Gounnal Privacy Policy

Effective date: September 26, 2026

Gounnal (Representative: Hyunseo Lee; “we,” “us,” or “our”) processes the personal information of people who use the Gounnal app (“you”) as described in this Privacy Policy. This policy also applies when you store records on your device without signing in. Processing through third-party services takes place when you use the related features.

If you live in Washington or Nevada, or your consumer health data is collected in either state, our Consumer Health Data Privacy Policy also applies to you.

1. Purposes, Information Processed, and Retention Periods

• Records, calendar, notifications, and profile: Information you enter, including your name or nickname, date of birth, treatments of interest, and profile photo; treatment details (treatment name, date, treated area, dosage, cost, clinic, notes, photos, and tags); and period start and end dates and expected period dates. This information is stored on your device and processed until you delete it or delete the app’s data.

• Social sign-in and backup/restore (optional): Your Apple, Google, or Kakao account identifier; the email address, name, and profile information you agree to share; and the records, photos, categories, and profile described above. When you sign in, this information is automatically backed up to and synced with Supabase, and it is kept until you request account deletion or delete all your data. We do not collect your social sign-in passwords.

• AI features (optional): What you enter in AI chat and any earlier messages needed for context; the parts of your treatment records included in a request (such as treatment name, date, area, notes, and tags); and your age and treatments of interest. We use this information to generate responses, suggest your next treatment, check intervals between treatments, and analyze tags. If you decline or withdraw the separate consent for this feature, this information is not sent. Your AI chat history is encrypted and stored on your device and is not included in cloud backups. The content of your requests is sent to Anthropic to generate responses.

• Clinic search (optional): The clinic search terms you enter are passed to the NAVER Search API through a Supabase server function for as long as needed to provide search results. We do not store your search terms in our database.

• Advertising: Clinic ads that we run directly are displayed at random. To measure campaign performance, we record in Supabase the campaign ID, whether each ad was shown or clicked, and a persistent random identifier generated on your device. We do not link this identifier to your signed-in account or use it to target ads based on your treatment records or photos. We use Google AdMob for rewarded ads. The AdMob SDK may process your IP address (which can be used to estimate your approximate location), device identifiers, ad impressions and interactions, and crash and performance data to deliver, measure, and diagnose ads.

• Subscriptions: We verify Apple App Store payment results, subscription status, purchase history, and your app user ID through RevenueCat to provide premium access. We do not receive your payment card number.

• Inquiries and security: The email address and message content you send when you contact us, and authentication, access, and error information generated while you use the service. We process this information for as long as needed to handle inquiries, prevent fraud and abuse, and respond to service outages. If the law requires us to retain certain information, we keep it separately for the required period.

Treatment details, skin condition, menstrual cycle information, and photos may include sensitive information about your health. Entering this information is optional. If you use cloud backup after signing in, or use AI analysis, it is transferred off your device to the extent necessary.

Before you save a treatment or period record for the first time, we ask for your separate consent to the processing of health-related information. If you do not consent, those records are not saved. Sending information to AI features requires a further, separate choice.

2. How We Collect Information and Your Choices

We collect information when you enter it directly in the app or select photos, and we receive information from social sign-in providers within the scope you agree to. Related information is also generated automatically when advertising and security features are used.

Social sign-in, sending information to AI features, adding photos, and recording your menstrual cycle are all optional. If you do not sign in, you cannot use cloud backup and restore. If you decline or withdraw your AI data transfer consent, you cannot use AI features. You can change your AI data transfer consent in Settings.

3. On-Device Storage and Cloud Sync

Before you sign in, your profile and records are stored on your device by default. However, when you use online features such as AI, search, or ads, data needed to provide those services may be transmitted.

When you sign in, your profile, treatment records and photos, menstrual cycle data, and categories are automatically backed up to Supabase. If you sign in with the same account on another device, the data on that device is merged with your cloud data. None of your AI conversations are backed up to the cloud. Deleting the app alone does not delete your cloud account or backups.

4. Third-Party Services, Processors, and Disclosure to Third Parties

We use the following services to operate Gounnal. Supabase and Anthropic are external services that process data on our instructions. Social sign-in, advertising, and search providers may process related information under their own policies.

• Supabase, Inc.: Authentication, database, private photo storage, server functions, and backup and restore.

• Anthropic, PBC: Generating responses to AI requests you have separately consented to.

• Google LLC: Google sign-in, and delivery and measurement of AdMob ads. Even for non-personalized ad requests, identifiers may be used for purposes such as frequency capping and aggregated reporting.

• RevenueCat, Inc.: Subscription status verification, purchase restoration, and premium access management. RevenueCat processes your app user ID and purchase history.

• Apple Inc. and Kakao Corp.: The social sign-in you choose. Subscription payments are processed by the Apple App Store, and we do not receive your payment card number or Apple Account password.

• NAVER search service provider: Providing results for the clinic searches you request.

• Direct advertisers: We count ad impressions and clicks ourselves. We do not provide advertisers with any individual’s records or health information.

Beyond the purposes described above, we do not provide your treatment records, period records, or photos to advertisers, and we do not sell them. Where a disclosure is based on law or on your separate consent, we follow the applicable scope and procedures.

5. International Transfers

After you give separate consent for AI features, the content of your AI requests and the necessary treatment and profile information are sent over HTTPS to Anthropic, PBC in the United States, where they are used to generate responses. This information is sent each time you use an AI feature. If you turn off your AI data transfer consent, further transfers stop, and you can continue to use non-AI features.

As a general rule, Anthropic API inputs and outputs are deleted within 30 days of receipt or generation, subject to exceptions for safety review, legal obligations, or separate agreements. Inquiries: https://privacy.claude.com/

Supabase processes personal information for account authentication, cloud backup and restore, and private photo storage. The information is kept while your account is in use, and the deletion process begins when you request deletion. Our Supabase project’s primary database region is Singapore, and the specific regions through which photos are stored and transmitted may vary depending on the service configuration.

The locations and retention periods of international processing involved in Apple, Google, and Kakao sign-in, Google AdMob ads, and RevenueCat subscription verification follow each provider’s service configuration and policies. You may email us for details or to ask us to stop processing. Depending on the feature, this may limit your ability to sign in, watch ads, or use subscription benefits.

6. Retention and Deletion

We delete personal information without delay once the purpose of processing has been fulfilled or the retention period has expired. Electronic files are deleted using methods that make them difficult to recover, and any paper printouts are shredded. Information that must be retained by law is kept separate from other information for the required period only and then deleted.

If you use “Delete All Data” while signed in, the account deletion process begins and your cloud records and photos are deleted. If a failure message appears, you can email us to confirm whether deletion has been completed. The retention and deletion of data held independently by third-party services are governed by those providers’ policies and agreements.

7. Rights of Users and Legal Representatives

You can view, correct, and delete your profile and records in the app, and you can withdraw your AI data transfer consent in Settings. You may also email the Privacy Officer at the address below to request access to, correction or deletion of, or suspension of processing of your personal information, to withdraw consent, or to delete your account. We will verify your identity and handle your request in accordance with applicable law; if a legal restriction applies, we will tell you why.

The app is not directed to children under 14. If we need to process the personal information of a child under 14, we will put the necessary procedures in place, such as obtaining the consent of a parent or legal guardian.

8. Security Measures

We apply safeguards including encryption in transit (HTTPS), per-account data access controls, private storage paths for photos, on-device encryption of AI conversations, and separate storage of server secret keys. We also review the settings and access permissions of the third-party services we use. No method of transmission or storage can guarantee absolute security.

9. Automatic Data Collection, Behavioral Information, and Ad Choices

Our direct ads are displayed at random, and we use an identifier generated on your device to count impressions and clicks for each campaign. AdMob rewarded ad requests in the app are set to non-personalized ads. Even so, mobile identifiers may be used with non-personalized ads for frequency capping and aggregated reporting.

The Google Mobile Ads SDK may process IP addresses, device identifiers, ad impression and interaction information, and diagnostic and performance information to deliver ads, measure performance, and prevent fraud. We do not use your treatment records, period records, or photos to target ads.

How we respond to Do Not Track signals: Some browsers and devices can send a “Do Not Track” (DNT) signal. Because there is no common standard for responding to these signals, we do not currently respond to them. As described above, third parties such as Google may collect information about your device and your interactions with ads over time and across different apps and websites when you use the app.

10. Privacy Officer and Remedies

• Business name: Gounnal

• Representative and Privacy Officer: Hyunseo Lee

• Business registration no. (Korea): 674-15-02841

• Address: 246-1103, 1218 Yangjae-daero, Songpa-gu, Seoul, Republic of Korea

• Phone: +82-10-5027-0608

• Email: gounnal.app@gmail.com

Requests to access your personal information and complaints can also be sent to the email address above. If you need help resolving a dispute or reporting a privacy violation, you may contact the following authorities in Korea: the Personal Information Infringement Report Center (118), the Personal Information Dispute Mediation Committee (1833-6972), the Supreme Prosecutors’ Office (1301), and the Korean National Police Agency (182).

If you are in Canada, you may also contact the Office of the Privacy Commissioner of Canada (www.priv.gc.ca, toll-free 1-800-282-1376). If you live in Quebec, you may also contact the Commission d’accès à l’information du Québec (www.cai.gouv.qc.ca, toll-free 1-888-528-7741).

11. Changes to This Policy

Before any material change takes effect, we will announce its effective date and details in the app or on our public web page. We also keep previous versions of this policy available for review.

Effective date: September 26, 2026