Privacy Policy
Explains the personal information choidev handles, why it is used, how long it is kept, outsourcing and overseas transfers, and users' rights.
Contents
choidev (https://choidev.com, hereinafter the "Site") is operated by Lim Sehyun (hereinafter the "Operator"). The Operator complies with the Personal Information Protection Act and other related laws and informs you as follows about how personal information is handled. Effective date: October 7, 2026
1. Purposes of Processing Personal Information
The Operator processes personal information only for the following purposes. If the purpose changes, the Operator will notify you in advance as required by law and obtain any necessary consent.
- Member management: Sign-up and login via Google, Kakao, Naver, GitHub, or Microsoft accounts, or via email (verification code check), login with passkeys added by members, identity verification, access to member-only posts, and prevention of misuse
- Comments: Writing, displaying, and managing comments, and preventing spam and flooding (including human verification and AI spam detection)
- Guestbook: Letting visitors leave greetings, limiting entries to one per day, and preventing spam (including human verification and AI spam detection)
- Inquiries: Reviewing and answering inquiries received through the contact page, and preventing spam and abuse (including human verification, rate limits, and AI spam detection). No automatic confirmation email is sent to inquirers
- Likes: Counting likes per post, keeping members' like status, and preventing duplicate likes from non-members on the same post
- Service operation and security: Checking access logs, analyzing errors, and detecting and blocking attacks
- Statistical analysis: Improving the Site by understanding visit and usage trends (Google Analytics)
- Advertising: Displaying ads and measuring performance (when Google AdSense is applied), and preventing invalid clicks such as repeated clicks
- Operator notifications: Sending alerts about new comments, guestbook entries, and member sign-ups to the Operator's mobile phone
- App notifications and credits: Sending new post and reply notifications for the Android app, and recording the earning and use of member credits
- Browser notifications: Sending new post notifications (if you have enabled them)
- Daily quiz and friend invitations: Grading the daily quiz, awarding credits, recording friend invitations and rewards, and preventing fraudulent credit earning
- Site performance measurement: Measuring page loading speed to improve the Site
- Donation thank-you credits: Granting and revoking thank-you credits for donations made through external platforms, preventing duplicate grants, and handling inquiries
- Member profiles: Displaying profile photos and public profiles (introduction, activity, owned items, level), and showing level badges on profile photos in comments, guestbook entries, and the community
- Community: Posting and managing posts, comments, and images, likes, handling reports, preventing spam and flooding, and managing usage restrictions
- Inquiry responses: Reviewing and answering inquiries sent by email
- Notification emails: Verification codes for sign-up and login, notifications of replies to your comments (you can opt out), and account status notices such as suspension
- Newsletter: Sending new post news emails to users who subscribed (the Site sends the subscription confirmation email through Amazon SES, and only addresses that have completed confirmation are added to the Zoho Campaigns subscriber list to receive the newsletter)
2. Items of Personal Information Processed and Collection Methods
| Category | Items | Collection method |
|---|---|---|
| Member sign-up and login (required) | Social account identifier, name (nickname), email address (if provided) | Received from the respective provider within the scope you consent to when logging in with Google, Kakao, Naver, GitHub, or Microsoft |
| Email sign-up and login (optional) | Email address, name (nickname), password (stored in a non-recoverable form), verification code (stored in a non-recoverable form, valid for 10 minutes), and sending records | When signing up or logging in by email |
| Passkey (optional) | Passkey public key and identifier, signature counter, transport method, whether synced (backed up), name (generated from device or browser type, or set by the member), and registration and last-use dates and times. Biometric data such as fingerprints or face data and private keys never leave the user's device (or password manager), and the Site neither receives nor stores them | When a member adds a passkey in their account or logs in with a passkey |
| Email notifications (members) | Whether reply notification emails are received, a random value for the unsubscribe link, the time a reply notification was sent (to send only once per hour for the same comment), and email addresses that bounced or were reported as spam (to avoid resending) | When sending reply notification emails, and when an email bounces or is reported |
| Newsletter subscription (optional) | Email address, subscription and confirmation dates and times, unsubscribe status, email open and link click records (collected by Zoho Campaigns) | Passed to Zoho Campaigns when you complete confirmation by clicking the button in the confirmation email (not stored on the Site's server) |
| Profile photo (optional) | A square-resized copy (96 or 192px) of the profile photo from the social account. Visitors' browsers do not connect directly to the social service's image servers | Provided by the relevant service when logging in with Google, Kakao, Naver, or GitHub (not saved if the member turns off display) |
| Public profile (members) | Random public address (/u/…), introduction, sign-up date, number of comments and guestbook entries, days attended (last 26 weeks), recent comments on public posts, public guestbook entries and community posts, owned and equipped decoration items, level (Lv.1–100 calculated from total earned credits, with progress to the next level; the Operator can turn off display), and visibility settings | When signing up and using the Site (the member sets the visibility scope) |
| Community (optional) | Post titles and bodies, comments, uploaded images (stored after removing metadata such as shooting location and reducing their size), creation and edit times, likes, reports (target, reason, details), time of agreeing to board rules, usage restriction records (reason and period), and the last post or comment time (used to check posting intervals) | When using the community |
| Re-registration restriction (applicable members only) | For members who withdrew while under a usage restriction, a one-way encrypted value of their social account identifier and email address (original values are not stored), restriction type, reason, and end date | Automatically generated when a member under a usage restriction withdraws or the account is deleted |
| Comments (required) | Comment content, author name, and time of writing. For non-member comments, a one-way encrypted value of the IP address (IPv6 at /64 range) used to prevent flooding | When writing a comment |
| Guestbook (optional) | Name, message, stamp, and time of writing. For non-members, a one-way encrypted value of the IP address (IPv6 at /64 range) used to check the one-per-day limit | When writing a guestbook entry |
| Likes (optional) | Members: a record of posts they liked. Non-members: a one-way encrypted value of the network (IPv4 address or IPv6 /64 range) and the post liked, so that each post can be liked only once | When pressing the like button |
| App notifications (optional) | Device identifier for app notifications (push token), notification settings, comments for which reply notifications were requested, and the member identifier if logged in | After installing the app, when allowing notifications or turning on reply notifications for a comment |
| Credits (members) | Credit earning and usage history (attendance, comments, posts and codes, shop items, CD pieces), balance, total earned credits (used for level calculation; not reduced when spent, but reduced if revoked), and owned and equipped decoration items (displayed publicly on comments and guestbook entries) | When attending, writing comments, or using credits |
| Browser notifications (optional) | Browser push subscription information (push service address and encryption keys), subscription time, and the member identifier if logged in | When allowing notifications via "Receive new post notifications" |
| Daily quiz (members) | Response date, selected option, whether the answer was correct, and credits received | When answering the quiz |
| Friend invitations (members) | Invitation code for each member, the link between the inviting member and the joined member, sign-up date and reward status, and a one-way encrypted value of the network used to prevent fraudulent credit earning (the original IP is not stored) | When viewing an invitation link or attending, and when signing up through an invitation link |
| Donations (optional) | Donation reference number, amount, currency, time, processing status, linked member, partially masked email (e.g., jo***@example.com) or GitHub ID, and a per-member donation code. Full email addresses, names, donation messages, and payment method information are not stored; emails and messages are used only for linking to members and discarded immediately | When donation platforms (Buy Me a Coffee, GitHub Sponsors) send donation notifications |
| Inquiries (optional) | Email address, name, inquiry content | When sending an inquiry by email |
| Automatically generated information | Access IP address, browser and device information (User-Agent), access date and time, pages visited, cookies, security event records | Automatically generated and collected while using the Site |
| Human verification (automatic) | Browser and device signals and verification results checked by Cloudflare Turnstile | When writing non-member comments or guestbook entries, and when requesting a verification code for email sign-up or login |
| Statistics and advertising (automatic) | Cookie identifiers, device and browser information, visit history, and other behavioral information | Collected via cookies by Google Analytics and AdSense |
| Ad invalid-click prevention (automatic) | Ad click time, location, and device type, plus an identifier made by one-way encrypting the IP address and browser information with a value that changes daily (the original IP is not stored) | Automatically generated when an ad is clicked |
| Performance measurement (automatic) | Page loading speed measurements (LCP, INP, CLS, FCP, TTFB), visited page path, and mobile or desktop classification. No cookies or identifiers are used, and IP address and browser information are not stored | Sent automatically when leaving a page during part of visits (25% by default) |
| Inquiries (optional) | Name (optional), email address for reply, inquiry type and content, member status, and inquiry time. Access IP information is used only for rate limits to prevent abuse and is not stored | When sending an inquiry from the contact page (/contact) |
The Site does not collect unique identifiers such as resident registration numbers or sensitive information. Post view counts are stored only as totals per post and date and do not identify users.
3. Retention Period of Personal Information
| Item | Retention period |
|---|---|
| Member information | Until membership withdrawal (deletion request) |
| Passkeys | Until the member deletes them or withdraws from membership (deleted together upon withdrawal). One-time values for login and registration checks are deleted immediately after use, or after 5 minutes if unused |
| Login session | 30 days after login (deleted immediately on logout or withdrawal) |
| Pending sign-up or login information (before verification) | Deleted immediately upon verification; if not verified, automatically deleted within 1 day after the code expires (10 minutes) |
| Email notification settings | Until membership withdrawal |
| Reply notification sending records | Automatically deleted after 1 day |
| Blocked sending addresses (bounced or reported as spam) | Until the Operator lifts the block (to avoid sending to the same address again) |
| Comments | Until the user deletes them (upon member withdrawal, author information is removed and content is kept as "withdrawn member") |
| Guestbook | Until the user requests deletion or the Operator deletes it (upon member withdrawal, author information is removed and marked as "withdrawn member"; the one-per-day check value is automatically deleted after 2 days) |
| Like records (members) | Until the like is canceled or the member withdraws |
| Duplicate like prevention value (non-members) | Automatically deleted after 30 days |
| App notification device information | Deleted when notifications are turned off or the app is uninstalled and the token becomes invalid |
| Credit history | Until membership withdrawal |
| Profile photo | Deleted immediately when the member turns off display or withdraws (may be updated to the latest photo each time the member logs in) |
| Public profile settings and introduction | Until membership withdrawal (the public address is not reassigned to other members) |
| Community posts, comments, and images | Until the author or the Operator deletes them (deleting a post also deletes its comments and images; upon member withdrawal, author information is removed and marked as "withdrawn member"). Uploaded images not included in a post are deleted after 24 hours. Deleted images may remain for up to 5 minutes in the browser of devices that have already viewed them |
| Records of likes, reports, rule agreements, and usage restrictions | Until membership withdrawal (restrictions are deleted when they end; operation records are deleted from the oldest once they exceed the most recent 500 entries) |
| Community posting interval records | Until membership withdrawal (only the last post or comment time is kept per member) |
| Re-registration restriction records (only for members who withdrew under a usage restriction) | Kept until the remaining restriction period ends to prevent avoiding usage restrictions by rejoining after withdrawal (community restrictions without an end date and suspensions are kept for 1 year from withdrawal or deletion). Automatically deleted when the period ends, and deleted immediately if the Operator lifts the restriction. Other member information such as names and emails is destroyed immediately upon withdrawal |
| Browser notification subscription information | Until notifications are turned off or the push service reports that the subscription has expired (automatically deleted if delivery repeatedly fails) |
| Quiz responses and invitation records | Until membership withdrawal (deleted together upon withdrawal) |
| Donation records | Kept while the Site is in operation (member links are deleted upon withdrawal or request; donation codes are deleted upon withdrawal) |
| Inquiry emails | 1 year after processing is complete |
| Server access logs | 3 months |
| Security event records | Automatically deleted from the oldest once they exceed the set number for each type (300 to 1,000 most recent entries) |
| Ad click records | Automatically deleted after 7 days |
| Performance measurement statistics | Stored only as daily distribution statistics without individual records, and automatically deleted after 90 days |
| Backups | Encrypted backups are kept for 7 days and then automatically deleted |
| Google Analytics data | Retention period set in Google Analytics data retention settings (up to 14 months) |
| Inquiries | Retained for 1 year after processing is complete (inquiries judged to be spam may be deleted immediately by the operator after review) |
| Newsletter subscription information | Until you unsubscribe (subscription requests that have not completed verification are not stored anywhere, and the verification link expires after 48 hours) |
Where related laws require retention, the data is kept for the period those laws specify.
4. Provision of Personal Information to Third Parties
The operator does not provide users' personal information to third parties. Exceptions apply only where the user has given prior consent, where a specific provision of law requires it, or where an investigative agency requests it through the procedures set by law.
5. Outsourcing of Personal Information Processing
To provide the service smoothly, we outsource personal information processing tasks as follows, and we ensure that personal information is managed securely in accordance with applicable laws.
| Processor | Outsourced Tasks |
|---|---|
| Amazon Web Services, Inc. (AWS Lightsail and Amazon SES, Seoul region) | Server hosting and database storage, email delivery (sign-up and login verification codes, reply and account notifications, inquiry replies, newsletter subscription confirmation emails) |
| Cloudflare, Inc. | DNS, security proxy and CDN (traffic delivery and attack blocking), spam prevention (Turnstile), encrypted backup storage (R2) |
| Google LLC | Visitor statistics analysis (Google Analytics), ad serving (Google AdSense), social login authentication, operator and app notification delivery (Firebase Cloud Messaging) |
| Browser push services (Google, Mozilla, Apple, Microsoft) | Browser notification delivery (only if notifications are turned on; notification content is delivered encrypted) |
| Kakao Corp. | Social login authentication |
| Naver Corp. | Social login authentication |
| GitHub, Inc. | Social login authentication |
| TypeSafe AI, Inc. | Spam and malicious content judgment for comments, guestbook entries, community posts, and inquiries (AI moderator) |
| Microsoft Corporation | Social login authentication |
| Zoho Corporation (Zoho Mail and Zoho Campaigns) | Receiving and replying to inquiry emails, managing and sending newsletter subscriptions |
6. Cross-Border Transfer of Personal Information
Some of the processors above handle personal information overseas. This is outsourcing of processing necessary for performing the service agreement under Article 28-8(1)(3) of the Personal Information Protection Act, and the transfer is disclosed through this policy.
| Recipient (contact) | Country | Items Transferred | Purpose | Timing and Method | Retention Period |
|---|---|---|---|---|---|
| Cloudflare, Inc. (privacyquestions@cloudflare.com) | United States and other countries where Cloudflare data centers are located | IP address, request information, cookies, backup data (encrypted) | Security proxy and CDN, spam prevention, backup storage | Transmitted over the network when accessing the site; backups daily | Immediately after request processing or per Cloudflare policy period; backups 7 days |
| Google LLC (support.google.com/policies) | United States | Cookie identifiers, device and browser information, visit history, social login information, author name and beginning of posts contained in operator notifications, app notification device tokens and notification content | Statistical analysis, advertising, login authentication, operator notifications | Transmitted over the network when accessing the site or logging in | Per Google policy (Analytics up to 14 months) |
| Browser push services (Google, Mozilla, Apple, Microsoft; each company's privacy contact) | United States and other countries | Push subscription address, encrypted notification content | Browser notification delivery | Transmitted over the network when a new post is published | Per each company's policy after delivery |
| GitHub, Inc. (github.com/privacy) | United States | GitHub account identifier, name, email address (if provided) | Social login authentication | Transmitted over the network when logging in with GitHub | Per GitHub policy |
| TypeSafe AI, Inc. (privacy@typesafe.ai) | United States | Comment, guestbook, and inquiry content, author name, membership status, number of links | Spam and malicious content judgment | Transmitted over the network when writing comments, guestbook entries, or inquiries | Per TypeSafe policy after judgment (input content is not used for AI training) |
| Microsoft Corporation (privacy.microsoft.com) | United States | Social account identifier, name, email address | Login authentication | Transmitted over the network when logging in with Microsoft | Per Microsoft policy |
| Zoho Corporation (privacy@zohocorp.com) | United States | Email address, inquiry content | Inquiry response | Transmitted over the network when sending an inquiry email or receiving a reply | Retained for the period needed to handle the inquiry, then deleted without delay |
| Zoho Corporation (Zoho Campaigns, privacy@zohocorp.com) | United States and other countries where Zoho data centers are located | Email address, subscription and confirmation date and time, email open and click records | Managing and sending newsletters | Transmitted over the network when newsletter subscription confirmation is completed | Until unsubscribe |
If you do not want your personal information transferred overseas, you can avoid leaving comments or guestbook entries, block cookies in your browser, or use an ad-blocking extension that blocks Google Analytics. However, you cannot access the site without going through the security proxy (Cloudflare).
7. Procedures and Methods for Destroying Personal Information
Personal information is destroyed without delay once its retention period has passed or its processing purpose has been achieved. Electronic files are deleted using methods that cannot be recovered, and information remaining in backups is deleted when the backup retention period (7 days) ends. Personal information in paper form is not kept.
8. User Rights and How to Exercise Them
Users may at any time request access to, correction of, deletion of, or suspension of processing of their personal information, or withdraw consent (by leaving membership or turning off notifications).
- hi@choidev.comSend a request to this address. After identity verification, we will process it within 10 days and notify you of the result.
- You can turn off reply notification emails using the unsubscribe link at the bottom of the email or the email notification settings in your account. Sign-up and login verification codes and account status notices are essential for using your account, so they cannot be turned off separately.
- Browser notifications can be turned off at any time using 'Turn off notifications' at the bottom of a post or in your browser settings.
- Rights may also be exercised through a legal representative or an authorized agent, in which case a power of attorney must be submitted.
- Where other laws require retention or where the law otherwise provides, requests may be restricted, and in that case we will explain the reason.
9. Personal Information of Children Under 14
The site does not accept membership registration from children under 14 and does not knowingly collect children's personal information. If we learn that personal information of a child under 14 has been collected, we will delete it without delay.
10. Installation, Operation, and Refusal of Automatic Personal Information Collection Devices
The site uses cookies and browser storage to keep you logged in, for security, statistics, and advertising. Details on the types and duration of cookies used and how to refuse them are explained in the Cookie Policy.
Refusing cookies: You can block or delete cookies in your browser settings (e.g., Chrome Settings → Privacy and security → Third-party cookies). Blocking essential cookies may prevent some features, such as logging in, from working.
11. Collection and Use of Behavioral Information and Personalized Advertising
When Google AdSense is applied, Google and its partners may use cookies to collect behavioral information such as visit history and show personalized ads based on interests.
| Category | Details |
|---|---|
| Items Collected | Website visit history, ad impression and click records, cookie identifiers, device and browser information |
| Collection Method | Automatically collected through Google ad cookies when visiting the site |
| Purpose | Providing interest-based ads and measuring ad performance |
| Retention Period | Per Google policy (advertising cookies are mostly kept within 13 months) |
| Control Method | Personalized ads can be turned off in Google Ad Settings |
; you can also block cookies in your browser.For more details, see the Advertising Information
12. Measures to Ensure the Safety of Personal Information
- Encryption in transit: All connections are encrypted with HTTPS (TLS).
- Encryption at rest: Login session tokens are stored as hashes, keys for linked services are encrypted with a separate master key, and backups are also encrypted.
- Access control: The admin page can only be accessed from an authorized private network (Tailscale), and two-factor authentication (phone approval or OTP) is applied to admin login.
- Attack response: Unauthorized access is detected and blocked through the Cloudflare security proxy, request rate limiting, human verification (Turnstile), AI spam judgment, and security event logging.
- Minimum processing: Only the minimum necessary information is processed, and only the operator (one person) has access.
13. Personal Information Protection Officer
| Category | Details |
|---|---|
| Personal Information Protection Officer | Lim Se-hyun (Operator) |
| Contact | hi@choidev.com |
For inquiries about personal information processing, complaints, or requests for damage relief, please send them to the contact above, and we will respond and handle them without delay.
14. Remedies for Infringement of Rights
To seek remedies for personal information infringement, you may apply for dispute resolution or consultation with the following organizations.
- Personal Information Dispute Mediation Committee: (no area code needed) 1833-6972, www.kopico.go.kr
- Personal Information Infringement Report Center: (no area code needed) 118, privacy.kisa.or.kr
- Supreme Prosecutors' Office: (no area code needed) 1301, www.spo.go.kr
- National Police Agency: (no area code needed) 182, ecrm.police.go.kr
15. Changes to the Privacy Policy
This policy applies from October 6, 2026. If content is added, deleted, or changed, we will notify you through the site 7 days before the change takes effect (30 days before for changes important to user rights).
Change notice (posted October 5, 2026): We added Amazon SES (for sign-up verification and notification emails) and Zoho Mail (for receiving and replying to inquiry emails) to the outsourcing and cross-border transfer items. We also added the processing purposes, items, retention periods, and opt-out methods for sign-up and login by email (via verification code) and for notification emails (reply notifications and account status notices), and removed the sentence stating that email/password sign-up is not accepted. Human verification (Turnstile) is also applied to email sign-up and login. These changes apply from October 6, 2026.
October 9, 2026: We added processing purposes, items, retention periods, outsourcing, and cross-border transfer details for Microsoft account login, passkey login, and newsletter subscription (Zoho Campaigns). These changes apply from October 16, 2026.
October 10, 2026: We revised the processing purposes, items, retention periods, outsourcing, and cross-border transfer details to match the current method, in which the site sends newsletter subscription confirmation emails directly via Amazon SES and only addresses that have completed confirmation are passed to Zoho Campaigns. These changes apply from October 17, 2026.
Change history: October 6, 2026 — Since we no longer run an email newsletter, we removed the related processing purposes, items, retention periods, and the Resend outsourcing and cross-border transfer details (new post notifications are sent only as app and browser notifications). October 3, 2026 — We added items for the re-registration restriction records of members who withdrew during a usage restriction, member levels (cumulative credits earned, public badges), and community posting interval records, and noted how long deleted community images are kept in the browser. October 2, 2026 — We added Naver and GitHub login, human verification (Turnstile) and AI spam judgment (TypeSafe), duplicate-prevention for anonymous likes, ad invalid-click prevention, operator notifications, Android app notifications, member credits, browser notifications, the daily quiz, friend invitations, site performance measurement, donation thank-you credits, profile photos, public member profiles, and community items, and revised the wording on handling comments and guestbook entries upon withdrawal to match actual operations. September 30, 2026 — Initial implementation.
Privacy Policy · Terms of Service · Cookie Policy · Advertising Information