Privacy Policy

Article 1Purposes of Processing Personal Information

Popokit processes personal information for the following purposes. Personal information we process is not used for any purpose other than these. If a purpose changes, we will take the necessary measures, such as obtaining separate consent in accordance with Article 18 of the Personal Information Protection Act.

1. Member management: creating and maintaining accounts, linking Apple and Google accounts, and preventing misuse such as repeatedly creating accounts on one device
2. Providing the service: recording walk distance and routes, making photo cards and showing where photos were taken, walk weather information, the feed, public profiles and comments, sending notifications such as care schedules, and creating AI cards
3. Providing paid services: granting Golden Bones and Plus, managing subscription status, processing refunds, and keeping transaction records as required by law
4. Improving the service: analyzing usage statistics, analyzing errors and crashes, and checking the quality of AI cards
5. Friend invites: granting invite rewards (Golden Bones and invite-only decorations) to new users who arrive through a card QR code and to the users who invited them, and preventing fraudulent claims such as repeatedly creating accounts on one device to receive rewards
6. Responding to inquiries: checking a user's own usage records to answer that user's inquiries and error reports
7. Sending advertising information: sending news of events, discounts and new features to users who have agreed to receive it (Article 10)

Article 2Personal Information We Process

Popokit processes the following personal information while you use the service.

• Payment method information is processed by Apple and Google. Popokit does not receive it.
• Card photos use only photos taken in the app. Photos from your device's photo library are used only as material for making stickers and do not become card or photo box photos.
• App usage records note only which screens you viewed, what you tapped and what the result was, using predefined names and values. They contain no text, photos, names or locations, and numbers are recorded only as ranges.
• Your name tag and your dog's name do not have to be real names.

Article 3Retention and Use Periods

Popokit keeps personal information while your account exists and destroys it without delay when you delete your account. However, the following information is kept for the periods below.

Payment records are kept separately from the account, holding only the store, item, store transaction number, number of bones granted, and time of payment, expiry and refund. They are not used for any purpose other than fulfilling legal obligations.

Article 4Procedure and Method of Destruction

Destruction procedure. When you delete your account in the app under Settings > Account > Delete account, the following information is destroyed with it: photos and cards, walk records and routes, dog profiles, posts and comments on the feed, Golden Bones and packs you own, Plus status, app usage records, installation identifier, AI card request records, offer notification consent records, and friend invite records. The photo box and photos not yet uploaded that remained on the device are also deleted. A deleted account cannot be restored.

When you delete your account, your cards saved by other users, cards you passed on by QR code, and replies to your comments also disappear. Records of users you invited or who invited you are also deleted when either the inviting user or the invited user deletes their account. Reports you made remain with the reporter information removed, because they are needed to review other posts. The fact that other users reacted to your posts or followed you remains in those users' mission and badge records, but only as a number that cannot identify you.

Google sign-in is disconnected on the device, and for Apple sign-in we ask Apple to disconnect it. You can also disconnect it yourself under ‘Sign in with Apple’ in your Apple ID settings. Plus subscription payments are handled by the App Store and Google Play, so deleting your account does not cancel your subscription. Please cancel it in each store's subscription management.

Destruction method. Information in electronic file form is deleted from the database and file storage. Photo files are deleted from storage in sequence. Information with a set retention period is deleted in the same way when the period ends.

If you cannot access the app, you can request deletion at [email protected]. For details, please see the account deletion guide. Accounts created without an email address and password cannot be recovered, so we recommend linking your account in case you change or lose your device.

Article 5Provision of Personal Information to Third Parties

Popokit does not provide users' personal information to third parties. The exception is when the law has special provisions or when an investigative agency requests it following procedures set by law. The extent to which information you make public yourself is visible to other users is described in Article 9.

Article 6Outsourcing of Processing

Popokit outsources personal information processing as follows to provide the service. In outsourcing contracts, we set out what is needed to keep personal information safely managed, and we do not sell personal information to contractors or provide it to them for advertising purposes.

Walk weather is obtained from Apple Weather. Only a location grouped into units of about 5km is passed on through Popokit's servers, and no account information is passed on.

Article 7Transfer of Personal Information Abroad

Servers and photos are kept in Korea (Seoul). However, the following companies process personal information outside Korea, so we give notice in accordance with Article 28-8 of the Personal Information Protection Act. All of them process it on behalf of Popokit, and it is transmitted over encrypted networks.

Google LLC

OpenAI OpCo, LLC

Vercel Inc.

Apple Inc.

How to refuse transfer abroad and its effect. Information is sent to OpenAI only when you use an AI pack, so nothing is sent if you do not use one. Information is sent to Vercel when someone opens a public page, so nothing is sent if you do not create a public profile and do not share links. Notifications that include names (care, feed news) are not sent to Google and Apple if you turn them off in the app's notification settings. The device check token is sent to Apple only when you save a card received through a card QR code as a new user, so it is not sent if you do not save one. Beyond that, transfers to Google for map display, crash analysis and usage statistics are necessary to provide the service, and there is currently no setting in the app to turn them off separately. To refuse, you must stop using the app and delete your account, in which case you will not be able to use the service. When you delete your account, Analytics collection on that device is turned off and the analytics identifier is reset.

Article 8Processing of Location Information

Walk routes. Precise location is collected only from when you start a walk until you end it, and collection stops immediately when it ends. The collected route is stored on the server to show the path you walked in the walk summary. Stored routes are not made public to other users, and there is no feature for finding walks that passed a specific place.

Place names shown on photos. The bottom of a photo shows the country, city and date (e.g. 🇰🇷 Incheon · 2026-09-10). The coordinates at the moment the photo is taken are converted into country and city names on the device by the phone's operating system, and the precise coordinates never leave the device. The server receives only the city name and coordinates grouped into units of about 5km. Because the place name is imprinted into the photo image, it cannot be removed later. That is why nothing narrower than a city (neighborhood, building names) is shown, and the time the photo was taken is not shown either. When you delete a photo, the image and its coordinates are deleted together.

Walk weather. The weather on the home screen is requested from Apple Weather by Popokit's servers. Instead of precise coordinates, the device sends the server only latitude and longitude grouped into units of 0.05 degrees (about 5km north–south) and the time zone. Weather is looked up only while you are viewing the home screen, and location is not received while the app is in the background. The server keeps the weather it receives for up to 1 hour per grid cell, without any requester information, to reuse it for other users in the same area, and does not keep weather lookup records on accounts.

Article 9Information Visible to Other Users

Until you create a public profile, your information is not visible to other users (except whether a friend invite has been confirmed, described below). To write posts or comments on the feed, you must set a name tag and create a public profile, and from then on the following information is visible to other users of the app.

• Name tag, bio, main image
• Your dog's name, photo and introduction (breed, age, birthday, sex), number of cards, total walk days and distance, badges earned, recent missions
• Public cards, posts and comments

Your dog's health and care records, coordinates and walk routes are not made public. The only location made public to other users is the city name shown on photos.

Friend invites. When you invite another user with a card QR code, the inviting user's app shows the invited user's name tag (only if they have a public profile) and whether the invite has been confirmed (Waiting · Confirmed). It does not show whether the invited user has signed in, or when or how many times they opened the app.

Cards are created as public at first. If you turn off ‘Card sharing’ for a dog, all of that dog's cards become private, and you can also make cards private one at a time. Private cards are not visible to anyone else anywhere: in the feed, in cards saved by other users, or through share links and QR codes. Share links and QR codes you make yourself can be opened by people who are not signed in, but they are not exposed to search engines, and if you turn off a card's QR code, that address no longer opens.

Article 10Sending of Advertising Information

Popokit's news of events, discounts and new features (offer notifications) is advertising information, and is sent as push notifications only to users who have separately agreed to receive it. The default is not to receive it, and allowing notification permission alone is not treated as consent. You can agree in the app under Settings > Notifications > Offer notifications (ads), or in a notice shown once after you finish your first walk. There is no restriction on using the service if you do not agree.

When choosing which news to send to users who have agreed, we use only the following information. App usage records are not used, and the effect of sending is checked only as aggregate figures, not per person.

• ‘(Ad) Popokit’ is shown at the start of the notification title, and how to opt out is written at the end of the body.
• Notifications are not sent from 9 PM until 8 AM the next day, based on the time where the user is.
• You can opt out at any time, free of charge, in the same setting, and it takes effect immediately. When you agree, decline or withdraw, the app tells you the result and the date right away.
• Every 2 years from the day you agreed, we remind you that you agreed, the date, and how to opt out.

Article 11Rights of Data Subjects and How to Exercise Them

You may at any time request access to, correction of, deletion of, or suspension of processing of your personal information, and withdraw your consent.

• You can edit your name tag, dog profiles and public profile directly in the app.
• You can delete photos and cards, posts and comments one by one in the app.
• You can turn off notifications and offer notifications in the app under Settings > Notifications.
• You can delete your entire account in the app under Settings > Account > Delete account.

For any other request, send it to [email protected] and we will act without delay; requests for access are handled within 10 days. You may also make requests through a legal representative or a person you have authorized, in which case you must also send documents that confirm the authorization. Information that other laws require us to keep is retained for that period even if you request deletion.

Article 12Measures to Keep Personal Information Secure

Popokit takes the following measures to keep personal information secure.

• All communication between the app or website and the servers uses encrypted connections (HTTPS).
• The database is kept on an internal network that cannot be reached directly from the internet.
• Operations tools can be used only by operators who pass separate authentication.
• When an operator views one user's app usage records or notification records, what was viewed and when is logged.
• The number of people who process personal information is kept to a minimum.

Article 13Installation, Operation and Refusal of Automatic Collection Tools

App. We use Google Analytics for Firebase and Firebase Crashlytics for usage statistics and crash analysis. Account numbers are not sent, advertising identifiers are not collected, and ad personalization signals are kept turned off. There is currently no setting in the app to turn off only this collection; when you delete your account, collection on that device is turned off and the analytics identifier is reset. Records already sent to Google Analytics are not linked to your account, so they cannot be found and deleted by account; they are deleted when the retention period (2 months) ends.

Continuing to a received card. If you scan a card QR code and then newly install the app, the app opens that card once, the first time after installation. On Android, it reads only the card address from the install source information that Google Play passes on at installation (install referrer). On iPhone, it checks only whether there is a web address on the clipboard, and reads the clipboard's content only when you tap the paste button. Tapping ‘See it in the app’ on a card page copies that card's address to the clipboard.

Website. popokit.pet uses only one cookie, which remembers the language you chose, and does not use analytics or advertising cookies. You can refuse cookies in your browser settings, in which case the language you chose will not be remembered.

Article 14Children's Personal Information

Popokit is a service for people aged 13 and over. In the Republic of Korea, it can be used from age 14 and over in accordance with Article 22-2 of the Personal Information Protection Act. Popokit is not directed at children younger than this age and does not knowingly collect their personal information. If we learn that such information has been collected, we delete it without delay.

Article 15Privacy Officer

Popokit has designated a privacy officer as follows to oversee work related to the processing of personal information and to handle related inquiries, complaints and remedies for damage.

Article 16Remedies for Infringement of Rights

To obtain a remedy for infringement of personal information, you can apply for dispute resolution or counseling to the following organizations.

• Personal Information Dispute Mediation Committee (개인정보분쟁조정위원회): 1833-6972 (www.kopico.go.kr)
• Personal Information Infringement Report Center (개인정보침해신고센터): 118 (privacy.kisa.or.kr)
• Supreme Prosecutors' Office (대검찰청): 1301 (www.spo.go.kr)
• Korean National Police Agency (경찰청): 182 (ecrm.police.go.kr)

Article 17Changes to This Privacy Policy

This privacy policy applies from the effective date above. If the policy changes, we will post it on this page with the new effective date, and we will also notify you in the app of important changes, such as an increase in the items collected. Previous policies can be viewed in the revision history below.