SIDEY Privacy Policy

SIDEY follows applicable privacy law and handles only the information needed to provide and improve friend Groups and messaging. This Policy explains what is handled, why it is needed, when it is deleted, and how you can exercise your rights.

1. Why personal information is handled

The Operator handles personal information only as needed for the purposes below. If a purpose changes, the Operator will obtain separate consent or take another step required under Article 18 of Korea’s Personal Information Protection Act and other applicable law.

Providing the Service and performing contracts

Information is used to authenticate Accounts and restore sessions; create and join invite-only Groups; show a friend’s presence; send messages; provide characters and customization items; and verify, restore, or refund purchases.

Managing users and the Service

Information is used to identify users, enforce Group capacity and usage limits, prevent misuse, maintain security, respond to errors, questions, and disputes, and deliver service notices.

Product usage analysis and service improvement

For signed-in Mac users who choose to share usage statistics, SIDEY analyzes total usage time and changes to Quiet Mode and character sound settings, linked to their account. This helps us understand feature use and how setting combinations affect the experience so we can improve the product. We do not combine this information with activity in other companies’ apps or websites to track users or use it for advertising.

SIDEY does not handle personal information for interest-based advertising, personalized recommendations, or promotional messages.

2. Information handled

Elapsed time since the last system input and screen-lock state are checked locally to show away status. The Mac app uses this determination to total present time on the device, but does not send raw input-idle durations or a history of state changes to the analytics server. It does not collect input contents or a history of other apps’ use.

3. How information is collected

Information is collected when you create a profile or group, send a message, choose Google account linking or Sign in with Apple, or request payment, restoration, refund or support. Online status, typing signals and character interaction information are processed while you use the service. Authentication and data delivery for Firebase realtime services can occur regardless of whether you link a Google account.

Mac app usage analysis is off by default and runs only after you turn on Share usage statistics in settings for the signed-in account. Each account requires a separate choice, and this collection does not apply to the Windows app. You can turn it off at any time to stop collection on that device and delete that account’s unsent analytics records there. You can use the service without sharing statistics. Records already sent to the server follow the retention and deletion rules in Section 4.

Time is totaled on the device, and a summary is created when the app exits, you sign out or switch accounts, or a long-running usage period is split. It is sent when consent, sign-in status for the same account and connectivity permit. After an unexpected exit or connection failure, records remaining on the device may be sent when you next sign in to the same account. Quiet Mode and character sound changes are recorded only when their values actually change. Periodic raw status records, the key contents or coordinates of individual actions, and message or photo contents are not included in usage analytics.

Photos are processed only when you choose to attach and send them by pasting, dropping a file or using the photo picker. Before upload, your device resizes and converts the photo to JPEG and removes original metadata such as location and camera information. The converted image and thumbnail are uploaded; the original file itself is not.

SIDEY does not automatically collect screen contents, lists of active apps, keys pressed in other apps, global pointer coordinates, microphone audio or camera video. It does not collect file contents except for photos you choose to send or information you attach to a support inquiry. It does not inspect what you type outside the SIDEY message field.

4. Retention

Firebase authentication identifiers and the minimum identifiers needed to record deletion and block access are not immediately removed by deleting a SIDEY account or group. They remain until the Operator deletes the corresponding Firebase information. You can request deletion through the privacy contact in Section 12. Service providers apply their own retention and deletion rules to connection records and backups.

Records that must be retained by law are used only for that purpose. Display and advertising records may be kept for six months; contract or cancellation records and payment or digital-delivery records for five years; and consumer complaint or dispute records for three years.

5. Sharing and third-party disclosure

The Operator does not disclose personal information to a third party unless you consent or applicable law provides a specific basis.

Members of the same Group

To provide invite-only groups, your nickname, character, online and typing status, character interactions and sent messages are shown to members of the same group you joined. Photos are stored privately and can be accessed only by current members of that group with a valid signed-in session. Retention and cleanup of messages, including photos, and realtime information follow Section 4.

Mac app usage summaries and setting-change analytics records are not shown to group members.

Authorities acting under law

Information may be disclosed within the scope and period permitted by law when an investigative or other authorized authority makes a request through a lawful process such as a warrant.

6. Service providers and overseas handling

The Operator uses the following providers only as needed to provide the Service. Changes to the provider or purpose will be disclosed through this Policy.

Supabase, Google, Apple and GitHub are based in the United States. SIDEY uses the Singapore region for Firebase Realtime Database and Cloud Functions; Firebase Authentication processes authentication information in the United States. Information is transferred over networks when connecting to realtime services, authenticating, sending messages and interacting. Google account linking is separate from Firebase realtime processing. Refusing overseas processing essential to authentication, data storage and realtime communication may prevent use of part or all of SIDEY. Contact the privacy officer in Section 12 to exercise your rights or ask questions. See Firebase Privacy and Security for Google’s service-specific processing locations and retention and deletion rules. Where applicable law requires separate notice or consent for overseas processing, the recipient, country, information, purpose, method and retention period will be explained before you use the relevant feature.

7. Payment information and outside services

Apple processes Mac App Store payments. For a PortOne payment, a payment service provider opened through PortOne handles the full card number, payment password, and bank-account authentication information. SIDEY does not receive or retain full payment credentials; it handles only the identifiers and results needed to verify, cancel, or refund an order.

When you use an outside sign-in page, payment window, or linked website, the provider’s own terms and privacy policy apply to information it collects independently.

8. Your rights and how to exercise them

You may request access to, correction or deletion of, suspension of processing of, or withdrawal of consent for your personal information. A user of Sign in with Apple can delete an Account in the app’s settings after reauthentication. Other Account or data requests can be sent by email to the Privacy Officer below.

You may exercise rights through a legal representative or another authorized person. The Operator may request the authorization form and minimum information needed to confirm the identity of the user and representative as permitted by law. Within 10 days after receiving an access request, the Operator will explain how access will be provided or, where law permits restriction, delay, or refusal, explain the reason and how to object.

Deletion may be limited while another law requires a record to be retained. SIDEY does not make automated decisions that produce legal or similarly significant effects on users.

9. Deletion

Personal information is deleted without undue delay when its retention period ends or its purpose is achieved. Electronic records are deleted using methods intended to prevent recovery. Transaction records subject to separate retention duties are separated from general service data, used only for the required purpose, and deleted when that period ends.

Deleting an Account removes the profile, Group connections, and active SIDEY entitlement links. Minimum transaction records may be retained separately for legal and settlement purposes with user linkage minimized. Account deletion does not automatically delete transaction records held by Apple or a payment service provider and is not a refund request.

10. Security measures

The Operator limits access to personal information to what is needed for the work and separates operational privileges and secrets. SIDEY uses database row-level access controls, server-side Group capacity and membership checks, encrypted transport, and operating-system secure storage. Invitation codes are not stored in plaintext on the server, and payment secret keys and administrative privileges are not included in the app or public website.

SIDEY is not represented as a service with implemented and verified end-to-end encryption.

11. Cookies and similar technologies

The SIDEY public website does not install cookies for personalized advertising, visitor-behavior analytics, or individual recommendations. A browser or hosting provider may process connection information or use technical storage to serve static files and protect the service.

An outside provider may use cookies for functionality and security when you visit a Google or Apple sign-in page or a payment page. See that provider’s privacy settings for available controls.

12. Privacy Officer

Questions, complaints, remedies, and requests to exercise privacy rights may be sent to the email above. The Operator will review and respond without undue delay.

13. Remedies for privacy infringement

If you need advice or wish to report a privacy infringement in Korea, you may contact:

14. External services outside this Policy

The SIDEY website and app may link to services operated by other providers. This Policy does not govern information handled by an external service the Operator does not control. Review the privacy policy of the service you visit.

15. Changes to this Policy

If this Policy changes because of law, the Service, or outside processing relationships, the effective date and material changes will be announced through the website or app. A change with a significant impact on user rights will be announced in advance for the period required by law.

16. Effective date

This revised Privacy Policy takes effect on October 20, 2026. It explains the handling, sharing, storage and deletion of photos users choose to send, and the purposes, information, retention and deletion rules for account-linked Mac app usage-time and setting-change analytics. The original effective date was September 4, 2026.