The operator of Onelings (the "Service") collects only the personal information it needs, uses it only for the purposes stated here, and deletes it when it is no longer needed. This policy explains what we collect, why, and when we delete it.
1. What we collect and why
| Category | What we collect | Why | How long we keep it |
|---|---|---|---|
| Account | Account number (created by the Service), nickname, sign-up time, the versions of the Terms and Privacy Policy you agreed to and when, the time we confirmed you are 14 or older | Identify members, check sign-up age, keep consent records | Until you delete your account (see section 5) |
| Google sign-in | Your Google account's unique ID | Sign-in | Deleted immediately when you delete your account |
| Email sign-in | Email address | Sign-in, sending sign-in codes | Deleted immediately when you delete your account |
| Email code records | Email address, a check value of the code (not the code itself), number of wrong tries | Verify sign-in codes, prevent repeated requests | 24 hours after sending |
| Sign-in sessions | A check value of the session (not the session itself), created / last used / expiry times | Keep you signed in | Deleted on sign-out or expiry (30 days), and immediately when you delete your account |
| Devices for notifications | Device notification address (FCM token), device type (Android, iOS), app language, device time zone | Send push notifications, avoid sending at night (22:00–08:00 device time) | Deleted on sign-out, immediately when you delete your account, or when we learn the app was removed |
| Devices used | A random value the app creates when it is installed (stored on our servers only as a hash), when it was first and last used | Prevent vote fraud using several accounts on one device | Until you delete your account (see section 5) |
| Uploaded drawings and characters | Original image, working image, small preview image, character name, joint data, a check value (hash) and upload time for proof of originality, a value for finding similar drawings | Create and show characters, contests, proof of originality and copying disputes, moderation | Until you delete your account (see section 5) |
| Activity records | Care records, contest entry and vote records, records of notifications sent, coins earned and spent (including check-ins, missions and lucky draws), mini game scores, items bought in the shop, how you decorated your room, when you turned on sharing | Provide the Service, prevent vote fraud, improve the Service | Until you delete your account (see section 5) |
| Reports | Reporter (account number), reported drawing, reason, note | Handle reports, prevent duplicate reports of the same drawing | Until you delete your account (see section 5) |
| Moderation and restriction records | Drawing review results (similar drawings, number of reports), the operator's decisions and notes, suspension period and reason | Respond to policy violations, handle appeals | Until you delete your account (see section 5) |
| Notices | Report results, notices that a drawing was hidden or shown again, suspension and lifting notices (with the character name, reason and period), time read | Telling reporters and uploaders what we found and what we did | 180 days after the notice (after you leave, see section 5) |
| Inquiries | Your email address and message | Answer your inquiry | 3 years after we answer |
- What we don't collect: the email, name, or photo of your Google account; your birth year and month (used only to check that you are 14 or older at sign-up, never stored); advertising IDs; location; contacts.
- Photo location data: when you upload a photo, we remove the location and device information stored in the file (EXIF, etc.) before saving it.
- Sharing: when you tap Share on a character, anyone with the link can see that character's drawing and name and your nickname on the web. You can stop at any time with Drawing info → Stop sharing, and the link stops working. The contest page on the web does not show other people's drawings or nicknames.
- Finding similar drawings: if an uploaded drawing is almost the same as someone else's, the operator reviews it (possible copying). Accounts are suspended only after the operator reviews them in person.
- Server access logs: to protect the servers and fix problems, IP addresses, times, and requested addresses may be recorded in server logs. They are deleted after 3 months.
2. Children
You must be 14 or older to use the Service. At sign-up we check your birth year and month, and if you are under 14 we delete the account immediately. To stop sign-up from the same device for 24 hours, we keep a note only on that device (it is not sent to our servers). If we learn that we hold personal information of a child under 14, we delete it immediately. The Service is not directed to children under 13.
3. Sharing with others
We do not give your personal information to other companies or people, except where a law specifically requires it or an investigative authority requests it through legal procedures.
4. Service providers and international transfers
We use the following company to provide the Service.
| Recipient | Task | Information transferred | Country | When and how | Retention |
|---|---|---|---|---|---|
| Google LLC (Firebase Cloud Messaging) | Delivering push notifications | Device notification address (FCM token), notification content (including character names) | United States | Each time a notification is sent, over an encrypted network | As long as needed to deliver notifications (per Google's policy) |
- Our server hosting and email delivery providers are not decided yet. We will list them here before the Service launches.
- If you don't want your information transferred for push notifications, sign out of the app (this deletes your device information) or contact us. You will not receive push notifications.
- For Google sign-in, we receive only your Google account's unique ID from the sign-in that Google confirms. We do not send your information to Google.
5. Deletion
- We delete information without delay when its retention period ends or it is no longer needed, in a way that cannot be recovered.
- When you delete your account, we immediately delete your sign-in methods (Google account ID, email address), sign-in sessions, and device information. Your nickname is deleted and your characters are hidden from others right away. Entries in contests whose results are not out yet are withdrawn.
- Remaining drawings and activity records are permanently deleted 30 days after you delete your account. During those 30 days they are used only to handle copying reports or abuse investigations, and they may remain in already published contest rankings without your name.
- Information we must keep by law is stored separately for the required period and then deleted.
- Korea's Protection of Communications Secrets Act: sign-in records, 3 months
- After paid features launch, Korea's E-Commerce Act: contract and payment records, 5 years; consumer complaint and dispute records, 3 years
6. Your rights
- You can ask to see, correct, or delete your personal information, or to stop its processing, at any time.
- In the app: change your nickname, see your sign-in methods, and delete your account on the Account screen.
- If you can't use the app, you can sign in on the web's Delete account page and delete your account there.
- For anything else, email us at the address below. You may also act through a representative. We will respond within 10 days.
7. How we protect your information
- We never store sign-in sessions or sign-in codes as they are; we store only check values that cannot be reversed.
- When the Service launches, traffic between the app/web and our servers will be encrypted (HTTPS).
- We keep the number of people who handle personal information to a minimum and manage access to operating tools.
- We remove location and device information from uploaded photos.
8. Cookies and similar technologies
- The app does not collect advertising IDs and does not use analytics tools.
- The website uses only essential cookies: your chosen language (1 year) and the sign-in state on the Delete account page (30 minutes).
- You can block cookies in your browser settings. If you do, you can't sign in on the web's Delete account page, so please delete your account in the app.
9. Privacy officer and contact
- Privacy officer: (to be decided)
- Contact: support@onelings.com
10. Users outside Korea
The Service is available in Korea, the United States, and the Philippines. This policy applies the same wherever you are, and you can exercise the rights given by the law where you live (for example, your rights under the Philippine Data Privacy Act of 2012) using the methods in section 6. Users in the Philippines may also file a complaint with the National Privacy Commission (privacy.gov.ph). We do not sell your personal information, and we do not share it for targeted advertising.
11. Changes to this policy
If we change this policy, we will announce it in the app and on the website 7 days in advance (30 days in advance for changes that are unfavorable to you or significant).
- Version: 2026-11-14-draft4 (draft)
- Effective date: to be set when the Service launches