EOUL Privacy Summary

Proposed effective date: 24 November 2026, 00:00 Korea Standard Time — Korean Privacy Policy v1.29 Advance notice: 24 October 2026

This proposal is not the policy currently in effect. Korean Policy v1.28 remains effective until the announced change. Read the advance notice, the full Korean proposal, and the relevant consent screen. An incomplete notice, separate member notification or required consent postpones the effective date. Publication does not replace a required consent or retroactively change previous consent.

New post attachments are checked before public storage; a multi-image upload is checked as a batch before any image is stored. A clear violation refuses that upload; a technical failure asks for a retry without new public storage. A completed uncertain classification is distinct from a failed check and does not alone establish a violation. The check adds no account warning, ban or strike. Human review is available through in-app inquiries. The check can make mistakes and does not guarantee safety.

Profile backgrounds and room covers are included only after the new scope has been properly disclosed, a lawful processing/overseas-transfer basis is established and the feature is enabled. The future policy date alone does not enable these checks or change old consent. Ordinary private-chat image uploads are not added. Google analyzes visual content and text within the image; the new image result does not output/store extracted text. Prior moderation records keep their existing retention rules. Eligible completed results may be cached for up to 24 hours using a one-way key derived from image bytes and upload context, without image bytes, extracted text or individual model reasons; rejected/incomplete results are not cached. A rejected photo is not kept in a new evidence store just for this gate.

General inquiries are retained for 90 days after receipt. A cleanup job runs every 10 minutes and removes the inquiry body, responses, and internal notes together. Open status does not extend retention automatically. Staff may record a reason and a dated hold, with each hold ending no later than 366 days after it is set. Inquiries linked to a case follow that case’s retention policy. Existing general inquiries receive a transition period of at least 30 days when this policy is introduced.

Who can join

Members must be 19 or older and currently enrolled at a Korean university/graduate school or a university-affiliated language program. Applicants may choose phone identity verification or, if they hold an ARC, ARC verification. The phone route is available regardless of nationality when the contracted provider can verify the applicant’s Korean phone subscription in their own name. School affiliation is reviewed separately after registration.

Purposes and data

Account management, identity/age/school verification, duplicate-account and abuse prevention, community/chat/course reviews, translation, notifications, support and security. We process account credentials, name, birth date, nationality and relevant verification results; optional profile/schedule/content data; submitted school documents and review metadata; IP, device, login, push and advertising data. Passwords and duplicate-account identifiers are stored as one-way values. A verified recovery email is required for ARC registration and phone registration when the identity provider identifies the applicant as a foreign national. Phone registration classified by the provider as domestic-national registration does not collect a recovery email. Adding or changing a trading-contact number preserves any existing recovery email. School email is not mandatory for registration.

ARC verification

We read your ARC to verify your name, birth date, gender and nationality. Your registration number, issue date and serial number are sent to CodeLine (APICK) for a check against issuing records. The original photo and raw numbers are not permanently stored. The internal temporary verification record holds verification status, check time, request identifier and cost information for up to 30 minutes for registration and duplicate-request prevention. This period does not cover all operational logs or external providers’ records. Account details, a one-way duplicate-account hash and consent time follow the Privacy Policy retention periods. A different ID may be temporarily processed by external OCR/classification before being rejected; its details are not saved as account information. If you decline, you cannot register through this route.

Before a photo is taken and external OCR begins, you separately agree to identity-document processing and overseas transfers. The server records the displayed notice version, language and receipt time, binds them to the verification session, and checks them before front/back OCR and the issuing-record check. Missing or outdated consent blocks this processing. Session evidence expires within six minutes; subsequent verification tickets expire within 30 minutes after issue. Registration stores only the notice version, language and server receipt time as account consent evidence, retained under the account consent policy for up to three years after anonymization.

School documents

Review and issuing-record checks may also process/store document number, issue/expiry dates, affiliation and verification method/result. Originals expire 30 days after approval/rejection or verification expiry and are included in withdrawal cleanup. Google OCR may assist review; the operator makes the final check. See Privacy Policy §§2.7, 3 and 6 for retention/transfers.

Retention and withdrawal

Verified accounts have a 14-day withdrawal grace period. Accounts that have not completed identity verification are deleted immediately; if records that outlive the account exist (sanctions, inquiries or written content), the account is anonymized at once instead so those records are not deleted with it. Logging in during the grace period cancels withdrawal. Withdrawal never shortens the retention periods below. Anonymization also deletes timetables and personal calendars, notification settings and history, saved post and lecture-review lists, the blocks you set (board, chat room, matching), revoked-device push records, free-translation allowance, ad-reward and translation-usage records and translation results only you used; app feedback is deleted by the next scheduled purge. Staff roles and connections to external review tools are revoked; the permission-change history is kept for three years. Blocks other members set against you are their data and stay; reaction counts stay on posts. A daily job then removes identity details. Posts, comments and reviews may remain with an anonymized author, including attached images; delete unwanted content before withdrawal or contact support. Member-deleted posts/comments are removed from the service database; separate reports/moderation copies follow their retention periods. Image deletion is asynchronous and delivery caches may remain until expiry. For reported images, the necessary evidence copy is secured before deleting the original; temporary copy or storage failures can delay file deletion. Private evidence copies follow their separate retention period. We do not promise simultaneous erasure of every backup copy.

Retention clarification: the three-month identity-hash/signup-IP archive starts on the scheduled deletion date (normally 14 days after requesting withdrawal). The voluntary-withdrawal re-registration restriction ends seven days after that date, normally about 21 days after the request. Other registration checks still apply: matching verified names, birth dates and genders can restrict a new account even for a different person. Names are normalized only for spaces and letter case; verified Korean and English ARC names are compared. This rule does not automatically merge or recover accounts. If you have no existing account and are restricted, request review at support@eoul.app. Images attached to retained posts also remain. Login records: 12 months for security. Minimum records of personal-data system access by administrators and other staff handling personal data are kept for two years; minimum records of access permissions granted, changed or revoked are kept for three years. Detailed administrator operation logs are kept for 90 days and detailed database before/after change records for 365 days under separate operational policies. Consent times: up to three years after anonymization. Pending proceedings and permanent sanctions have exceptions. Failed-translation source text: 90 days from the last failure; successful DB translation text: 90 days from creation. Hash-only spending guards remain during operation. Google advertising privacy options are separate from marketing-message consent.

DM messages are retained for 30 days, group messages for 60 days, and messages in report-locked rooms for 90 days. A withdrawn member's messages stay for the same periods and can be reported by the other members during them. Confirmed violating images, and private evidence copies of reported post and chat images (reporting itself does not remove the original), are held privately for 180 days. Moderation, report-investigation and translation-feedback records are normally held for three years, subject to pending proceedings/permanent-sanction exceptions. School files expire 30 days after completed review or verification expiry. Permanent-ban identifiers are retained while re-registration blocking remains in force. One-way identifiers can still be used to match the same person and are treated as personal data; hashing alone does not make them anonymous.

Actual case reasons, administrator review summaries and previously generated similar-case vectors are not reused as new similar-case reference material. Existing moderation case records and vectors retain their three-year policy and applicable exceptions; this change does not bulk-delete them. New reference material consists of synthetic policy examples.

Chat reports

Selecting a message for a report stores only that one message after the server checks that it belongs to the room, was written by the reported member and is visible to the reporter. Text, images, polls and event cards can be selected. A card identifier may remain in the internal report copy, but the card contents are not newly retrieved or sent for external review. Header/member-list reports without a selected message, and older app submissions without a message selection, retain the reason and any entered detail without adding chat-message copies. Recent conversations are not appended or searched using the detail text.

Selected text or images may be reviewed by an external AI service. The supplied material uses fixed role labels and removes or replaces message/member identifiers and some known nickname/contact expressions. This does not guarantee removal of all personal information or anonymization of text or images. Legacy reports without a confirmed selected message, reason-only reports and poll/event-card reports receive manual review with no automatic external AI call. When an administrator expressly requests translation of a legacy report, only the latest text from the reported member and at most one immediately adjacent reporter text are used, limited to 500 characters each. Other participants’ messages, old images and card identifiers are excluded. This translates an excerpt; administrators can still review the full retained internal evidence.

Chat-report AI results assist administrator review and do not themselves automatically hide messages or sanction the reported member. Immediate protective unmatching for matching-room reports remains separate. Existing report copies are not bulk-deleted by this change; retention and exceptions follow Korean Policy §3.4.

Providers, transfers and advertisements

Before agreeing, read Privacy Policy §§5–6 through the link below for each recipient’s data, contact and retention periods.

• Google LLC (Cloud Vision): ARC and school-document images for text extraction. School PDFs are reviewed manually and are not sent to this API. • Google LLC (Gemini API): ARC images for authenticity checks; post images and, only after the new activation conditions are met, profile-background/room-cover images; posts/comments/reviews, profile bios and room names/descriptions for moderation/translation; requested chat translation content; ordinary text translations do not append previous chat messages. Selected chat-report text/images may be reviewed within the limited scope described above. Administrator-requested legacy-report translation uses at most the two text excerpts described above; legacy/reason-only/card reports have no automatic external review. Similar-case reference material uses synthetic policy examples, not actual case reasons or administrator summaries. Current moderation input may still be processed externally to create a search representation for retrieving those examples. • Cloudflare, Inc.: storage/delivery of images and school-document PDFs, IP and security data. R2 currently uses the Asia-Pacific (APAC) location with default jurisdiction; this does not guarantee a particular country. CDN/security processing uses a separate global network. • Supabase Pte. Ltd.: account/service database stored in Seoul; Singapore contracting entity and possible access by overseas support/operations staff. The contracting entity’s country does not identify every access country. • 650 Industries, Inc. (Expo): push tokens, notification titles/bodies, notification-routing data such as room/message/post identifiers, and app updates. Expo Push Service servers are hosted in the United States; this does not establish all app-update, support or onward Google/Apple processing countries. • Functional Software, Inc. (Sentry): error paths/stacks, performance information and account identifiers in some diagnostics. Current US region; Developer error-event retention is 30 days. Default PII collection is disabled and request/user fields are removed before sending. Separate downsampled trace metrics have a 396-day retention setting; this is not a promise that all Sentry data expires in 30 days. • Discord Inc.: operational metrics and safety alerts without identifiers, original content or individual decision reasons

Encrypted transfers occur when features are used, to providers’ processing countries or through overseas operational access. Google API has no specified region. R2 location, global CDN processing and Supabase support access are different scopes; contracting countries do not establish the full transfer-country list. See Korean Policy §6 for confirmed settings and remaining country-specific information. Service data follows §3; separate provider records follow contracts and provider policies. Withdrawal does not immediately erase all external records. Personal data written in content may also be sent.

Declining transfers essential to operation can restrict registration/use. Optional translation and push have separate feature impacts. Requests/withdrawal: support@eoul.app. Google's advertising SDK may collect information directly from the device; this is described separately from EOUL providing its collected member data and from necessary registration outsourcing. See §16. Non-personalized ads can still use device identifiers/cookies.

EOUL requests non-personalized Google AdMob ads. Google Mobile Ads SDK may directly collect advertising/device identifiers, IP address and IP-derived approximate location, device/OS information, app/ad interactions, diagnostics and performance data, depending on SDK, permissions and settings. Purposes include ad delivery, frequency limits, aggregate measurement, fraud prevention and SDK diagnostics. EOUL's current ad request code does not pass member names, identity documents, nationality, school, posts or chat content as additional advertising data. Direct SDK collection is distinguished from EOUL providing its collected member data.

CodeLine/APICK’s published privacy policy includes personal/credit data of subjects using its members’ paid services, as well as member account data. It lists five years for contract/payment/supply, tax and electronic financial records; three years for complaints/disputes; six months for advertising records; and three months for access records. These are record-specific periods, not a stated retention period for every raw ARC request, response, log or backup. The policy does not identify the ARC API’s processing countries or item-specific retention. Privacy contact: Jo Seung-hyeon, 070-7799-2700, spark@codeline.kr. The policy is dated 1 January 2024 (announcement), effective 15 January 2024.

Domestic identity providers include CodeLine/APICK, PortOne and NHN KCP for the applicable routes. AWS infrastructure is in the Korean region. Google advertising data follows Google’s own purpose-specific retention policy and privacy policy; non-personalized advertisements can use cookies/identifiers for fraud prevention and frequency capping. Advertising information can be transmitted when the SDK runs and when ads are requested or displayed. Depending on the SDK, permissions and settings, this can include device identifiers, IP-derived approximate location, app/ad interactions, diagnostics and performance information. This does not mean collection of the device’s GPS location. The Google ad-content rating limit is T (Teen); it is not a Korean statutory content rating. The app checks Google UMP status and only requests ads after canRequestAds is true and initialization is complete. Unknown/error/timeout states block requests. Google's privacy-options menu appears in Profile when the SDK requires it for the user's region/status. Changing a choice invalidates cached ads and checks the new result before requests resume. A UMP result does not establish every applicable Korean-law processing basis. Device settings and non-personalized ad requests do not stop every advertising-data transfer. Android ad-ID controls and iOS tracking settings can restrict identifiers/tracking, subject to OS version, but do not stop all IP/diagnostic collection. Google's direct collection follows its privacy and purpose-specific retention policies. Account withdrawal, available SDK privacy controls and marketing-message consent have different effects. Additional member-data sharing or new advertising partners would require a separate assessment of applicable notices and consent.

Expo’s official push FAQ states that notification contents are kept in memory and queues only as long as needed to deliver them to Google/Apple push services, not in databases. Staff may see contents while actively debugging. This does not define retention of push tokens, delivery records or app-update data; Google/Apple apply their own policies after handoff.

Paid Gemini API and Cloud Vision

EOUL uses the paid Gemini API. Under the paid-service terms, Google does not use submitted inputs or generated responses to improve its products, and a data processing addendum applies. Abuse-monitoring policy provides for 55-day retention of prompts, context and outputs; authorized staff may review flagged activity/content. Policy-enforcement model use is distinct from general product improvement. Paid use does not mean immediate erasure of every external record. See the Gemini terms and abuse-monitoring policy.

Google states that Cloud Vision content is not used to train or improve Vision models. Online immediate-response operations process images in memory without persisting them to disk; request metadata may be logged temporarily. Asynchronous batch operations have different retention. See the Vision data usage FAQ. Processing locations remain subject to Korean Policy §6.

Content safety and automated decisions

Publishing sensitive details that identify someone else, such as their health, political views, religion or sex life, is prohibited by the community rules, including where the surrounding context identifies them despite a hidden name. User content can contain sensitive personal details. EOUL does not build a health-diagnosis profile; safety analysis can nevertheless involve such content, and moderation records follow the stated retention periods. A member’s own submission does not exempt legally sensitive data from the applicable restrictions. Such processing requires separate consent or statutory authorization, including for current storage, translation and moderation. Automated rules/AI may reject an invalid ID, check age, classify content or limit content visibility. Account warnings, suspensions, permanent bans and strikes require a separate human decision on actual evidence and context. Reports, uncertain classifications and upload refusal alone do not establish an account violation. Matching is unavailable during beta. Posts within a school are still visible to other members, rather than private to the author. Omit or remove sensitive details you do not want shared before posting; use edit/delete or contact support for published content. Separate report/moderation copies follow §3.

You can request reasons, an explanation and human reconsideration. Whether a statutory refusal right applies depends on the particular decision, its significance and legal basis. Not every AI moderation action is a statutory obligation. The ban screen shows available reasons, severity, strike count and source. Request an individual explanation of the information used and decision process through the contact routes. The one-submission limit for an in-app suspension appeal does not limit statutory privacy or automated-decision requests. Hidden-post notices use “Contact us” to open an in-app inquiry, with replies shown in notifications and “My inquiries”; a dedicated hidden-post appeal form is not promised. You can also use support@eoul.app. The sole operator/CPO handles reconsideration; a separate independent reviewer is not promised. Formal processing, extensions and refusal notices follow the full policy and applicable law.

Your rights and security

Request access, correction, deletion, restriction, consent withdrawal or an explanation through the app or support@eoul.app. A registration email is not required for every member, and emailing an ARC photograph is not the default verification requirement. Issuing-authority records may need correction at the source. The ten-day response target is an operational goal, not a universal legal deadline. Access controls, encryption, administrative authentication and audit records protect service data. Minimum access records concern administrators and other staff handling personal data, rather than ordinary members’ app-use records. They identify the actor, time, access origin, affected person and task; permission history records the actor, affected account, time, scope and permissions before/after the change. These minimum records do not copy content, original identity documents or complete database before/after records. Unrecorded historical access origins are not filled in by inference. Statutory minimum access retention is two years for this service’s system processing unique identification data, and permission-history retention is three years under Articles 8(1) and 5(3) of Korea’s Standards for Ensuring the Safety of Personal Information. Deleting detailed operational records does not delete these separate minimum records. Security logs can contain full IP addresses. Error monitoring disables default PII and removes request/user fields before sending; this is not blanket masking of every IP string in diagnostics. Current AWS application logs are kept for 30 days and recovery logs for 14 days, separate from database login/audit records. Backup retention follows the applicable operational configuration.

Student-to-student trading

For students trading or exchanging their own belongings. Business sales are prohibited. EOUL is not a party to the transaction and does not handle payments, delivery or refunds. Check the terms, other person and item; report suspected fraud. EOUL’s legal obligations and liability still apply.

Trading-contact phone numbers and verification records are stored in encrypted form. The selected display country, the identity provider’s domestic/foreign classification, language, trading-contact number and recovery methods are managed separately. Seller email is verified separately unless EOUL holds identity information verified through a legally designated identity-verification institution; the actual exception conditions must be confirmed before launch. EOUL does not automatically publish a private seller’s ID or contact details. Information for dispute handling is provided under applicable statutory conditions; direct provision to a buyer under Korean E-Commerce Act Article 20-4 requires the seller’s consent. A general terms agreement or report alone does not authorize such disclosure.

Mismatch, recovery and trading reports may form encrypted case records containing the request, copies of posts, chats or images designated by the applicant, counterpart identifiers and handling records. Only material the applicant can access is linked, and administrator access, downloads and actions are logged. Phone numbers and raw person identifiers are not automatically added to general inquiries. Case records and linked original inquiries are kept for 90 days from receipt under EOUL’s support/dispute policy, separately from deletion of the original content or account. This is an operational retention period, not a universal statutory period. Extensions require a recorded reason and end date, no later than 366 days from each setting; cleanup runs every ten minutes after expiry. Seller-email verification conditions and actual verification channels still require confirmation before trading launch; trading listings are not offered while those conditions remain unresolved.

International laws

GDPR/PIPL applicability depends on their territorial and activity-based conditions, not nationality alone. PIPL representation is not subject to a general 10,000-user threshold. Vietnam’s 2026 framework includes Law 91/2025/QH15 and Decree 356/2025/ND-CP, effective 1 January 2026. Legal applicability, representations and transfer procedures require service-specific assessment.

Contact

Controller/CPO: EOUL, operator Lim Cheolgeon (임철건), business registration 175-13-03320. Telephone: 070-7954-3182. Email: support@eoul.app. Postal address: (55427) 29-6 Sangyeok-ro, Jinan-eup, Jinan-gun, Jeonbuk State, Building 107, Unit 103, Republic of Korea. Privacy complaints: KISA 118; dispute mediation 1833-6972. Suicide prevention counselling: 109 (24 hours).

Selected reported chat-image access

After reviewing the one image selected by the reporter, an authorized operator may separately withdraw access to that file or restore it under the permitted conditions. Forwarded references using the same URL are affected. This does not start general chat AI review, automatically delete other messages, change report status or impose account sanctions. The operation secures private evidence, quarantines the original and requests cache invalidation; failures/delays mean access blocking may remain pending. Private evidence and quarantined originals follow the 180-day retention rule. Restoration requires a remaining undeleted lawful reference and a retained recoverable source; it does not republish deleted/purged material. Request human reconsideration through in-app inquiries or support@eoul.app.