Privacy Policy

App Atlas processes personal data as set out below. This policy is written to the contents required by article 30 of the Korean Personal Information Protection Act.

1. What is collected

Signing up with email: the email address, and the password. The password is stored only as an argon2id hash, never in the clear.
Signing in with a provider (Google, GitHub, GitLab, Discord, Kakao, Naver): the identifier that provider gives, the email address it reports and whether it says the address was checked, the name, and the address of the profile image.
Created while signing in: a hash of the session token, the browser and system string the browser sends, the two-letter country code of the connection, and the times it was opened, expires and was revoked.
The IP address itself is not stored. Only the country code that the CDN resolves is kept, because the account page shows a country and nothing finer.
Watching an app: the store, the app identifier, the language and country asked for, and when it was named.
Adding to favourites (a saved embed setup): the name given to it, the store and the question it asks, the parameters that make up the view (which app, which sections and their options, the accent, the language and country), and when it was saved. Nothing is written here unless the reader presses save.
What has been looked up recently is kept in the browser's own storage on the reader's device, and is not sent to or stored by the Service.
Confirming an address or resetting a password: the address it was sent to, a hash of the link's token, and when it was issued, expires and was used.
When the terms and this policy were agreed to.
Abuse prevention: for requests to a cost-bearing feature (a deep-link visit, an AI request, watching an app), a one-way daily-rotated hash of the connection address and browser string, a coarse network type (whether the address is a hosting provider) and the country code, the automated risk score and the signals that formed it, and (where a challenge is shown) its outcome. The address itself is never stored, the hash cannot be reversed once its daily salt has rotated, and this record is kept apart from all other data and never joined to it.
The Service collects no advertising identifier, no location and no payment details, and uses no third-party analytics or advertising tool.

2. Why it is processed

Creating, identifying and keeping an account, and signing the reader in.
Confirming an email address, and resetting a password.
Showing where and when the account was signed in, so a sign-in the reader did not make can be noticed and ended.
Carrying out watch requests and returning their results.
Sending notices about running the Service.
Preventing abuse and keeping the Service stable.

3. How long it is kept

Account details: until the account is closed.
Sessions: 30 days from sign-in, or until signed out or revoked.
Confirmation and reset links: 1 hour from issue, and void as soon as they are used.
Watch requests: until watching stops or the account is closed.
Abuse-prevention records: 45 days on a rolling basis, then deleted automatically.
Where a law requires a longer period, for that period.
The app figures collected by watching (ratings, review counts and the like) are public information about an app, not about a person, and are kept after an account closes.

4. Passing it to others

Personal data is not given to anyone else, except where an investigating authority requires it by a lawful procedure.

Signing in with a provider is the reader asking that provider to vouch for them. It is not the Service handing personal data over.

5. Processors, and transfer abroad

The Service relies on the following companies to run. All of them process the data outside Korea.

Render Services, Inc. (United States) / hosting the server and the database / all of the items in section 1 / until the account closes or the arrangement ends.
Resend (United States) / sending confirmation and notice emails / the email address and the contents of the message / for the period set by that provider.
Cloudflare, Inc. (United States) / domain, CDN and protection / connection details including the IP address, which the Service itself does not store / for as long as the request is being handled.

6. Refusing the transfer

Data is sent over the network at the moment the Service is used. A reader may refuse by closing their account. Because the arrangements in section 5 are what the Service runs on, refusing them means the Service cannot be used.

7. Destruction

Once the period has passed or the purpose is met, personal data is destroyed without delay, by a means from which it cannot be recovered.

When an account closes, the email address, the name, the profile image address, the password, every provider link, every stored passkey, every watch and every favourite are deleted at once. Deleting the provider links is what frees that provider account to sign up again. What remains is a record carrying no personal data: an identifier, the dates the account opened and closed, and the plan. The app history collected by watching stays, because it belongs to the app rather than to the reader.

8. The reader's rights

A reader may ask to see their personal data, to correct it, to delete it or to stop it being processed, at any time.

Most of it can be done directly on the account page: changing the address, changing the password, unlinking a provider, signing other devices out, stopping a watch, renaming or removing a favourite, and closing the account.

Anything else can be asked for at the address in section 12, and is acted on within 10 days of arriving. A legal representative or an authorised agent may ask on the reader's behalf.

9. Children under 14

The Service does not accept members under the age of 14, and does not knowingly collect their personal data.

10. Keeping it safe

Passwords are stored as an argon2id hash. The password itself is never kept.
Session tokens are stored as a hash, so the contents of the database cannot be used to sign in as anyone.
Every connection is encrypted with HTTPS.
Links in email expire after an hour and are void once used.
Access to the systems that hold personal data is granted to as few people as possible.

11. Cookies and what the browser stores

sid: keeps the reader signed in. HttpOnly, Secure, SameSite=Lax, 30 days.
oauth: guards a provider sign-in against a forged request while it is under way. Removed after 10 minutes.
No cookie is used for advertising or analytics.
The browser also stores the sign-in method last used, the chosen language and recently used colours. These stay on the device and are never sent to the server.
Cookies can be blocked in the browser's settings. Blocking sid means it is not possible to sign in.

12. Who to contact

Requests to see personal data under article 35 of the Act are received at the same address.

13. Where to complain

Personal Information Dispute Mediation Committee / 1833-6972 / kopico.go.kr
Privacy Infringement Report Centre / 118 / privacy.kisa.or.kr
Supreme Prosecutors' Office / 1301 / spo.go.kr
National Police Agency / 182 / ecrm.police.go.kr
A person dissatisfied with a decision under articles 35, 36 or 37 of the Act may seek administrative appeal under the Administrative Appeals Act.

14. Changes to this policy

Changes are announced at least 7 days before they start, or at least 30 days before where the change is unfavourable to the reader.

The Korean text is the operative one. Where a translation reads differently, the Korean text prevails.

App Atlas · API Reference · Embed Reference · SDK Reference · Terms of Service · Sign up

ko · zh