K-Universe Privacy Policy

Version v1.1 · Effective date: September 8, 2026
Operator: Unichest Inc. · Contact: 4ddesigner@naver.com

1. Introduction and Who We Are

K-Universe is a travel information app for visitors to Korea, operated by Unichest Inc. ("we", "us"), a company in the Republic of Korea. This policy explains exactly what the app collects, why, where it goes, and what we do not do.

We designed K-Universe to work with as little personal information as possible. Most of what the app knows about you never leaves your phone.

For any privacy question or request, contact us at 4ddesigner@naver.com.

2. What We Collect and Why

2.1 Your account

• Anonymous sign-in. When you open the app, it signs you in to Firebase anonymously. This creates an anonymous user ID (UID) with no name, no email, and no link to you. The ID is kept in your device's app storage, so it stays the same when the app restarts; reinstalling the app issues a new one. We use it so the app can save and show your own posts.
• Optional Google sign-in. You can choose to sign in with Google. You do this in your system browser on a page hosted by our server; our server checks the Google ID token and returns only four fields to the app: uid, email, name, and picture. The one-time exchange code used for this handoff is held in our server's memory for at most 10 minutes and is deleted immediately once it is claimed.
• No passwords or tokens are stored. We never store your Google password, ID token, or refresh token — not on your device and not on our server. Your device stores only the four public profile fields above, in local app storage.
• Google sign-in is required only if you want to post to Traveler Moments.
• Username. To post, you choose a public username (4–12 characters, lowercase letters and numbers). We store the username you choose together with a claim record that maps that name to your account, so that no two travellers can hold the same name. Your username is public by nature: it is displayed on everything you post, and anyone can check whether a given name is already taken.

2.2 Traveler Moments (posts other travellers can see)

A Moment is a photo plus a short text about a place. Moments are public to other users of the app.

• Photo. Uploaded to Firebase Cloud Storage at the path moments/{anonymous-uid}/{timestamp}.jpg.
• Post record. Stored in Firebase Cloud Firestore with exactly these fields: spotId (the place the post is attached to), uid (your anonymous UID), userName (your Google display name, or "Traveler"), photoUrl, text (up to 120 characters), status, and createdAt.
• No GPS or location metadata is attached to a Moment. The only location signal in a post is which place (spotId) you attached it to.
• Moderation. Moments are subject to moderation that combines automated screening with human review.
• Reports. If you report a post, we store a report record containing the momentId, the spotId, your anonymous UID, and a timestamp.
• Blocks. If you block a traveller, that block is stored only on your own device and is never sent to our server.

2.3 Menu scanning (K-menu)

• The menu photo is sent to our server as base64 data and forwarded to the Anthropic Claude API, which reads the dishes and returns text.
• The photo is not stored. Not on disk, not in a database, not in logs. It exists only in our server's memory for the length of the request, and is then gone.
• Under Anthropic's commercial API terms, content submitted through the API is not used to train models.

2.4 K-care symptom card

• The symptom text you type — and, only if you choose to include it, your health profile (allergies, medications, conditions) — is sent to our server and on to the Anthropic Claude API to produce a card you can show a pharmacist.
• The symptom text and the health profile are not kept on our server. They are used to answer that one request and then discarded. Only a per-device daily usage counter remains.
• The health profile itself lives on your device.

2.5 Location

Location is used only while you are using the app, and only if you grant permission.

• K-taxi fare estimate. Your current coordinates are sent to our server and forwarded to Naver Cloud (Maps Direction) to calculate distance, time, and an estimated fare. Our server keeps the route result in a short-lived memory cache; the coordinates are not written to disk and are not logged.
• K-care nearby pharmacies, hospitals, and emergency rooms. Your current coordinates are sent to our server and forwarded to the Korean public data portal (data.go.kr) open APIs to find nearby facilities. Results are cached briefly in server memory on a coarse grid and are not written to disk.
• The blue "my location" dot on the map is handled entirely on your device and is never sent anywhere.
• Your location is never stored in a user profile, never used for advertising, and never sold.

2.6 Place search

• A place name you type is sent to our server and on to the Naver Open API local search to find matching places.
• Place names may be translated using the Anthropic Claude API.

2.7 Usage counters

To enforce free-usage limits on the AI features, our server keeps a small per-device counter record containing:

• a device identifier — an installation identifier generated by the app itself, sent as the X-Device-Id header;
• daily scan counts;
• K Pass status;
• your anonymous Firebase UID.

These counters contain no name, no email, and none of the content you scanned or typed.

2.8 Product analytics and error diagnostics

So that we can see which features are actually used and where people get stuck — and improve the app accordingly — the app sends a fixed, predefined list of in-app events to PostHog (posthog.com), our product-analytics provider. PostHog acts as a processor handling this data on our instructions. This is not used for advertising, not used to profile you, and never resold.

• The events we send. Only the following: opening the app; finishing or skipping the intro; which tab you view; viewing a place or spot detail; tapping directions; saving a place; starting and finishing a menu scan (including how many dishes were recognised, or an error category); opening an order card; estimating a taxi fare; viewing a driver card; searching in K-care, including when a search found nothing; tapping a public emergency hotline number; viewing a K-Star location; seeing a K Pass offer; starting and completing a K Pass activation; choosing or changing a username — the fact that you did, never the name itself; and posting a Traveler Moment, including when a post was blocked or failed, with the reason category only.
• What is sent alongside each event. A randomly generated install identifier; the app's name, version, build number, and bundle ID; a coarse device category, which on a phone is always the fixed value "Mobile"; and the app language you selected.
• Error diagnostics. The same tool also records app errors — the error type and the code location, that is, a stack trace — so we can fix crashes. No screen contents and no personal data are included.
• No device or handset details. We do not collect your device model, manufacturer, or device name; we do not collect your operating system name or version; and we do not collect your device locale or timezone. The coarse device category above is a fixed value on a phone — it is not a measurement of your device and tells us nothing about your handset.
• No advertising identifiers. We do not read the iOS advertising identifier (IDFA) or the Android Advertising ID, and there is no cross-app or cross-site tracking. There is no advertising and no ad network in the app at all.
• No names and no text you type. No names, email addresses, usernames, or profile photos are sent, and none of the free text you type.
• No photos. Neither the photos you scan or post, nor their contents, are sent.
• No location. No GPS coordinates and no addresses are sent, and IP-based geolocation is explicitly disabled — we do not derive your country or city from your IP address. Our only regional signal is the app language you chose yourself.
• Not linked to your account. The analytics identity is not linked to your Google sign-in, your Firebase account, or the username you chose.
• No session recording. We do not record or replay your screen.
• How long it is kept. Analytics and error events are retained for up to 12 months and are then deleted.
• How to turn it off. You can switch analytics off at any time in the app under My → Settings ("Share usage data"). Turning it off immediately stops all analytics and crash-diagnostics collection on that device, and your choice is remembered.
• Where it is stored. PostHog processes this data on our behalf and may store it in the United States; our PostHog region is the US cloud.

2.9 Purchases (K Pass)

K Pass is a real, paid purchase, not a demo.

• On iOS, K Pass is purchased through Apple's In-App Purchase system. On Android, it is purchased through Google Play Billing. In both cases, the store — not us — takes your payment; we never see your card number, billing address, or other payment details.
• After a purchase, our server verifies the receipt directly with Apple's or Google's server-side API, then stores a purchase record containing: your account identifier, the transaction ID, a one-way hash of the purchase token (never the token itself), the product ID, the platform (iOS or Android), and the purchase time.
• Restoring K Pass. Your Firebase sign-in identity (an anonymous UID, or your Google or Apple account if you link one) is mapped on our server to your account identifier. If you have linked a Google or Apple account, this mapping lets us restore your K Pass when you sign in with that account on a new install or device. A purchase made while anonymous stays with that installation: reinstalling the app or deleting the account issues a new anonymous identity, and the earlier purchase cannot be restored to it.
• Refunds are handled entirely by the store you purchased from (Apple or Google), under that store's own refund policy. We cannot issue a refund directly.

3. What Stays on Your Device

The following is stored only in the app's local storage on your phone and is never uploaded to us:

• your nickname and profile photo;
• your saved spots;
• your app settings, and your chosen language and currency;
• your K-care health profile — allergies, medications, conditions;
• the list of travellers you have blocked;
• posts you have hidden locally.

Deleting the app erases all of it.

4. What We Do Not Do

• We do not sell or rent your personal information to anyone.
• The app contains no advertising at all. There is no ad banner, no space reserved for one, and no advertising SDK anywhere in the app; no advertising identifier is read, and no data is sent to any ad network. If we ever introduce advertising, we will update this policy first.
• We use exactly one analytics tool — PostHog — and only for the product analytics and error diagnostics described in section 2.8. It receives no advertising identifier, no location, no photos, and none of the text you type, it does not record your screen, and it is never used for advertising or profiling. You can switch it off at any time under My → Settings ("Share usage data"). The only other counting anywhere is the per-device usage counters described in section 2.7.
• We do not track you across other apps or websites, and we do not read advertising identifiers.
• We do not build advertising or behavioural profiles about you.
• We do not send any of your content or data to Google Gemini. Gemini is used only inside our own admin tool, by our team, to generate illustrative artwork for places and dishes before that artwork ships in the app.
• The app itself collects no payment card or billing address — that is handled entirely by the store. K Pass is a real, paid purchase: Apple's In-App Purchase (iOS) or Google Play Billing (Android) processes your payment, and our server only ever receives the purchase record described in section 2.9 — never your card number or billing details.
• The app does not record audio. No feature uses the microphone.

5. Who Processes Data for Us

We use the following service providers. Each one only receives what it needs for the purpose listed.

• Apple — processes and verifies K Pass purchases made through the App Store's In-App Purchase system on iOS, and provides Sign in with Apple.
• Google Play — processes and verifies K Pass purchases made through Google Play Billing on Android.
• Google Firebase (Authentication, Cloud Firestore, Cloud Storage) — anonymous and Google accounts, Traveler Moments posts, and Moment photos. Provided by Google LLC.
• Anthropic (Claude API) — reads menu photos, produces K-care symptom cards, and translates place names. Content is processed transiently and, under Anthropic's commercial API terms, is not used to train models.
• Google Gemini — admin-side artwork generation only. No user content and no user data is ever sent to Gemini.
• Render — hosting for our server infrastructure.
• Naver Cloud Platform / Naver Open API — maps, route and fare calculation, and place search (Korea).
• Korea public data portal (data.go.kr) — pharmacy, hospital, and emergency-room lookup (Korea).
• PostHog — product analytics and app error diagnostics, as described in section 2.8. PostHog is a processor acting on our instructions and may store this data in the United States (our region is PostHog's US cloud). It receives no advertising identifier, no location, and none of the content you type or photograph.

6. Permissions the App Asks For

You are asked for each permission only when a feature needs it, and you can change or withdraw any of them at any time in your device Settings.

• Camera — "K-Universe uses the camera to scan Korean menus and to let you add photos of places you visit."
  Used to photograph a menu for K-menu, and to take a photo for a Traveler Moment.
• Photo library — "K-Universe uses your photos so you can scan a saved menu picture or share a photo of a place you visited."
  Used so you can pick an existing photo instead of taking a new one.
• Location (while using the app) — "K-Universe uses your location to estimate taxi fares from where you are and find nearby pharmacies."
  Used for the K-taxi fare estimate, for finding nearby pharmacies, hospitals, and emergency rooms in K-care, and for the map's blue dot. Never in the background.
• Microphone / audio — not used. No feature in K-Universe records audio. (An unused audio-recording entry appears in the Android manifest purely as a side effect of the camera module.)

7. How Long We Keep Data, and How to Delete It

• Traveler Moments. Posts stay until you delete them or moderation removes them. You can delete your own post from inside the app. Please note honestly: because a reinstall issues a new anonymous ID, if you reinstall the app you may no longer be able to delete an older post yourself — in that case, email us and we will remove it.
• Reports. Report records are kept while we handle the report and for our safety records.
• On-device data. Erased by deleting the app.
• Google account information. Signing out clears it from your device.
• Menu photos, symptom text, and health profile sent for processing. Not stored — discarded when the request finishes.
• Location sent for fare estimates and nearby-facility lookups. Held only in a short-lived server memory cache; not written to disk and not logged.
• Per-device usage counters. Kept for as long as needed to enforce usage limits. They contain no name, email, or content.
• Product-analytics and error-diagnostics events. Kept for up to 12 months, then deleted. Switching "Share usage data" off under My → Settings stops any further collection on that device immediately.
• Deleting your account. You can delete your account from inside the app: the My tab → Settings → Delete account. Deletion is immediate and permanent, and it cannot be undone.
• What deleting your account removes. Your public @username is released, so another traveller can claim it afterwards; your profile is deleted; every Traveler Moment you posted is deleted including the photo, and it disappears for everyone, not only for you; your Google sign-in on that device is removed; and your on-device personal data — saved spots, allergy rules, health card, K Pass state, your nickname and profile photo, your last pharmacist card, and the posts and travellers you had hidden or blocked — is erased.
• What deleting your account does not remove. Stated plainly, because it matters: the anonymous per-device usage counters in section 2.7 remain. They are keyed to a device identifier and not to your account, they contain no name, no email, and none of your content, and they have to stay so that daily usage limits keep working; they are kept for as long as needed to enforce usage limits. Moderation and report records are kept for our safety obligations. Product-analytics and error-diagnostics events (section 2.8) are not linked to your account and follow their own 12-month retention. Your K Pass purchase ledger and the account-identifier mapping described in section 2.9 also remain on our server — kept to support purchase restoration, refund handling, and legal record-keeping. Purchases and receipts held by Apple or Google themselves stay with the store and have to be managed there — we cannot delete or refund them. Finally, four items are deliberately left on your own device because erasing them would help nobody: your chosen language, your "Share usage data" setting (you asked for less collection, so we will not quietly switch it back on), the device identifier that keys the counters above, and the cached copy of our public place catalogue, which contains nothing about you.
• Deleting by email or on the web. The in-app button is not the only route. If you can no longer sign in, or you have lost access to your device, see k-orea.com/delete-account.html or email 4ddesigner@naver.com and we will action your deletion request.

8. Your Rights

You have the right to:

• access the personal information we hold about you;
• have it corrected if it is wrong;
• have it deleted;
• object to or ask us to restrict its processing;
• withdraw consent at any time — camera, photo library, and location permissions can be revoked whenever you like in your device Settings (iOS or Android), and analytics can be switched off in the app under My → Settings ("Share usage data").

Send any request to 4ddesigner@naver.com. We respond without undue delay.

If you are not satisfied with how we handled your request, you may lodge a complaint with Korea's Personal Information Protection Commission (PIPC).

9. Children

K-Universe is not directed to children. We do not knowingly collect personal information from children under 14 (the standard under Korean law) or under 13 (the standard under laws such as the US Children's Online Privacy Protection Act). If we learn that we have collected such information, we delete it. If you are a parent or guardian and believe your child has given us personal information, contact us at 4ddesigner@naver.com and we will remove it.

10. International Transfer

We are based in the Republic of Korea. The service providers named in section 5 operate servers outside Korea, including in the United States. Using K-Universe therefore involves transferring data internationally. Those transfers are handled under each provider's own terms and safeguards for international data transfer.

11. Security

• Data sent between the app and our server, and between our server and our service providers, is encrypted in transit using HTTPS/TLS.
• Access to our admin console is restricted to authorised members of our team.
• We keep as little as possible: content sent for AI processing is not stored, and sensitive material such as your health profile stays on your device.
• Honestly stated: no online service can guarantee absolute security. We work to protect your information, but we cannot promise it is impossible for anything to go wrong.

12. Changes to This Policy

If we change how the app handles data, we will update this policy and post the new version with a new effective date at this address before or when the change takes effect. If the change is significant — for example if we ever introduce real advertising — we will say so clearly.

13. Contact

Privacy questions, access or deletion requests, and complaints:
Unichest Inc. — 4ddesigner@naver.com