머미피디아

1. Information We Collect

• Account: email, password (hashed), nickname
• Social sign-in: email, provider identifiers (Apple, Google, Kakao). Also the nickname (name) and profile photo that a Kakao or Google account provides (Kakao provides them only if you agree to these optional items; declining does not limit sign-up or use). The nickname is shown as a suggestion right after sign-up and becomes your 머미피디아 nickname only if you confirm it; the profile photo is copied to the Service's storage and used as your default profile photo.
• Service usage: reviews, ratings (party participation and booking history once party matching is introduced)
• Venue usage records (collected as described in "How app and venue usage records are collected" below): opening a venue's page, tapping its booking, phone, map, website, Instagram or open chat button, an advertised venue appearing in the list or its card being tapped, and the introduced venues row appearing or one of its cards being tapped. Only the venue, the kind of record, the time and the device type (iOS or Android) are stored, not linked to your account. To stop one member flooding the records, a one-way hash of the member identifier is kept and deleted within three hours.
• Partner venue operator check (only when a venue partnership is made): your name, contact details, documents such as a business registration certificate that show you own or run the venue, and the nickname of your account. A copy of the documents you give us is kept in private storage that only the service's administrators can open, and the account also keeps the kind of document checked, the date and the linked venue. A document showing a resident registration number is accepted only with that number covered. When an operator edits the venue's details in the app, the fields changed, the values before and after, and the time are kept with the account.
• App usage records (collected as described in "How app and venue usage records are collected" below): the screens you view, the features you use, search terms and filters you choose, how many items a list shows, warnings and errors the app hits, the app version, and the device type and OS version. While you are signed in, these records are linked to your account. Opening a venue's page is also kept here as a screen record, separately from the venue usage records above. They never contain passwords, review text or contacts, and email addresses and phone numbers inside them are masked.
• Location: when you view venues in the Distance or Recommended order, your device's location is used on the device to compute distances and is never sent to or stored on our servers.
• Payments (once party matching is introduced; the app has no payments today, so none are collected): deposit transaction records (card data held by PG only, never stored by the Service)
• Third-party AI permission: whether and when you allowed it, and the version of the wording you saw
• Reports and restrictions: report reasons and details, the outcome, the reason and time of any restriction
• Notification settings and followed venues: whether and when you agreed to receive advertising and to the use of your data to choose ads, which kinds of news you receive, the areas you picked, the venues you follow and the venues you silenced. Areas are values you choose, not location data.
• Automatic: IP address, device identifier, login attempt logs, push notification device token, app crash logs (device model, OS version and the error when the app stops unexpectedly — not linked to your account)

How app and venue usage records are collected: these two records and app crash logs are processed without consent, to the extent needed to fix the app and improve the Service (Personal Information Protection Act of Korea, Article 15(1)(6), the legitimate interest of the controller). On first launch the app reads the country on the device (the App Store country on iOS, the SIM country on Android). Outside the European Economic Area, the United Kingdom and Switzerland, Korea included, the sign-in screen states that these records are collected and collection starts after that. In the European Economic Area, the United Kingdom or Switzerland, or when no country can be read, they are collected only if you agree on the app's consent screen. The country read is used for this decision only and is not stored. Either way, you can stop the collection at any time in Settings > Usage records, and no new records are sent after that.

2. Purpose of Collection

• Member identification, authentication, and account management
• Profile defaults (a nickname suggestion right after sign-up and a default profile photo)
• Party matching, reservations, and payment mediation (once introduced)
• Abuse prevention and security audit logging
• Finding the cause of app errors and improving the Service (app usage records)
• Improving venue information, per-venue usage statistics and measuring venue advertising (venues receive per-venue counts only, never information that identifies a person)
• Checking partner venue operators and running the partnership (terms, monthly numbers)
• Announcements and customer support
• Sending advertising: to members who agreed, MMpedia sends partner venue news, discounts and newly arrived themes by app push. Never between 9 pm and 8 am Korea time.
• Personalized advertising: for members who separately agreed, favourites and predicted ratings are used to choose recipients. Venues receive totals only, no number when fewer than five, and never information that identifies a member.

3. Retention Period

• Account information: until membership withdrawal
• Payment and booking records: 5 years (per Korean e-commerce law)
• Login logs: 3 months (per Korean telecommunications privacy law)
• App usage records: destroyed 14 days after the server receives them, and together with the account on membership withdrawal. Before that they are summed into daily statistics (counts per date, device type, app build, screen and feature name, and how many people used the app), which are not linked to any account and are kept
• Advertising consent records and notification settings: until you delete your account. Advertising notifications: destroyed after 90 days. Advertising delivery records: destroyed after 180 days. Device registrations: deleted on sign-out, when you turn notifications off, or after 270 days unused.
• Partner venue operator check: until you delete your account. Copies of the documents: destroyed without delay when the operator link ends or you delete your account. Venue edit records: the link to the account is removed when you delete your account; the changes and their times stay as the venue's record.
• Third-party AI permission record: until account deletion.
• Restriction records: on account deletion the link to the account is removed; the action and its time remain.
• Re-sign-up restriction: when you delete your account yourself, the same account cannot sign up again for 30 days. To enforce this, your verified email address and social login identifiers (Kakao, Google, Apple) are kept for 30 days from deletion only as one-way hashes that cannot be turned back into the original values, then destroyed without delay.

4. Third Parties, Processors and Overseas Transfer

The Service does not share personal information with third parties without consent. The processors below receive the minimum data needed to provide the Service, and overseas recipients are disclosed here as Article 28-8 of Korea's Personal Information Protection Act requires. Data is sent over an encrypted network when you use the Service.

• Supabase Pte. Ltd. (privacy@supabase.com): database, authentication and file storage; the member data in section 1. Stored in the Republic of Korea (Seoul region), for the periods in section 3 or until the contract ends.
• Google LLC, United States (Firebase support): push notification delivery and app crash logs; device registration values, notification content, crash logs. Crash logs are kept for 90 days; device registration values follow section 3.
• Plus Five Five, Inc. (Resend), United States (support@resend.com): authentication email; email address and message content. Kept for the period Resend sets and deleted when the contract ends.
• Cloudflare, Inc., United States (privacyquestions@cloudflare.com): bot protection and network security; IP address, TLS fingerprint, User-Agent. Kept for the period Cloudflare sets.
• OpenAI OpCo, LLC, United States (privacy@openai.com): only if you allow it in the app, the text of a review you write, the note you give the writing helper and the sentence you type into "Find with AI", to classify spoiler severity, extract tags, draft reviews and per-theme review summaries, and read search conditions. No name, email or account identifier is included, it is not used to train models, and OpenAI keeps abuse-monitoring logs for up to 30 days.
• Apple, Google, Kakao: the social sign-in you choose
• PG provider (payment processing, from when party matching is introduced; none today)

To refuse overseas transfer you can ask to delete your account, in which case you cannot use the Service. To refuse only the transfer to OpenAI, turn it off in the app's Settings: your reviews are still posted but appear covered because they cannot be checked for spoilers and stay out of review summaries, and the writing helper and Find with AI are unavailable.

5. Your Rights

You may at any time request access, correction, or deletion of your personal information. Account deletion is available via "Settings > Account > Delete Account" within the app, or by emailing the address below.

You can withdraw consent to advertising and to the use of your data for choosing ads at any time, free of charge, in Settings > Notification settings or with the opt-out button on an advertising notification.

You can change whether reviews and search use a third-party AI at any time in the app's Settings.

6. Security Measures

• Passwords stored as one-way hashes (bcrypt)
• SSL/TLS encryption in transit
• Row-Level Security on all database tables
• Breached-password screening (HIBP pre-check)
• Least-privilege access and audit logging

7. Data Protection Contact

Privacy officer: Andygile data protection contact
E-mail: andy@andygile.com
Data protection questions and complaints go to this address.

Nature of Service

머미피디아 (MMpedia, "Service") provides murder mystery theme reviews and a venue guide. Party matching and deposit escrow will be announced when introduced and offered under these terms from then.

Account Creation

Membership is established when a user agrees to these Terms and completes the sign-up procedure provided by the Service using email or social sign-in (Apple, Google, Kakao). Only people aged 19 or older (the Korean age of majority) may sign up, and a member can use the Service after confirming in the app that they are 19 or older. An account found to belong to someone under 19 may be restricted and deleted. After a member deletes their own account, the same email address or social sign-in account cannot sign up again for 30 days from the deletion.

Service Scope

The Service provides theme information and reviews, and a venue guide. Party matching and recruitment, deposit escrow, and payment mediation are provided once introduced.

User Content

You are responsible for the reviews, ratings, nickname and profile picture you post ("Content"). Abuse, hate, discrimination, harassment, sexual or violent material, exposing someone's personal information or defaming them, false Content such as reviews of themes you did not play or reviews that hide a payment, advertising and spam, copyright infringement, and anything else against the law are not allowed. The Service has no tolerance for such Content or for users who post it.

You can report Content with the in-app Report function or by the contact e-mail below, and the Service aims to look at a report within 24 hours. Where a violation is found the Service may, without prior notice, hide or delete Content, reset a nickname and profile picture, suspend use, or delete the account. If you disagree with an action, write to the contact e-mail below.

You allow the Service, free of charge, to display Content in the app and in materials about the Service, to process it to cover spoilers or summarize it, and to copy and distribute it as far as those purposes need. Copyright in Content stays with you. When you delete your account, your reviews and ratings may remain with the author removed. Cancellation and refund rules will be added to these Terms, with advance notice, when party matching is introduced.

User Obligations

Users shall not impersonate others or register false information, shall not disrupt Service operation or harm other members, and, once party matching is introduced, shall attend booked parties in good faith, following the prescribed cancellation procedure if unavoidable.

Limitation of Liability

The Service shall not be liable for damages caused by force majeure, natural disasters, or the user's own fault. Service quality provided by venue and theme operators is the responsibility of each operator.

Venue Information and Advertising

Venue information in the Service is collected by the Service from material the venues publish themselves and from public data (the Korean shop register of the Small Enterprise and Market Service), and its accuracy and currency are not guaranteed. Bookings and payments at a venue take place between you and the venue through the venue's own booking channel; the Service is not a party to that transaction and is not responsible for it. A venue marked "Ad" in the Recommended order of the venue list has a placement partnership with the Service, paid or free; advertising does not affect any other order. The Service does not change or remove theme ratings or reviews because of advertising. Reviews written by a partner venue's operator are labelled "Partner venue operator". The venues the Service introduces do not change any order or rating, and a card says so when its slot was paid for or its writer has a tie to the venue. You can ask for venue information to be corrected or removed from the venue's page in the app or by email to the address below. A partner venue operator can edit their venue's photo, introduction, phone, hours, prices and links in the app; the operator is responsible for what they write and upload, and the Service may correct or remove content that is untrue or breaches these Terms. An operator may upload only photos they took or hold the rights to, must not upload a photo in which guests or other people can be recognised, and permits the Service to show the photo, resized, on the venue's screens in the app.

Curators

• A curator is a member registered through the procedure the Service sets, who writes theme reviews and puts forward featured venue candidates with introductions in the app (with the reviews, "Content"). Registration is decided by the Service. Candidates follow the rounds and deadlines the Service sets and may be edited or withdrawn until the deadline. The Service reviews them against its selection criteria and decides whether, for how long and where they run; it may edit or remove Content, including its label, and does not promise exposure to any venue.
• Curators may provide only Content based on their own play or use.
• Curators may provide only text and photos they created or hold the rights to. They must not provide other people's works, posters or photos without the rights. If breaching this leads to a dispute with a third party, the curator resolves it at their own responsibility and cost.
• A curator with an economic interest in the subject of Content must tell the Service when providing it and must state the fact at the start of a review. This includes being an operator or employee of the venue, receiving free use or a discount, and giving or receiving a benefit in return for candidate selection. The Service shows the fact with a featured introduction.
• The Service may edit or decline to publish Content to meet disclosure duties and these Terms. It tells the curator first before changing the substance.
• The curator permits the Service to use provided Content in the app and in introducing the Service. Copyright in the Content stays with the curator.
• If a curator breaches this clause, the Service may take the Content down and end the registration.

Representations and Warranties

The Service is provided on an "AS IS" and "AS AVAILABLE" basis, without warranties of any kind, express or implied, including but not limited to merchantability, fitness for a particular purpose, and non-infringement.

Governing Law

Any claim relating to the Service shall be governed by the laws of the Republic of Korea without regard to its conflict of law provisions.

Terms Updates

We may update these Terms from time to time. If there is a change, we will notify users 7 days in advance. If you object to the change, please contact andy@andygile.com within the notice period.