Privacy Policy

Effective date: September 1, 2026

This English text is a translation provided for convenience. In the event of any discrepancy between this translation and the Korean original, the Korean version prevails.

Sumbi carries no ads, does not track you, and collects only the minimum information needed to run the service. When you delete your account, all of your data is destroyed immediately.

niceday Inc. (the "Company") complies with applicable laws including the Personal Information Protection Act of the Republic of Korea, and processes users' personal information as follows.

1. Information We Collect and How

Category	Items	Method
Account information (required)	Social sign-in identifier, email address, nickname	Upon Apple, Google, or Kakao social sign-in
Service usage records (automatic)	Dive records (start time, set duration, breathing-room setting, result), My Ocean and encyclopedia composition, buddy connection	Generated in the course of using the service
Purchase information (where applicable)	In-app purchase history (product, date and time), store transaction identifier	Upon App Store / Google Play payment
Device information (automatic)	Device model, OS version, app version, push token	Generated in the course of using the service

The Company does not collect location, contacts, photos, or call content. To judge a dive, we only check whether the app is in the foreground or background; we do not collect which apps you used during a dive.

2. Purposes of Processing

Identifying members, sign-in, and restoring data when changing devices
Judging dives (based on server time) and providing core features such as dive records and My Ocean
Providing paid products (non-consumable creature invitations) and restoring purchases
Sending notifications the user has enabled (dive results, buddy news)
Checking service errors, improving quality, and fulfilling legal obligations

The Company does not process personal information for advertising, marketing, or behavioral tracking purposes.

3. Retention and Use Period

Personal information is destroyed immediately upon membership withdrawal (account deletion). All data including My Ocean, dive records, and purchased creatures is deleted and cannot be recovered.
However, information that must be retained under applicable laws is stored separately for the required period and then destroyed:
- Records on contracts or withdrawal of offers: 5 years (E-Commerce Act of Korea)
- Records on payment and supply of goods: 5 years (E-Commerce Act of Korea)
- Records on consumer complaints or dispute resolution: 3 years (E-Commerce Act of Korea)

4. Provision to Third Parties

The Company does not provide users' personal information to third parties, except where the user has given prior consent or where required by law.

5. Outsourcing of Processing

Processor	Outsourced work
Amazon Web Services / Supabase	Data storage and server operation
Apple Inc. / Google LLC / Kakao Corp.	Social sign-in authentication, in-app payment processing, push notification delivery

The Company does not transfer users' personal information overseas. All data is stored and processed on servers located in the Republic of Korea (Seoul region).

If the Company ever entrusts processing to an overseas provider, the details (destination country, items transferred, retention period, etc.) will be specifically disclosed in this section in advance.

6. Destruction Procedure and Method

Personal information whose retention period has expired or whose processing purpose has been achieved is destroyed without delay. Electronic files are deleted using technical methods that make recovery impossible.

7. Your Rights and How to Exercise Them

You may view and correct your personal information at any time, and may withdraw consent to collection and use (delete your account) via [Settings > Delete Account] in the app.
You may also exercise your rights by email (sumbi@niceday.io), and the Company will act without delay.
A legal guardian may exercise rights regarding the personal information of a child under 14. However, Sumbi does not accept sign-ups from children under 14.

8. Cookies and Automatic Collection Tools

The website (sumbi.app) uses Google Analytics and PostHog to understand how the service is used, and cookies may be collected in the process. The collected information is used for visit statistics only and is not used for advertising. You can refuse cookies in your browser settings. The app does not use advertising identifiers or third-party advertising SDKs.

9. Security Measures

Encryption of personal information in transit (TLS) and access control for stored data
Minimizing personnel handling personal information and managing access privileges
Technical protection through security programs

10. Privacy Officer

Item	Details
Privacy Officer	Hyunwoo Lim
Contact	sumbi@niceday.io

For reports or consultation regarding privacy infringements in Korea, you may also contact the Personal Information Infringement Report Center (privacy.kisa.or.kr, dial 118) or the Personal Information Dispute Mediation Committee (kopico.go.kr, +82-1833-6972).

11. Changes to This Policy

If this policy is amended, we will announce the changes on the website and within the service at least 7 days before they take effect.