. Vietnam’s 2026 framework includes Law 91/2025/QH15 and Decree 356/2025/ND-CP, effective 1 January 2026. Legal applicability, representations and transfer procedures require service-specific assessment.

Optional image descriptions

Authors may enter an optional description for a post image. It is stored and publicly displayed with the post and follows the existing post-text translation and safety-review scope, without adding an external provider. Do not include information you do not want to make public. Editing and deletion follow the post rules.

Website data

The website stores the selected display language locally in the browser. Clearing site data removes it; blocking storage may stop the preference from being remembered. Cloudflare RUM processes page/referrer information, a temporary per-page identifier and performance timings. It does not access or store cookies or browser storage. Cloudflare says it discards the transport IP at the nearest data center rather than retaining it in core analytics databases/logs. Processing location depends on routing. This differs from security logs and app advertising. Browser script/content blocking can restrict metrics but may affect website functions. See the RUM documentation.

Supplier-specific processing countries, onward processors and retention marked as unverified in Korean Policy §6 are pending confirmation. A registered company address or general supplier list does not identify the complete processing locations for each product. EOUL is confirming the relevant product conditions, contracts and required notices and consent.

Contact

Controller/CPO: EOUL, operator Lim Cheolgeon (임철건), business registration 175-13-03320. Telephone: 070-7954-3182. Email: support@eoul.app. Postal address: (55427) 29-6 Sangyeok-ro, Jinan-eup, Jinan-gun, Jeonbuk State, Building 107, Unit 103, Republic of Korea. Privacy complaints: KISA 118; dispute mediation 1833-6972. Suicide prevention counselling: 109 (24 hours).

Selected reported chat-image access

After reviewing the one image selected by the reporter, an authorized operator may separately withdraw access to that file or restore it under the permitted conditions. Forwarded references using the same URL are affected. This does not start general chat AI review, automatically delete other messages, change report status or impose account sanctions. The operation secures private evidence, quarantines the original and requests cache invalidation; failures/delays mean access blocking may remain pending. Private evidence and quarantined originals follow the 180-day retention rule. Restoration requires a remaining undeleted lawful reference and a retained recoverable source; it does not republish deleted/purged material. Request human reconsideration through in-app inquiries or support@eoul.app.