Privacy Policy

Effective Date: June 10, 2026

UKNONG ("Company") values your privacy and complies with applicable laws including the Personal Information Protection Act (PIPA) and the Act on Promotion of Information and Communications Network Utilization and Information Protection of the Republic of Korea. This policy describes what personal information we collect, how we use, store, and dispose of it, and how you can exercise your rights.

1. Information We Collect

1.1 Required Information

1.2 Authentication Security Information

1.3 Optional Information

1.4 Social Login Information

1.5 Music Service Information

• Music usage data (play history, favorites, playlists, artist follows)
• Device information (device name, device type, platform info, playback state)
• Spotify Client ID (if provided by the user)

1.6 Mail Service Information

• Email content, subject lines, and sender/recipient addresses
• Attachments
• Contacts (automatically collected based on send/receive frequency)
• Mail aliases, filter rules, reply templates, and other user settings
• Read receipt requests and responses
• External email account connection details (IMAP/SMTP server addresses, encrypted credentials)
• Large attachments (files uploaded via link sharing)

1.7 Automatically Collected Information (Service Analytics)

We operate a first-party web analytics system to improve service quality and detect abnormal access. The following data is collected automatically on all pages we operate, including this policy page:

• IP address (irreversibly hashed when stored; original IP is not retained)
• Visited URL (path) and previous page hostname (Referrer)
• Country code (derived from Cloudflare header; raw IP not stored)
• Browser type and version, operating system, device type (mobile/tablet/PC), screen width
• Anonymous visitor identifier (random string stored in the browser, automatically expiring after a certain period or at the end of the session)
• Access timestamp, page activity signals
• Language preference

We honor user opt-out signals such as Do Not Track (DNT) to a reasonable extent.

1.8 Security and Audit Logs

• Login session records: IP address, User-Agent, country code (for abuse detection and session management)
• Access records to the personal information processing system, as required by Article 48-3 of the Information and Communications Network Act and Article 58-2 of its Enforcement Decree
• Administrator activity audit logs: actions taken, IP, User-Agent, and details

1.9 Paid (Payment) Service Information

Full payment credentials such as card numbers are handled by the payment gateway (PG); the Company does not retain them.

1.10 Customer Support Information

• Inquiry subject, content, and any materials you attach
• Reply email address
• Live chat and AI assistant conversation content
• Inquiry handling records (receipt, responses, status change history)

2. Purpose of Use

• Authentication and account management — Login, identity verification, email verification, age verification (14+)
• Service delivery — Lyrics search, play history storage, email sending/receiving/storage/display/search, personalization
• Security — Fraud prevention, abnormal access detection, two-factor authentication, spam/phishing/malware blocking
• Service improvement — Usage statistics analysis (de-identified)
• Legal compliance and dispute resolution — Performance of statutory obligations, retention of evidence for potential disputes

3. Sharing with Third Parties

We do not share your personal information with third parties except in the following cases:

• Google, Apple — During social login, information you choose to share is exchanged between the provider and us for authentication purposes.
• Lawful requests from law enforcement agencies, courts, or administrative authorities under applicable legal procedures.

4. Data Processing Delegation

We delegate the following data processing tasks to operate the Service:

We perform supervision of the delegates as required under Article 26 of PIPA.

4-1. International Data Transfers

For some of the above delegated processing, we transfer personal information outside the Republic of Korea in accordance with Article 28-8 of PIPA:

You have the right to refuse international transfers; however, refusal may restrict registration, system email delivery, and other parts of the Service. You may exercise this right by deleting your account. Transfers to Xiaomi occur only when you directly run the mail translation/summary or AI assistant features, so you may also refuse them simply by not using those features.

4-2. External Services You Connect

If you connect an external email account (IMAP/SMTP) to the Mail Service or provide a Spotify Client ID to the Music Service, we access the relevant external service on your instruction to retrieve mail or playback data. The choice of external provider is yours, and the provider's own terms and privacy policy apply separately. Credentials for external accounts are encrypted using a key we maintain and are deleted without undue delay upon disconnection. Residual copies retained for technical reasons such as backups will be destroyed within a reasonable period.

5. Cookies

We use cookies for the following purposes:

• Essential cookies — Maintain your login session (access_token, refresh_token) and CSRF protection tokens. They use HttpOnly, Secure, and SameSite attributes for security and are required for the Service to function.
• Preference cookies — Store your language, display mode, and other UI preferences.

We currently do not use third-party advertising cookies. If we adopt third-party analytics or advertising tools in the future, we will update this policy in advance and obtain any required consent. You can disable cookies in your browser settings, but doing so may prevent login or limit certain features. Session cookies automatically expire after a defined period, which may be adjusted in accordance with our security policy.

6. Data Retention and Deletion

• Account information — Deleted without undue delay upon account deletion
• Session data — Automatically deleted upon expiry
• Email verification codes — Deleted without undue delay after use or expiry
• Music usage data (play history, favorites, playlists, device info) — Deleted upon account deletion. Device info may be automatically removed after a period of inactivity.
• Withdrawn account records — Retained for a reasonable period to prevent re-registration abuse and address misconduct, then deleted
• Mail data — All emails, attachments, and contacts deleted upon account deletion
• Authentication security data (Passkeys, 2FA secrets, backup codes) — Deleted without undue delay upon account deletion; individually removed when disabled
• External email account data — Deleted without undue delay upon disconnection or account deletion
• General audit logs (settings, admin actions) — Retained for a reasonable period for operational and security analysis, then automatically deleted
• Access records to the personal information processing system — Retained for at least one year as required by Article 48-3 of the Information and Communications Network Act and Article 58-2 of its Enforcement Decree. The period extends to two years when the Service handles personal information of 50,000 or more users.
• System email sending logs — Sending metadata (type, provider, success status) is retained for a reasonable period for operational and debugging purposes, then automatically deleted. Recipient addresses are processed only to the extent necessary for delivery failure handling and retries, and are destroyed under the same standard.
• Customer support inquiries and chat records — Retained for a reasonable period for inquiry handling and dispute resolution, then deleted; also deleted upon account deletion.

Where retention is required by applicable law, data will be stored separately for the required period and then destroyed. Commitments in this section to delete data "without undue delay" or "automatically" include destruction within a reasonable period for technical reasons such as residual backup copies or delegates' processing schedules.

Deletion Methods

• Electronic files — Permanently deleted using irreversible methods
• Database records — SQL DELETE followed by automatic cleanup
• Attachments — Completely removed from the server file system

7. Right to Refuse Consent

You have the right to refuse consent to the collection and use of your personal information. However, if you refuse consent for required items, registration and use of the Service may be restricted.

8. Your Rights

You may exercise the following rights:

• Access — Request to view your personal information
• Correction — Modify your profile information such as display name
• Deletion — Delete all personal information by deleting your account
• Withdrawal — Delete your account at any time from the Service settings
• Consent withdrawal — Withdraw consent to data collection, use, and international transfers at any time (exercised by deleting your account)
• Suspension of processing — Demand suspension of processing under Article 37 of PIPA

To exercise these rights, use the in-service settings or contact us at [email protected].

9. Children's Privacy

Our Service is not directed to children under the age of 14. During registration, users self-confirm that they are 14 or older; registration is blocked when the user is identified as under 14. We do not knowingly collect personal information from children under 14.

If we learn that personal information of a child under 14 has been collected without the consent of a parent or legal guardian, we will delete such information without delay and notify the result. Parents or legal guardians who become aware of such collection may report it to [email protected].

10. Security Measures

• Passwords are converted using an industry-standard one-way hashing algorithm for storage
• All communications are transmitted over encrypted connections (HTTPS/TLS)
• Authentication data and external account credentials are encrypted at rest with a separate key
• Mail data is stored on our servers and accessible only by the account owner
• Server access is restricted under the principle of least privilege with strong authentication
• Network- and application-layer protections are in place against external attacks
• Administrator activity is recorded through audit logs

11. Data Breach Notification

If a personal information breach occurs, we will notify affected users without delay upon becoming aware of the incident, in accordance with Article 34 of PIPA, and report to the Personal Information Protection Commission or the Korea Internet & Security Agency (KISA) where required.

12. Data Protection Officer and Dispute Resolution

We have designated a Data Protection Officer responsible for overseeing personal information processing and for handling user complaints and remedies.

• Role: UKNONG Representative (Data Protection Officer and dispute handling)
• Email: [email protected]
• Response Standards: We respond and resolve inquiries within a reasonable period and comply with any timelines specified by applicable laws, including PIPA.

For privacy-related complaints or assistance, you may contact the following authorities:

• Personal Information Dispute Mediation Committee (kopico.go.kr, +82-1833-6972)
• Personal Information Infringement Report Center (privacy.kisa.or.kr, 118)
• Supreme Prosecutors' Office Cyber Investigation Division (spo.go.kr, +82-2-3480-3573)
• Korean National Police Cyber Investigation Bureau (ecrm.police.go.kr, 182)

13. Contact

• General inquiries: [email protected]
• Privacy: [email protected]
• Website: uknong.com

14. Changes to This Policy

This policy is effective on the date shown above. If we make changes, we will post the updated policy on this page. For changes that are adverse to users, we will provide notice at least 30 days before the effective date through at least one of the following methods, as the Company may select: in-service notification or email sent to the address associated with your account.