# Privacy Policy

> **Language / 언어** — This policy is available in Korean and English. The English version is a convenience translation; in case of any discrepancy, **the Korean version prevails**. / 본 처리방침은 한국어와 영어로 제공됩니다. 영문본은 이해를 돕기 위한 번역이며, 해석상 차이가 있는 경우 한국어본이 우선합니다. → [한국어](./README.md)

> **This revised policy takes effect on 4 August 2026.** The previous version is available as the [policy dated 17 May 2026](https://github.com/Project-KYRO/privacy-policy/blob/main/archive/privacy-2026-05-17.ko.md) (Korean). This revision is not a change unfavourable to members — it discloses payment processing that arises only for members who use the paid service, newly discloses cross-border transfers, and removes items that are not in fact collected — and therefore takes effect without delay, in members' interest. This revision discloses the processing of payment information following the introduction of in-app purchases (KYRO PRO), adds a cross-border transfer provision, and brings the collected-items and processor lists up to date. See the [Revision History](#17-revision-history) for details.

### 1. About This Privacy Policy

This Privacy Policy describes how Movement Lab Inc. (the "Company") collects, uses, stores, and destroys personal data in providing its service. It complies with the Personal Information Protection Act ("PIPA"), the Act on the Protection and Use of Location Information (the "Location Information Act"), and other applicable Korean data protection legislation. Terms not defined in this Policy have the meaning given to them in the Terms of Use.

### 2. Personal Data We Collect

The Company collects the minimum personal data necessary from among the following items in order to provide the service.

**1) Data collected at sign-up**

- Entered directly by the member during sign-up: nickname, date of birth, gender, height, weight
- Collected automatically on social sign-up (Kakao / Apple / Google / LINE): the email address, name (or nickname), profile image, and social identifier (such as a sub ID) that the social platform provides within the scope of the member's consent
- Provided optionally by the member: profile image, Instagram handle (displayed publicly on the member's profile)

The Company does not separately collect a member's legal name or mobile phone number during sign-up.

**2) Data collected through use of the service**

- Location data: GPS coordinates (latitude/longitude) and the time of positioning — collected in the background while a run is in progress.
- Physical characteristics and body measurements: weight, height
- Fitness activity data: distance, pace, duration, route, elevation, step count, heart rate, calories, and the like
- Images, photos, and video: run verification, record sharing, profile images

**3) Data collected separately when a challenge reward is claimed**

- Only where a member has applied to receive a challenge reward (such as a physical item), the Company collects the information required for delivery through a separate consent process: recipient's name, mobile phone number, postal code, and street address.
- This information is not used for any purpose other than delivering and confirming receipt of the reward, and is destroyed once the period necessary for handling related disputes has elapsed after delivery.

**4) Data collected automatically in the course of using the service**

- Device information: model name, operating system and version, app version, language setting, network carrier
- Identifiers: IP address, device identifier
- For sending notifications: push notification token (FCM)
- Usage logs: in-app events, screen navigation paths, crash (abnormal termination) reports

Depending on whether it is combined with other information and on how it is processed, automatically collected information may or may not constitute personal data. The Company may process it for the purposes of providing and improving the service.

**5) Data collected through third-party service integrations**

Where a member consents to linking an external service account, activity data provided by that service (distance, pace, duration, heart rate, calories, and the like), device information, and exercise/sleep summary data may be collected.

- Garmin Connect API
- Apple HealthKit (iOS)
- Google Fit / Health Connect (Android)

**6) Data collected when using the paid service (in-app purchases)**

Where a member purchases the paid service (KYRO PRO), the Company processes the following information in order to verify entitlement and to provide customer support.

- Store transaction identifier (transaction ID / order ID) and the product identifier purchased
- Date and time of purchase, renewal, expiry, and cancellation, and subscription status (free trial / active / cancelling / expired, and the like)
- Country and currency of payment, payment amount, and whether a refund was issued
- The platform on which payment was made (App Store / Google Play), app version, and device information
- The member identifier issued by the Company, used to link the above to the member's account

**The Company does not collect or store payment instrument information such as card numbers, account numbers, or payment passwords.** Payment and the processing of payment instrument information are carried out by Apple Inc. (App Store) or Google LLC (Google Play) in accordance with their respective privacy policies.

※ Individual items, or additional personal data and materials containing personal data, may be requested and collected through a separate consent process, for example in the course of user support or through in-service notification channels.

### 3. Purposes of Processing

Personal data collected is used only for the following purposes.

- Verifying intent to join or withdraw, and identifying and managing members
- Measuring, storing, and visualising location-based running records; calculating accumulated territory; providing rankings and statistics
- Providing platform features and any service or product the member requests
- Operating challenges and delivering rewards
- Providing the paid service, verifying entitlement (subscription status), and synchronising it across devices
- Processing payments, refunds, and withdrawals of subscription; responding to payment-related enquiries and disputes
- Sending notices about subscription status, such as an upcoming end of a free trial
- Communicating information about the Company's products, services, and events, and other promotional purposes (where advertising information is transmitted, separate consent is obtained under Article 14)
- Personalising the member's experience, the platform, and communications
- Operating, improving, and maintaining the Company's business, products, and services
- Protecting the rights, property, or safety of the Company or others
- General research and analysis purposes (pseudonymised or statistically processed)
- Complying with legal obligations
- Deriving statistics for member management, service operation, and maintenance
- Providing user-friendly services based on personal data and interests, and developing, maintaining, and improving existing and new systems

### 4. Additional Use and Provision of Personal Data

Taking into account the matters set out in Article 14(2) of the Enforcement Decree of PIPA, the Company may additionally use and provide personal data without the user's consent pursuant to Articles 15(3) and 17(4) of PIPA. In such cases, the Company considers the following.

⦁Whether it is related to the original purpose of collection  
⦁Whether it is foreseeable in light of the manner in which the personal data was collected or is processed  
⦁Whether it unfairly infringes the user's interests  
⦁Whether necessary measures such as pseudonymisation or encryption have been implemented

### 5. Retention and Use Periods

The Company processes and retains personal data in accordance with laws and regulations or as consented to by the member.

- **Location data and running records**: as the core data of this service, retained for as long as membership is maintained. Upon withdrawal of membership or withdrawal of consent, information that identifies the member (email address, social identifier, profile image, date of birth, gender, height, weight, and the like) and running records including GPS routes are destroyed without delay.
- **Territory that remains on the map after withdrawal**: the territory a member has taken is interlocked with the boundaries and rankings of other members' territories, so deleting it would alter those members' records as well. For that reason, the shape (area boundary) of a territory — and only that — is retained on the map after **its link to the member identifier has been severed so that no individual can be identified from it**. The original GPS route that produced the territory is destroyed under the preceding item, and the remaining shape alone cannot identify an individual, so it no longer constitutes personal data.
- **Records verifying the use and provision of location data**: retained for at least six months and then destroyed, pursuant to Article 16(2) of the Location Information Act.
- **Records relating to paid-service payments**: under the Act on Consumer Protection in Electronic Commerce, records of contracts and withdrawals of subscription, and records of payment and the supply of goods, are retained for five years. This statutory retention obligation applies regardless of whether the member has withdrawn from the service.
- **Other general personal data**: retained until withdrawal of membership, unless otherwise required by applicable law.

However, the Company may be required to retain information beyond that specified above in order to comply with legal obligations, including the following.

⦁Records of contracts or withdrawals of subscription: 5 years (Article 6(1) and (2) of the Enforcement Decree of the Act on Consumer Protection in Electronic Commerce)  
⦁Records of payment and supply of goods: 5 years (Article 6(1) and (3) of the same Enforcement Decree)  
⦁Records of consumer complaints or dispute handling: 3 years (Article 6(1) and (4) of the same Enforcement Decree)  
⦁Records of visits: 3 months (Article 15(2) of the Protection of Communications Secrets Act)  
⦁Records of labelling and advertising: 6 months (Article 6(1) of the same Enforcement Decree)  
⦁Records relating to an ongoing investigation or a violation of law: until the investigation is complete  
⦁Records of claims or obligations arising from use of the website: until the obligation is settled

### 6. Destruction Procedure and Method

The Company destroys personal data without delay once the purpose of its collection and use has been achieved, including upon withdrawal of membership or withdrawal of consent.
Where personal data must continue to be preserved under other legislation even though the consented retention period has elapsed or the processing purpose has been achieved, the Company transfers that personal data to a separate database or stores it in a different location.
Personal data for which grounds for destruction have arisen is destroyed without delay by a method that renders it irrecoverable. Personal data recorded and stored in electronic file form is destroyed so that the record cannot be reproduced; personal data recorded and stored on paper is shredded or incinerated.

However, the territory shape information that remains on the map after withdrawal under Article 5 is, in place of destruction, processed by severing its link to the member identifier and retaining the shape alone. This processing is irreversible; once carried out, the territory cannot be re-associated with any member by any means.

### 7. Processing of Personal Data of Children Under 14 and Under 8

The Company complies with the law and does not permit children below the statutory age limit (under 14) to register on the Company's platform without the consent of a legal representative.

In addition, pursuant to Article 26-2 of the Act on the Protection and Use of Location Information, the Company does not collect, use, or provide the location data of children aged 8 or under. This service is operated for members aged 14 and over.

### 8. Rights of Data Subjects and How to Exercise Them

Members may at any time view, correct, or delete their personal data, or withdraw consent to its processing by deleting their account, through [My Information] within the service, and may exercise rights of access, correction, deletion, suspension of processing, and withdrawal of consent.
The Company may refuse a member's request for access, correction, deletion, suspension of processing, or withdrawal of consent where there are special provisions in law or similar grounds. Members may object to such a refusal.
When a member exercises a data subject right, the Company verifies that the person making the request is the member themselves or a duly authorised legal representative.

**Rights of the personal location data subject (Article 24 of the Location Information Act)**

A personal location data subject may exercise the following rights in respect of their own personal location data.

- The right to withdraw, at any time, all or part of their consent to the collection, use, or provision of location data
- The right to require that the collection, use, or provision of location data be temporarily suspended
- The right to require access to, or notification of, the records verifying the collection, use, and provision of location data
- The right to require correction where their location data is inaccurate

These rights may be exercised through the contact details set out in Article 15 of this Policy.

### 9. Measures to Ensure Security

The Company takes the following measures to ensure the security of personal data.

- **Administrative measures**: establishment and implementation of an internal management plan, operation of a dedicated organisation, regular staff training, establishment of location data management guidelines
- **Technical measures**: access rights management for personal data processing systems, installation of access control systems, encryption of personal data (AES-256 at rest, TLS 1.3 in transit), automatic recording and preservation of access to the location information system, installation and updating of security programs
- **Physical measures**: physical access control at the cloud data centres that operate the location information system under entrustment (in compliance with the processor's security standards)

### 10. Processing of Location Data

This service constitutes a location-based service under the Act on the Protection and Use of Location Information. The Company processes location data as follows.

- **Purpose of collection and use**: measuring the member's own running records, visualising accumulated territory, providing rankings and statistics
- **Method of collection**: GPS coordinates are collected through the standard OS positioning APIs on the member's device (Apple Core Location / Google Geolocation Services), including in the background while a run is in progress.
- **Retention period**: retained for as long as membership is maintained; upon withdrawal of membership or withdrawal of consent, location data including GPS routes is destroyed without delay. For the treatment of territory shape information that remains on the map after withdrawal, see Articles 5 and 6. Records verifying the use and provision of location data are retained for at least six months and then destroyed, pursuant to Article 16(2) of the Location Information Act.
- **Provision to third parties**: the Company does not sell or provide members' location data to external businesses for advertising, marketing, or similar purposes.
- **Visibility to other members**: showing the route a member has run, and the territory generated from it, to other members is a core feature of this service. When saving a run, members can choose its visibility from **Public / Friends / Followers / Only me**; the default is Public. Runs saved as Public can be viewed, including their route and records, by other members. Members can change the visibility of a run at any time after saving it, and can block specific members.
- **Protection of start and finish points**: enabling [Hide start and finish points] under Settings › Privacy conceals the first and last 200 m of the route shown to other members. The full route is always shown to the member themselves. Please use this setting where a sensitive location such as your home lies at the start or end of your route.
- **Location data manager**: Ahn Jeongwoo (Chief Executive Officer) / support@kyro.team
- **Reporting location data infringements**: Korea Internet & Security Agency Privacy Infringement Report Centre (privacy.kisa.or.kr / 118) and the Korea Communications Commission (kcc.go.kr)

### 11. Entrustment of Personal Data Processing

The Company entrusts the processing of personal data as follows in order to provide and operate the service. In each entrustment agreement, the Company stipulates the matters necessary to ensure that personal data is managed securely, in accordance with Article 26 of PIPA.

| Processor | Entrusted work | Items processed |
|---|---|---|
| Supabase Inc. | Operation of the database, authentication, and file storage (managed PostgreSQL, Auth, Storage) | Member information, location data, body and activity data, images |
| Cloudflare, Inc. | API gateway, CDN, security (WAF, DDoS protection) | IP address, request logs |
| Google LLC (Firebase) | Push notification delivery, crash report analysis | FCM push token, device identifier, crash data |
| PostHog Inc. | User behaviour analytics (for app improvement) | Device identifier, usage event logs, screen navigation paths |
| Mapbox, Inc. | Map display and visualisation | Latitude/longitude coordinates |
| RevenueCat, Inc. | In-app purchase receipt validation and subscription state management | Member identifier, store transaction and subscription information, device and platform information |

Where the content of the entrusted work or the identity of a processor changes, the Company will disclose this through this Policy.

**Note on payment processing** — Payment for in-app purchases and the processing of payment instrument information are carried out **independently** by Apple Inc. (App Store) and Google LLC (Google Play) in accordance with their respective privacy policies. Neither company is a processor of the Company, and the Company does not receive payment instrument information from them.

### 12. Cross-Border Transfer of Personal Data

The Company entrusts the processing of personal data to the processors listed in Article 11. Because those processors' information processing facilities are located outside the Republic of Korea, personal data is transferred abroad. Pursuant to Article 28-8(1)(3) of PIPA, and to the extent that the transfer constitutes entrustment or storage necessary for the performance of a contract and for enhancing user convenience, the Company discloses the following through this Policy.

| Recipient | Country | Items transferred | Purpose | Time and method of transfer | Retention and use period |
|---|---|---|---|---|---|
| Supabase Inc. | United States | Member information, location data, body and activity data, images | Operation of database, authentication, and file storage | Transmitted over the network in encrypted form at the time of service use | Until termination of the entrustment agreement or the end of the period in Article 5 |
| Cloudflare, Inc. | United States | IP address, request logs | API gateway, CDN, security | Transmitted over the network in encrypted form at the time of service use | Until termination of the entrustment agreement |
| Google LLC | United States | FCM push token, device identifier, crash data | Push notification delivery, crash report analysis | Transmitted over the network in encrypted form when the event occurs | Until termination of the entrustment agreement |
| PostHog Inc. | United States | Device identifier, usage event logs, screen navigation paths | User behaviour analytics (for app improvement) | Transmitted over the network in encrypted form when the event occurs | Until termination of the entrustment agreement |
| Mapbox, Inc. | United States | Latitude/longitude coordinates | Map display and visualisation | Transmitted over the network in encrypted form when a map is requested | Until termination of the entrustment agreement |
| RevenueCat, Inc. | United States | Member identifier, store transaction and subscription information, device and platform information | In-app purchase receipt validation and subscription state management | Transmitted over the network in encrypted form at the time of purchase or renewal | Until termination of the entrustment agreement or the end of the period in Article 5 |

Members may refuse the cross-border transfer of their personal data. However, because these transfers are essential to providing the service, a member who refuses may stop the transfer by discontinuing use of the service through account deletion. A refusal may be communicated to the contact details in Article 15.

To protect personal data transferred abroad, the Company stipulates in its entrustment agreements the protective measures required by Article 28-8(4) of PIPA, including encryption in transit and at rest, access control, restrictions on sub-processing, and obligations to notify incidents.

### 13. Restriction on the Use of External and Third-Party AI Services

The Company does not share, provide, or otherwise make available any personal data it collects and retains under this Policy — including data collected through integrations with external services such as the Garmin Connect API — to external AI providers, third-party AI services, or external data processing services, nor allow such data to be processed or used by them.

The entrustment relationships set out in Article 11 do not constitute "third-party AI services or external data processing services" for the purposes of this provision. All processors handle personal data only within the specified scope of work and under the Company's direction and supervision.

**English Notice (Garmin Connect Developer Program Compliance)**

As required by the Garmin Connect Developer Program, data obtained via the Garmin Connect API is not shared with, processed by, or otherwise made available to any third party, including external AI providers, third-party AI services, or external data processing services. The same restriction applies to all personal information the Company collects and retains under this Privacy Policy. Service-provider relationships disclosed in Article 11 (data processing entrustment) are operated under the Company's direction and control and do not constitute third-party sharing under this provision.

> For a complete, dedicated disclosure of how data obtained through the Garmin Connect API is collected, used, processed, stored, and shared, see the **[Garmin Connect API — Data Disclosure](./garmin.html)** page.

### 14. Transmission of Advertising Information

Where the Company intends to transmit advertising information for commercial purposes to members, it obtains the member's prior consent pursuant to Article 50 of the Act on Promotion of Information and Communications Network Utilisation and Information Protection. A member who has consented may indicate a refusal to receive such information at any time, in which case the Company immediately ceases transmitting advertising information.

Informational messages necessary for operating the service and for handling transactions the member has requested (run completion notices, challenge progress notices, notices of changes to this Policy or the Terms, and the like) do not constitute advertising information and are sent without separate consent.

### 15. Department Responsible for Personal Data and Complaint Handling

The Company designates and operates a Chief Privacy Officer and a Location Data Manager as follows, for personal data protection work and the handling of data subject complaints.

- Chief Privacy Officer: Ahn Jeongwoo
- Location Data Manager: Ahn Jeongwoo
- Email: support@kyro.team

### 16. Changes to This Privacy Policy

The Company may revise this Privacy Policy to reflect government policy, applicable legislation, or changes to the service. In such cases, the Company will give notice of the changes through announcements at least 7 days in advance. Where there is a material change affecting members' rights (such as the addition of collected items, a change of processing purpose, or the addition of third-party provision), notice will be given at least 30 days in advance.

### 17. Revision History

| Version | Announced | Effective | Summary of changes |
|---|---|---|---|
| v1.0 | — | 27 April 2026 | Initial version |
| v1.1 | — | 17 May 2026 | Corrected company name (Movement Lab Inc.) and contact address (support@kyro.team); added a dedicated location data article (§10); disclosed entrustment of personal data processing (§11); specified automatically collected items; disclosed automatic collection on social sign-in; disclosed HealthKit/Google Fit integration; disclosed separate collection of challenge reward delivery information; added protection for children aged 8 and under; added a separate consent provision for advertising information (former §13) |
| v1.2 | 4 August 2026 | 4 August 2026 | Added processing of payment information following the introduction of in-app purchases (KYRO PRO) (§2-6); added paid-service, payment, and refund purposes (§3); specified the statutory retention period for payment records (§5); **added a cross-border transfer provision (§12)**; added RevenueCat, Inc. as a processor and clarified who processes store payments (§11); disclosed the visibility of location data to other members and the start/finish protection setting (§10); specified what is destroyed on withdrawal and how territory shape information is de-identified (§5, §6, §10); brought collected items up to date (added LINE sign-in and Instagram handle; removed legal name, mobile phone number, and country of residence, which are not in fact collected); published an English version; renumbered former §12–§16 as §13–§17 |

This Privacy Policy (v1.2) takes effect on 4 August 2026. The previous version (v1.1, effective 17 May 2026) is available [here](https://github.com/Project-KYRO/privacy-policy/blob/main/archive/privacy-2026-05-17.ko.md).