Privacy Policy

This Privacy Policy explains our privacy protection policy.

1. Personal Information Collected

1-1. Information We Collect Directly

  • Email address (upon registration)

1-2. Information Collected by Third-Party Advertising Services

Advertising services (AdMob) included in this app directly collect the following information to provide advertisements. We do not collect, store, or manage this information; each advertising service provider processes it directly:

  • Advertising identifiers (IDFA for iOS, Google Advertising ID for Android)
  • Device information (model name, OS version, screen size, language settings)
  • IP address and approximate location information
  • Interactions with advertisements (ad impressions, clicks, view completion)

※ Advertising services do not collect general app usage activities (feature use, content creation, etc.) and only collect information necessary for ad display and performance measurement.

1-3. Information Automatically Generated and Collected During Service Use

During your use of the Service, the following information may be automatically generated and collected.

  • Access logs: IP address, access date and time, service usage history
  • Device information: OS version, device model, app version, language/region settings
  • Notification service information: device token for push notifications (APNs/FCM token)
  • Error and quality improvement information: error logs and crash (abnormal termination) records

1-4. Information Provided by Users (User-Generated Content)

Information that users directly enter or upload while using features includes the following.

  • Photos (e.g., images uploaded when using record/analysis features)
  • User-entered text such as notes, records, and concerns
  • Baby/profile information (e.g., date of birth or age, within the scope entered by the user)
  • Baby health-related records (sensitive information): parenting records such as feeding, diapers, sleep, temperature and medication, poop and skin photos, height and weight, and AI analysis results. This information constitutes health information under Article 23 of the Personal Information Protection Act and is processed only with separate consent.
  • Who provides the baby's information: information about a baby (under 14) is entered and provided directly by the guardian acting as the legal representative.

2. Purpose of Collection and Use of Personal Information

2-1. Purpose of Use of Information We Collect

  • User identification and service provision
  • Providing notifications based on the records you enter (e.g., record reminders, schedule and feeding alerts)
  • Providing AI analysis results based on the records and photos you enter
  • Producing statistics processed so that individuals cannot be identified, and improving the service (e.g., the distribution of poop color and consistency among babies who eat similar things)

We do not use collected personal information for marketing and advertising.

2-2. Purpose of Collection and Use by Third-Party Advertising Services

Advertising service providers (AdMob) collect information for the following purposes:

  • Providing personalized advertisements
  • Measuring and analyzing advertising effectiveness
  • Preventing fraudulent clicks

2-3. Advertising Services and Third-Party SDKs

This app uses third-party advertising services for monetization. These advertising services directly collect and use user information to provide personalized advertisements. We do not directly collect, store, or process information collected by advertising services.

Advertising Services Used

Information Collected by Advertising Services

  • Advertising identifiers (IDFA for iOS, Google Advertising ID for Android)
  • Device information (model name, manufacturer, OS version, screen size)
  • IP address and approximate location information
  • Ad views, clicks, and conversion data

※ Advertising services collect only the minimum information necessary for ad display and measurement and do not collect general app usage activities.

How to Limit Personalized Ads

Users can limit personalized ads through device settings:

  • iOS: Settings → Privacy → Tracking → Turn off Allow Apps to Request to Track
  • Android: Settings → Google → Ads → Opt out of Ads Personalization

You can also manage ad settings at: https://adssettings.google.com

2-4. Disclosure to Other Users Based on Your Consent

Only if you separately consent, we show your baby's poop photos to other users whose babies eat similar things, as downsized copies cropped to the part that shows the poop. The photos appear on another user's poop analysis result screen, together with what the babies eat and their age range. Which photos appear is decided for each analysis when its result is first shown, and the same photos appear again when that result is opened later (photos whose sharing has been withdrawn or whose records have been deleted are left out). You may withdraw your consent at any time.

  • Disclosed: photo (downsized copy), feeding records (breast milk, formula, solid foods, probiotics, milk), baby's age range, and the color and consistency classification from the AI analysis (skin photos are not disclosed)
  • Not disclosed: name, date of birth, face, location, capture information (EXIF)
  • Scope: photos saved up to the time of consent and photos saved afterwards (the number of photos is shown on the consent screen)
  • Withdrawal: you may withdraw at any time in settings. Disclosure stops immediately upon withdrawal and the photos are no longer provided to other users. However, screens that other users have already saved (screenshots) cannot be undone.
  • If any one of a baby's guardians selects "do not share", that baby's photos are not disclosed.
  • Inappropriate use of disclosed photos can be reported, and we will block it after review.

3. Retention and Use Period of Personal Information

3-1. Information We Retain

  • Membership information collected for online/mobile service provision: Until membership withdrawal
  • If individual user consent is obtained: Period of consent
  • If a dispute such as a complaint or lawsuit occurs between the company and the user: Until the dispute is resolved
  • Shared copies of gallery photos: made private immediately when the user withdraws; deleted when the account is deleted.
  • Consent records (time of consent, text version, time of withdrawal): 1 year after membership withdrawal, for handling disputes

3-2. Information Retained by Third-Party Advertising Services

The retention period of information collected by advertising service providers is subject to each provider's privacy policy. We do not retain or manage such information.

3-3. Handling of Deletion Requests and Account Withdrawal

If a user deletes records/photos/notes in the app or requests account withdrawal, we delete the relevant personal information from service operation systems and databases without delay.

However, information required to be retained by applicable laws will be stored separately for the legally required period and then destroyed.

4. Provision of Personal Information to Third Parties

We provide personal information to third parties as follows:

4-1. Advertising Services

  • Recipient: Google LLC (AdMob)
  • Purpose of Provision: Provision of advertising services and display of personalized ads
  • Items Provided: Advertising identifier, device information, IP address, approximate location, ad view/click data
  • Retention and Use Period: Subject to each provider's privacy policy

4-2. Subscription Management Service

  • Recipient: RevenueCat, Inc.
  • Purpose of Provision: Management and processing of in-app subscriptions (paid services)
  • Items Provided: Anonymous user identifier (UUID), subscription status information
  • Personal Identification Impossible: Users cannot be identified solely by UUID
  • Retention and Use Period: Subject to RevenueCat's privacy policy
  • Privacy Policy: https://www.revenuecat.com/privacy

※ RevenueCat does not directly process subscription payments and only manages subscription status processed through Apple App Store and Google Play Store.

4-3. Outsourcing of Personal Information Processing and Cross-Border Transfer

  • Trustee: Amazon Web Services, Inc. (AWS)
  • Outsourced Tasks: Operation of servers/databases/storage, data retention, and provision of service infrastructure

To provide the service, personal information is transferred overseas as follows.

  • OpenAI OpCo, LLC (contact: privacy@openai.com)
    Country: United States / Outsourced tasks: AI analysis of photos and records, chatbot response generation, fortune (saju) results
    Timing and method: sent over an encrypted connection (HTTPS) each time you use an AI feature
    Items transferred: poop and skin photos, parenting records, conversation content, the names, birth dates and times, and genders entered for a fortune (saju) reading
    Retention: until the purpose of the outsourcing is fulfilled (content sent through the API is not used for model training; how long OpenAI separately keeps data for abuse monitoring follows OpenAI's policy)
  • Google LLC (contact: googlekrsupport@google.com)
    Country: United States / Outsourced tasks: AI analysis of photos and records, chatbot response generation, fortune (saju) results
    Timing and method: sent over an encrypted connection (HTTPS) each time you use an AI feature and, if you agreed to poop photo sharing, when shared photos are prepared and reviewed
    Items transferred: poop and skin photos, parenting records, conversation content, the names, birth dates and times, and genders entered for a fortune (saju) reading
    Retention: until the purpose of the outsourcing is fulfilled (how long Google separately keeps data for abuse monitoring follows Google's policy)
  • Anthropic, PBC (contact: privacy@anthropic.com)
    Country: United States / Outsourced tasks: chatbot response generation, AI schedule generation
    Timing and method: sent over an encrypted connection (HTTPS) each time you use the chatbot or AI schedule generation
    Items transferred: conversation content, parenting records, photos attached to a conversation
    Retention: until the purpose of the outsourcing is fulfilled (not used for model training; how long Anthropic separately keeps data follows Anthropic's policy)
  • Supabase, Inc. (contact: privacy@supabase.com)
    Country: India (Mumbai) / Outsourced tasks: storing logs of chatbot conversations, photo analyses and AI schedule generation (error checking and quality improvement)
    Timing and method: sent over an encrypted connection (HTTPS) each time you use an AI feature
    Items transferred: conversation content and the parenting records used in it (crisis-related expressions masked); photo analysis and AI schedule generation logs (baby's age in days, storage address of the analyzed photo, the questions, foods, skin area and concerns you entered, recent parenting records, AI results); user identifier
    Retention: until the purpose of outsourcing is achieved
  • Amazon Web Services, Inc. (contact: aws-korea-privacy@amazon.com)
    Country: United States / Outsourced tasks: operation of servers, databases and storage, and data retention
    Timing and method: sent over an encrypted connection (HTTPS) whenever you use the app
    Items transferred: personal information stored while using the service
    Retention: until membership withdrawal
  • Amplitude, Inc. (contact: privacy@amplitude.com)
    Country: United States / Outsourced tasks: usage analytics and product improvement
    Timing and method: sent over an encrypted connection (HTTPS) whenever you use the app
    Items transferred: user identifiers (email, login provider), app usage logs (screen and feature usage)
    Retention: until the purpose of the outsourcing is fulfilled (deletion requested on membership withdrawal)
  • Functional Software, Inc. (Sentry) (contact: compliance@sentry.io)
    Country: United States / Outsourced tasks: error monitoring
    Timing and method: sent over an encrypted connection (HTTPS) when an error occurs on our server
    Items transferred: device and app information at the time of an error, error logs
    Retention: up to 90 days
  • LangChain, Inc. (LangSmith) (contact: support@langchain.dev)
    Country: United States / Outsourced tasks: monitoring AI response quality
    Timing and method: sent over an encrypted connection (HTTPS) each time you use an AI feature
    Items transferred: AI request and response content (photo analysis, chatbot, reports and fortune; crisis-related expressions in the chatbot are masked), email and account number, storage address of the analyzed photo, the names, birth dates and times, and genders entered for a fortune (saju) reading
    Retention: until the purpose of the outsourcing is fulfilled

How to refuse the overseas transfer, and what happens if you do

  • Data goes to OpenAI, Google, Anthropic, Supabase and LangChain only when you use an AI feature (photo analysis, chatbot, reports, fortune, AI schedule generation and so on); Google also receives shared photos if you agreed to poop photo sharing. If you do not use AI features and keep photo sharing off (Settings > Privacy), nothing is transferred to these companies, and every other feature, such as records, keeps working.
  • AWS (servers and data storage), Amplitude (usage statistics) and Sentry (error monitoring) are processed whenever you use the app and cannot be switched off separately. If you do not want these transfers either, this is handled through More > Delete account (membership withdrawal), after which the service can no longer be used.
  • To have information that was already transferred deleted, or its processing stopped, email contact@bebesnap.com (see Sections 5 and 6).

5. Right to View, Correct, and Delete Personal Information

Data subjects may view, correct, or request deletion of their own or minor users' personal information at any time. If a data subject wishes to view, correct, or delete personal information, they may do so directly or contact the company's privacy officer and staff in writing or via email, and we will take action without delay. However, data subjects cannot request deletion if the personal information is specified as a collection target in other laws, and some or all services may be unavailable if personal information is corrected or deleted.

6. Right to Request Suspension of Personal Information Processing

Data subjects may request suspension of processing of their own or minor users' personal information at any time. If you wish to suspend personal information processing, contact the company's privacy officer and staff in writing or via email, and we will take action without delay. However, the company may continue to process personal information despite the user's request for suspension in accordance with relevant laws, and in such cases, we will notify the data subject without delay.

7. Right to Withdraw Consent for Collection, Use, and Provision of Personal Information

Data subjects may withdraw consent for collection, use, and provision of their own or minor users' personal information at any time. For this purpose, data subjects may proceed with the [membership withdrawal] process or contact the company's privacy officer and staff in writing or via email to request withdrawal. In such cases, the company will take necessary measures such as deletion of personal information after identity verification.

7-1. Withdrawal of Consent and Children's Personal Information

  • Users may withdraw consent for gallery photo sharing in Settings > Privacy. Withdrawing a required consent (collection and use of personal information, processing of health-related records) makes the service unusable, so that withdrawal is handled through More > Delete account (membership withdrawal).
  • A baby's information is provided and managed by the guardian as the legal representative, and the guardian may request access, correction or deletion at any time.

8. Personal Information Items Processed

Membership Registration (Partner Accounts)

  • Google: Email
  • Apple: Email
  • Kakao: Email
  • Naver: Email

9. Destruction of Personal Information

① The company destroys personal information without delay when personal information becomes unnecessary, such as when the retention period has elapsed or the processing purpose has been achieved.

② If personal information must continue to be retained in accordance with other laws even though the retention period consented to by the data subject has elapsed or the processing purpose has been achieved, the personal information is retained in accordance with the law.

③ The procedure and method for destroying personal information are as follows.

Destruction Procedure
Personal information for which collection and use purposes have been achieved is destroyed without delay, and if it must be retained in accordance with relevant laws, it is moved to a separate database and safely retained for a certain period (refer to processing and retention period of personal information) in compliance with internal regulations and relevant laws before being destroyed without delay. At this time, personal information moved to the database is not used for other purposes except as required by law.

Destruction Method
Personal information stored in electronic file format is deleted using technical methods that cannot reproduce the records, and personal information recorded or printed on paper is destroyed by shredding or incineration.

10. Measures to Ensure Safety of Personal Information

In processing users' personal information, the company is taking the following technical/managerial measures to ensure the safety of personal information so that personal information is not lost, stolen, leaked, forged, altered, or damaged.

  • Establishment and Implementation of Internal Management Plan: We establish and implement an internal management plan for personal information protection to safely process personal information.
  • Minimization and Education of Personal Information Handlers: We designate and manage personnel who handle personal information and conduct education for safe management of handling staff.
  • Access Restriction to Personal Information: We take necessary measures for access control to personal information by granting, changing, and revoking access rights to database systems that process personal information.
  • Retention of Access Records: We retain and manage records of access to personal information processing systems for at least 2 years.
  • Encryption of Personal Information: Personal information is safely stored and managed through encryption.
  • Installation of Security Programs and Periodic Inspection: We install security programs and conduct periodic inspections to prevent leakage and damage of personal information by hacking or computer viruses.

11. Privacy Officer and Privacy Violation Inquiries

① The company has designated a privacy department as follows to be responsible for overall personal information processing and to handle complaints and provide relief to data subjects related to personal information processing. If you have any questions regarding your personal information, please contact the privacy officer below.

Department: Data Center

Officer: Lee Yonghwan

Email: contact@bebesnap.com

② For other relief and consultation regarding privacy violations, you may contact the following organizations.

  • Personal Information Dispute Mediation Committee: (toll-free) 1833-6972 (www.kopico.go.kr)
  • Privacy Violation Report Center: (toll-free) 118 (privacy.kisa.or.kr)
  • Supreme Prosecutors' Office Cyber Investigation Division: (toll-free) 1301 (www.spo.go.kr)
  • National Police Agency Cyber Investigation Bureau: (toll-free) 182 (cyberbureau.police.go.kr)

12. Changes to Privacy Policy

The company's privacy policy may be changed according to changes in laws and guidelines and the company's terms and internal policies, and when revised, the company will disclose the revision through the company website or email in accordance with Article 30 of the Personal Information Protection Act and Article 31 of the Enforcement Decree of the same Act.

Posted: June 19, 2024

Last Modified: November 1, 2026

Effective Date: November 1, 2026