Privacy policy

zerobacklabs (the “Company”) establishes and publishes this Puzzlog Privacy Policy under applicable law, including the Personal Information Protection Act of the Republic of Korea, to protect data subjects’ personal information and address related concerns.

1. Processing purposes, categories, and retention periods

The Company processes the minimum personal information necessary to provide the Service as follows.

Notifications scheduled on the device, such as daily puzzle reminders, are handled on the user’s device, and their settings are not transmitted to the Company.

Guest use

While using the Service without signing in, photos, videos, and puzzle records registered by the user are stored only on the user’s device, not on the Company’s servers.

When a signed-out user retrieves public content such as themes or default puzzle settings, only access logs for those requests remain on the Company’s servers. They are processed for the sign-in and service protection purpose above. App error information is processed for error analysis and stability improvements in the same way as for members.

When the user signs in, photos, videos, and puzzle records stored on the device are transferred to the signed-in account and are then processed for the service provision purpose above.

Social sign-in

For Google sign-in, the Company may receive a member identifier, email address, name, profile photo, and similar information from Google.

For Apple sign-in, the Company may receive a member identifier, email address, name, and similar information from Apple. Some information, such as the name, may be provided only at the first sign-in.

When Apple’s Hide My Email feature is used, the Company may receive an Apple-generated private email relay address instead of the actual email address.

The information actually provided depends on the member’s settings and each provider’s policies.

The Company does not request unique identification information such as resident registration numbers, or sensitive information such as health information, as separate input fields for registration or use. Photos and videos uploaded by members may nevertheless contain sensitive information, as explained in Section 8.

Membership withdrawal and deletion grace period

When a member requests withdrawal, service use, sign-in, and notification delivery stop immediately, and the member’s group-shared content is hidden from other members.

To address accidental or mistaken account deletion, the Company retains the account and User Content in a recoverable state for 30 days from the request. Personal information is used only for account recovery during this period.

Members may cancel the request within 30 days by signing in again or using another method provided by the Company.

If the request is not canceled within 30 days, withdrawal and termination of the service agreement become final. The Company promptly destroys personal information except information that must be retained under applicable law.

If a member explicitly requests immediate deletion during the grace period, the Company verifies identity as necessary and promptly destroys personal information except information subject to legal retention requirements. The account and content cannot then be recovered.

Information subject to a legal retention obligation or a lawful need for retention, such as handling a legal dispute, is retained for the necessary period and then destroyed.

De-identified usage statistics

The Company collects app usage statistics in a form that cannot identify individuals to understand service use and improve features and stability.

Collected items are a device-generated random identifier, app session identifier, type and result of activity (app launches, screen views, puzzle views, photo or video upload starts and results, recap creation and sharing, and use of camera, gallery, recap, and group puzzle features), event time to the minute, OS type, app major and minor version, and sign-in status. Photo or video content, theme names, group information, and location information are not included.

Usage statistics are distinguished only by the device-generated random identifier. The Company does not link them to accounts, device identifiers, or IP addresses. Accordingly, these statistics do not constitute personal information under the Personal Information Protection Act.

Users can turn off the transmission of app usage statistics in the app’s settings.

2. Children under 14

① The Company does not accept members under 14 and does not directly collect their personal information for registration.

② If the Company discovers that a child under 14 has registered, it terminates the account and promptly destroys related personal information.

3. Destruction of personal information

① The Company promptly destroys personal information when it is no longer needed, such as when its retention period expires or its processing purpose is fulfilled.

② For an ordinary withdrawal request, personal information is deemed no longer needed when the 30-day grace period in Section 1 ends and is promptly destroyed, except information that must be retained under other laws.

③ If a member requests immediate deletion during the grace period, the Company verifies identity, ends the grace period, and promptly destroys personal information except information that must be retained under other laws.

④ Information subject to retention under other laws is stored and managed separately from other personal information and destroyed when its retention period ends.

⑤ Electronic files are securely deleted so that they cannot be recovered or reproduced. Photo and video files are also deleted from their storage locations.

4. Provision to third parties

The Company does not, in principle, provide data subjects’ personal information to third parties.

It may do so to the extent permitted by the Personal Information Protection Act, for example where the data subject gives separate consent or a specific legal provision permits it.

5. Outsourcing of personal information processing

The Company entrusts the following processing tasks to service providers.

Google and Apple social sign-in services are not processors entrusted by the Company. Rather, the Company receives member identification and related information when members use those sign-in services.

When outsourcing processing, the Company takes measures required by applicable law, including prohibiting processing beyond the entrusted purpose, ensuring safeguards for personal information, and managing and supervising providers.

Changes to entrusted tasks or providers are disclosed through this Privacy Policy.

6. Overseas transfers of personal information

The Company entrusts some processing to overseas providers to provide the Service, and personal information may consequently be transferred abroad.

These transfers involve outsourced processing or storage necessary to enter into and perform a contract with the data subject. The following information is provided under Article 28-8 of the Personal Information Protection Act.

6-1. Service servers and storage

6-2. Push notification delivery

6-3. App error analysis

Collection is limited so that error information does not include identifying information such as IP addresses, photos, videos, or email addresses.

The Company implements safeguards required by applicable law during overseas transfers.

7. Security safeguards

The Company implements necessary technical and organizational safeguards under applicable law, including the Personal Information Protection Act, such as managing access permissions, access controls, transmission protection, and access log management.

8. Possible disclosure of sensitive information and how to keep it private

① The Company does not require members to enter sensitive information such as health information, political opinions, religion, or beliefs as separate information fields.

② Photos and videos registered by members may nevertheless contain sensitive information about themselves or others. If content is shared to a group, that group’s members can view it.

③ Members can limit display to others by not sharing content to groups, deleting registered content, or leaving groups.

④ When a member requests withdrawal, their content is hidden from other members even during the deletion grace period.

⑤ The Company does not separately analyze sensitive information in User Content or use it to infer sensitive characteristics such as health, political opinions, religion, or beliefs.

9. Data subjects’ rights and how to exercise them

① Data subjects may request access, correction, deletion, suspension of processing, withdrawal of consent, and other rights under applicable law.

② Members can use app features to delete photos or videos, leave groups, change display names, disable notifications, and request withdrawal.

③ Even during the 30-day grace period after requesting withdrawal, members may request immediate deletion. After necessary identity verification, the Company promptly deletes information except information that must be retained under other laws. The account and User Content cannot then be recovered.

④ Other privacy requests, including immediate deletion, may be emailed to the privacy officer. The Company communicates the result within the periods and procedures prescribed by applicable law.

⑤ Data subjects may also exercise rights through an authorized representative. The Company may verify the identity or authority of the person making the request where necessary.

⑥ If access, correction, deletion, suspension, or other rights are restricted by applicable law, the Company explains the reasons to the data subject.

10. Privacy officer

The Company designates the following privacy officer to oversee processing and protection and to handle privacy inquiries, complaints, and remedies.

Data subjects may use this contact for privacy inquiries, complaints, remedies, exercise of rights, or immediate deletion requests arising from use of the Service.

11. Remedies for privacy infringements

Data subjects may contact the Company or request advice or dispute mediation from the following bodies regarding privacy infringements.

12. Changes to this Privacy Policy

① This Privacy Policy applies from October 8, 2026.

② If the policy changes, the Company publishes the changes and effective date on the service information website or similar channels. Changes that materially affect data subjects’ rights are separately communicated through reasonable means such as in-app notices.

③ Where previous policies exist, the Company makes them available through the service information website or similar channels so data subjects can review them.

Revision history