한국어

Moa Privacy Policy

1. What the operator can't see

Photos and videos are encrypted with the space key on the phone and go directly between members' phones; each receiving phone makes its own small previews. When phones can't connect directly, they may pass through a relay server while encrypted, and the operator can't see their content. The only exception is photos and videos sent with Moa Plus holding: they are held on the server for up to 7 days, encrypted with the space key, and the operator can't see their content (sections 2 and 3). Content such as album names, comments, voice comments, nicknames, profile photos and photo locations travels between members encrypted with the space key, and the operator can't see it. Photo locations are off by default and go to members only if you turn on "Send photo locations" in Settings (section 4). The one exception is the space name, which the app sends to the server separately so that we can recognize the space when answering support requests and name it in notices before an unused space is removed (section 2). Also, when a member reports a comment, the reporting phone sends the text of that comment with the report, and the operator can see it (section 2). When reporting a photo or video, if the reporter chooses "Send the reported photo too", that one photo (for a video, one representative frame) is also sent to the operator (sections 2 and 3). When reporting a voice comment, if the reporter chooses "Send the reported recording too", that one recording is also sent to the operator (sections 2 and 3). Tapping "Report AI text" on a memory sends that memory's AI title and caption text to the operator (section 2). Messages and pictures you send through Settings > Contact us are received so that the operator can read and answer them (section 2). We don't collect names, phone numbers or email addresses in the app.

2. Information the server processes, and why

• Device public keys and the device IDs made from them, the IDs of the spaces you belong to and your membership status, and when you joined and were last online: to check space membership, to sync, and for "Take over from my old phone"
• Encrypted change records (albums, comments and so on): kept so that members who were offline can receive them later
• Invite codes: deleted when they expire
• Join requests: the requesting device ID and time. A request not accepted within 7 days expires; only the device ID stays, so the phone can be told the request expired, until the space is removed.
• Space names: received so the operator can recognize the space when answering support requests and on the operator's admin screens, and to name the space in notices before an unused space is removed. Kept while the space exists and deleted when the last member leaves or the space is removed (section 3).
• Push tokens (Firebase Cloud Messaging; on iPhone, through the Apple Push Notification service) and notification language: for notifications about new activity. Notifications contain no photo or comment content and no people's names, only counts by type, such as "3 new photos" (notices before an unused space is removed include the space name so you know which space it is). The posting phone reports these counts, and they are deleted when the receiving member opens the app. We also keep the device IDs of members you have hidden with "Hide" and your notification settings (the types of notifications you turned off), so that we don't notify you about those people's activity or the types you turned off.
• Connection information (temporary IP addresses and the like): used only to set up direct connections between phones; the server doesn't keep this connection information (the IP address of each request to the server is in the "Server request logs" below). When phones connect directly, your phone and other members' phones in the space exchange IP addresses, so a member's phone connected directly to yours can know your IP address while connected.
• Server transfer (relay): when a direct connection isn't possible, the operator's relay server (Oracle Cloud, Seoul region, or Cloudflare Realtime TURN when it has a problem) passes encrypted data along. It doesn't store the content. While connecting, the relay server processes the phone's IP address and account ID. Relay credentials are issued per person (account), are valid only for a short time (1 hour), and are issued only within the fair use limit.
• Account information: the account ID made from the account key's public key (= your support code) and the device IDs linked to that account. We receive these so you can keep your subscriptions and purchases on a new phone and so we can answer support requests. We don't receive names, email addresses or Apple/Google account details.
• Server transfer usage: the amount each account ID used per month, a value identifying each relay connection and the bytes received through it, the bytes uploaded for holding, relay usage totaled by the relay server per account ID, and usage per member within a space. Used to count the fair use limit; the per-space records are also used for the "Space usage numbers" below.
• First-use offer: per account ID, when the offer started (when you first created or joined a space) and the bytes uploaded for holding during it, and the total bytes held with the first-use offer by all users. Used only to give the offer once per person and to count its holding limits.
• Server transfer records: when photos or videos pass through the relay server or holding, we record when, in which space, the sending and receiving device IDs, the number of bytes, and whether a held file was picked up. We use them to find the cause when you contact us about photos not arriving. We don't record the content of photos or videos, file names, or which photo it was. For connections through the relay server, we separately record the bytes received and sent, the time taken, the round-trip delay, the country and the platform, without device IDs, to check relay quality by country.
• Spaces created: to stop spaces being created excessively, we count how many spaces each device ID created in the last 30 days.
• Purchase records (Extra space): the store transaction ID (or order number), the item, the account ID and device ID that bought it, the time of purchase, and the IDs of spaces you created. We receive these to avoid applying the same purchase twice, to count how many spaces you can create, and to handle refunds.
• Holding (Moa Plus): photos and videos posted by members using Plus (including the first-use offer) that some members haven't received yet are kept as files encrypted with the space key, together with the device IDs of the members who are to receive them. File names are also values made with the space key, so it isn't possible to tell which photo is which.
• Report records (the reporting device ID, the IDs of the reported photo, comment or member, the posting device ID, the reason, and, for a reported comment, the comment text): kept for 180 days to handle reports, then deleted
• Photo and video deletion order records: the record of an order by the operator to delete a reported photo or video (space ID, photo or video ID, time, signature, and the operator's note on why) and the IDs of devices that confirmed deleting it. Kept while the space exists so the deleted photo or video cannot come back into it, and deleted when the space is gone. We do not receive the photo or video content or name.
• Reported photo or recording (optional): only when the reporter chooses "Send the reported photo too" while reporting a photo or video, we receive that one photo (for a video, one representative frame); only when the reporter chooses "Send the reported recording too" while reporting a voice comment, we receive that one recording (up to 1 minute). Only the operator sees or listens to it, to handle the report, and we don't receive any other photos or recordings.
• AI text reports (optional): when you tap "Report AI text" in a memory's ⋯ menu, we receive that memory's AI title and caption text, the reporting device ID and the type of on-phone AI. No photos are received. Kept with report records for 180 days, then deleted.
• Restriction records: the device or space IDs whose use is restricted, kept until the restriction is lifted so it can be enforced.
• Operator action log: the type of action the operator took (restricting or lifting, handling reports, ordering a photo or video deleted, clearing holding storage, granting Plus time and so on), the account, device or space IDs and photo or video IDs concerned, the operator's note, and the time. Kept for 1 year to check that operator tools are used properly.
• Server request logs: each time the server handles a request, we record it (IP address, country, request method and address, time, result and time taken, and the device ID when the request is signed by the device). We don't record the request's content or the values after the address (query). Used only to look into outages and abuse, to answer requests from investigative agencies and others made under the law, and for the operator to see which country a device connected from when handling an inquiry or report, and kept for 3 months. Separately, Cloudflare keeps an error log (IP address, requested address, time, result and errors) for up to 7 days.
• Coupon redemption records (optional): when you use a coupon on the web coupon page, we keep the coupon code, the support code you entered (account ID), the time it was used and the Plus period added. To prevent brute-force guessing, failed attempts are counted per IP address for 1 hour only.
• Moa Plus subscription check records (account ID, device ID, store transaction ID or Google purchase token, plan, expiry date) and Plus time records (coupons and operator grants: account ID, end date, source, note): to check subscription status and to link Google Play plan changes and resubscriptions. Deleted automatically 30 days after expiry (or cancellation or refund)
• Diagnostics (optional): only when you turn on "Send diagnostics" in Settings, we receive them to find out why the app isn't working well. They contain the device ID, app version, operating system type and version, language, network type (Wi-Fi or mobile data), sync figures such as the space ID and the number of members and photos, each space's sync progress (the numbers and counts of records sent to and received from the server, records waiting to be sent, and counts by record type), members' device IDs and when they were last connected, memory status (memory IDs and date keys, the device ID of the member who saved each one and when, the number of photos, and whether it shows on this phone), Plus, notification and on-device AI status, app setting values (mobile data, server transfer, auto-save, video quality and so on) and transfer progress, and app error logs. They don't contain content such as photos, videos, album or space names, memory titles, comments or nicknames. Every feature works the same without them, and you can turn them off at any time.
• Contact us (optional): when you send a message through Settings > Contact us, we receive its title, text and attached pictures (up to 3), your support code (account ID), the sending device ID, and the push token and language used to notify you when we reply. Only if you agree to "Send phone info and app logs too" do we also receive, with that message, the same items as diagnostics (above), the app log from the last 7 days kept on your phone, and, for each member who uploaded (device ID), how many of their photos haven't arrived yet and when that member was last connected. The app log records how the app worked, such as errors and transfer status; the phone keeps only the last 7 days and sends it only with a message you agree to. Please don't include other people's information in your text or pictures.
• Anonymous usage statistics: to fix and improve the app, we receive how often each feature is used (for example opening the app, creating a space, adding photos, likes, photos received or failed, making a video) and how long it took, how long each screen stays open (for example Home, the photo viewer, the sync screen), how long you use the app at a time and how many times a day, how many photos you swipe through in the photo viewer, and how often ads are shown and tapped in each ad spot. Times and counts are grouped into ranges on your phone (for example 10–30 seconds) before they are sent. They come with the app version, phone type (iPhone or Android) and the iPhone's major OS version, language, whether Plus is on, a range of days since install, and the country of the connection (worked out by the server). We don't store a device ID, account ID or IP address with them, so they can't be tied to you. They don't contain photos, videos, which photos you looked at, space or album names, comments, nicknames, search words or locations. In the European Economic Area, the United Kingdom and Switzerland, or when the country can't be told, the app asks the first time you open it, and they are recorded and sent only if you allow it. Elsewhere they are sent from the start. Wherever you are, you can turn them off at any time in Settings → "Send anonymous usage stats". Once you turn them off, nothing more is sent, and records kept on your phone that haven't been sent yet are deleted. On Android, the same switch also turns ad performance measurement (section 5) on and off.
• Space usage numbers: to run the service and manage our server costs, we receive for each space the number of photos and videos and their total original size (including per-uploading-device counts), and, for each device, the bytes it received from other members (split into received directly without our servers, through the relay, and from holding), together with the space ID and device ID. The phone reports the direct amount; the server counts the relay and holding amounts. These are numbers only: we don't receive the content of photos or videos, file names, or which photo it was. These numbers and transfer amounts are kept by month while the space exists and are deleted together with the space.
• Helping improve Moa (optional): only when you turn on "Help improve Moa" in the app's prompt or in Settings, the usage statistics above come with a randomly generated statistics number, and diagnostics (above) are sent too. The statistics number isn't linked to your device ID, and turning this off makes the app create a new number, so later records aren't linked to earlier ones. Every feature works the same without it.

3. How long we keep information, and deletion

• When you leave a space or are removed from it, that device's push token and notification state are deleted right away. A member who has left remains only as a device ID, not a name. That device ID, when you joined and when you were last online stay after you leave, until the space is deleted, so the remaining members can see who posted earlier photos and comments.
• A space's photos, videos, comments, name tags and other content are kept on members' phones, not on our server. When you leave a space, that content is deleted only from the app on your phone; what other members have already received (including what you posted or made) stays on their phones until each of them leaves the space (when the last member leaves, the space is gone). The operator can't directly delete content on members' phones; it can only order the deletion of photos and videos confirmed to break section 3 of the Terms, and each phone's app then deletes that photo or video together with the comments, reactions and name tags on it and the AI captions on it in memories, and changes the titles of memories that include it to their default titles (Terms, sections 2 and 8). The encrypted change records kept on our server (section 2) can't be read or changed by the operator, so this order doesn't change them; they are deleted when the space is gone.
• When the last member of a space leaves, all of that space's server records (members, encrypted change records, invite codes, notification state, space usage numbers) are deleted right away.
• If no member opens a space for 90 days, we notify members 30 days and 7 days before, then delete all of that space's server records (members, encrypted change records, invite codes, notification state, space name, held files, space usage numbers). We keep only a marker so a returning phone can be told the space was removed; it holds none of the space's content.
• While a space exists (until it is removed as above), its encrypted records are kept. You can ask for them to be deleted through Settings > Contact us.
• Server transfer records are deleted automatically after 3 months.
• Server transfer usage is kept by month for up to 13 months, and per-relay-connection records for 3 days, then deleted. Purchase records are kept for 400 days to handle refunds, then deleted. The number of spaces bought is kept while the account is in use.
• The first-use offer record (when it started and the bytes held) is kept as long as the account's server records exist, so that the offer is given only once per person.
• Account information (the account ID and linked device IDs) is kept while the account is in use; if you contact us, we delete the records for your device.
• Photo and video deletion order records are kept while the space exists and deleted when it is gone.
• Spaces-created counts are kept for 30 days, server request logs for 3 months (Cloudflare's error log for up to 7 days), and the operator action log for 1 year, then deleted. Restriction records are deleted when the restriction is lifted.
• Moa Plus subscription check records and Plus time records are deleted 30 days after expiry (or cancellation or refund).
• Files held with holding are deleted as soon as all receiving members have received them, and after 7 days at the latest. Files that weren't fully uploaded are deleted after one day.
• Photos and recordings received with a report are deleted as soon as the report is handled (resolved or dismissed), and in any case 30 days after we receive them.
• Coupon redemption records are kept until 180 days after the coupon's redemption period ends, then deleted (for coupons with no end date, until the operator cleans up the coupon).
• Diagnostics are deleted automatically after 30 days, and only the latest 20 are kept per device. Once you turn them off, nothing more is sent.
• Pictures attached to a support message and the phone info and app logs sent with it are deleted 30 days after the conversation is closed. A conversation is closed when you don't write again within 30 days of our reply. The messages themselves are deleted one year after the last one.
• Usage statistics (anonymous statistics and Help improve Moa records) are deleted automatically after 3 months. Once you turn them off, nothing more is sent.
• Deleting the app deletes Moa's photos and the device key on your phone (on iPhone, the device key stays in the Keychain until the app is installed again, and the app then discards it). The account key stays in iCloud Keychain or Google Block Store so a new phone can keep your support code and subscription (section 4). Deleting the app doesn't delete server records right away. Leaving a space in the app deletes your push token and notification state for it, and when the last member leaves, all of that space's server records are deleted. Records with a set retention period are deleted automatically when it ends. If you contact us, we delete your device's account information, diagnostics, support messages and spaces-created count sooner, and remove your device ID from reports you made. We keep, for the periods above, purchase and subscription records needed for refunds and subscription checks, records needed to handle reports and restrictions, the operator action log, server transfer records, and space member records (deleted when the last member leaves).

How we delete: information whose retention period has ended or whose purpose has been met is deleted automatically on the schedule above, or right away by the operator after checking. All information on the server is electronic and is deleted so that it can't be recovered. We keep no paper records. If another law requires us to keep some information, we keep it separately for that period and then delete it.

4. Phone permissions and information processed only on your phone

• Camera: used to read invite QR codes and to take photos and videos in the app (the Moa camera, taking a photo with the phone's own camera, and taking a photo in Large view). Photos and videos you take stay on your phone until you post them to a space.
• Microphone: used to record sound when you take a video in the app and to record voice comments. Voice comments travel to members encrypted with the space key, and the operator can't hear them. The exception is when someone reporting a voice comment chooses "Send the reported recording too": that one recording goes to the operator (sections 2 and 3).
• Photos: used to add the photos you pick to an album and to save received photos to your photo library. When you take part in "Collect photos", the app finds the photos you took on the requested days in your phone's photo library and shows them to you; only the ones you choose are posted to the space. Your other photos never leave your phone.
• Photo locations: off by default. Only if you turn on "Send photo locations" in Settings, the locations of the photos you post are encrypted with the space key and sent to members (the operator can't see them). On Android, turning this on asks for photo access so the app can read the location in the original photo.
• Place names: to show the place name of a photo with a location, the app sends its coordinates to your phone's built-in geocoder (Apple on iPhone, Google on Android). These coordinates are not sent to the operator's server, and Apple's or Google's privacy policy applies. When you search photos by place name or set a photo's location by typing a place name, the words you type are sent the same way (on iPhone, this includes the words you type in the photo search box).
• Maps: to show a photo's location or Places on a map, the app uses Apple Maps on iPhone and Google Maps on Android. To load the map images for the area you're viewing, Apple or Google processes your phone's IP address and the map area. This isn't sent to the operator's server, and Apple's or Google's privacy policy applies (Apple, Google).
• Photo search: the first time you search photos by describing them, the app downloads a search model file from the operator's server (Cloudflare); like any request, it appears in the server request logs above (IP address and time). Only if that fails does it download the file from Hugging Face, which then processes your phone's IP address. After that, analyzing and searching photos happens on your phone. Your photos and search words are not sent to the operator's server. The analysis results (values used for search) are shared with members of the same space, encrypted with the space key, and the operator can't see them. On iPhone, so you can also find photos by place, the words you type in the search box are sent to Apple's map search (see "Place names").
• People: works only in spaces where the owner turned it on and every member agreed. Faces are found, compared and grouped only on each member's phone (the face model is downloaded from the operator's server (Cloudflare) on first use, which appears in the server request logs; only if that fails does it come from GitHub, which then processes your phone's IP address), and face data and groups are never sent to the operator's server or to other members. Name tags members add (which face position in which photo, and which member or typed name it is), along with whether it is on and each member's answer, travel only to members of the same space, encrypted with the space key; the operator can't read them.
• Keeping and deleting face data (People): for each face in a photo, People uses the face model to make a face template of 128 numbers, used only to group photos of the same person. Face templates are kept in Moa's storage on each phone, per space; they are never sent to the operator's server or to other members, and are never sold or given to anyone. They are deleted on each phone when it opens that space: 7 days after the space owner turns People off or a member says no or withdraws their answer, 30 days after it pauses waiting for a new member's answer, or right away if the space owner chooses "Delete face data now". Name tags added before then no longer show. When you leave a space, the face templates for that space on your phone are deleted right away. Because each phone makes face templates itself from the photos on it, when you leave a space, the templates other members' phones made (including of your face) and the name tags added in the space stay on those phones until they are deleted as above or that member leaves the space. Deleting the app also deletes the face templates on that phone.
• Memories AI edit: on supported phones, the AI built into the phone (Apple Intelligence on iPhone, Gemini Nano on Android) picks a memory's title, scene captions and order. This happens only on your phone; no photos or space information are sent to an outside AI service. To pick photos for memories, the phone that posts a photo counts the faces in it and how many are smiling or have their eyes closed, and shares these counts with members, encrypted with the space key. The counts don't identify anyone, and this works whether or not People is turned on.
• Motion sensors: used only by the Moa camera to know the phone's direction and tilt, so photos come out upright and a level can be shown.
• Home Screen widget: the space photos shown in the widget are kept only in Moa's own storage on your phone.
• Notifications: used for new activity (new photos, comments, likes on your photos, join requests and so on), when a member is waiting for your photos, the operator's replies to your messages, notices before an unused space is removed (section 3), and app update notices. The phone also shows its own notifications, such as photos you haven't received yet and memories.
• Background transfer (Moa Plus, including the first-use offer): while you use Plus, uploads continue after you leave the app. On Android, an "uploading" notification (foreground service) shows while it runs, and files left over are also uploaded by a scheduled system job. On iPhone, the system's background upload and scheduled background processing are used; if you swipe the app away to close it, uploading stops until you open Moa again. If you turn off "Use server transfer" in Settings, holding doesn't happen.
• Account key: so a new phone can keep your support code and subscription, the app keeps the account key in your iCloud Keychain (iPhone) or Google Block Store (Android; backed up end-to-end encrypted when the phone has a screen lock). The operator never receives the account key, only the account ID made from its public key (section 2).
• Tracking (iPhone): the app asks for App Tracking Transparency permission before any ads load. If you haven't decided yet, it asks when you open the app, and on a new install it asks the first time you open the app. If you've been using Moa Plus without ads on this phone, though, it doesn't ask when you open the app; it asks before the first ad loads after Plus ends (section 5).

All phone permissions Moa asks for are optional; without one, only the features that need it stop working. Moa doesn't use your phone's location (GPS) permission. You can turn permissions off at any time in your phone's settings.

5. Ads, tracking and automatic collection

On the free plan, Google AdMob ads are shown in the app. To show ads and measure them, the Google Mobile Ads SDK in the app sends Google information such as the advertising identifier (IDFA on iPhone, advertising ID on Android), IP address and device and app information, under Google's privacy policy. Moa doesn't use web cookies.

• On iPhone, the app asks for App Tracking Transparency (ATT) permission before any ads load (on a new install, the first time you open the app; see section 4 for when). If you don't allow it, the IDFA isn't used; how much ads are tailored is up to Google's policies.
• In regions where the law requires consent (such as the EEA and UK), the app shows Google's consent form (UMP) before ads, and you can change your choice in Settings → "Ad privacy settings".
• How to opt out: on iPhone, go to Settings → Privacy & Security → Tracking and turn Moa off; on Android, go to Settings → Privacy → Ads and delete or reset your advertising ID (menu names vary by phone). If "Ad privacy settings" appears in the app's Settings, you can change it there too. Every feature still works if you opt out.
• While you use Moa Plus, the app doesn't load ads.
• Ad performance measurement (Android): to learn whether people who installed the app from a Moa ad start using it, Google Analytics for Firebase in the app sends Google an app-instance ID and the advertising ID, together with the fact that the app was opened for the first time and that a space was created or joined. Basic records Google Analytics makes by itself, such as app session starts, time in the app, app updates and uninstalls, purchases, and ad views and taps, along with device and app information and an approximate location worked out from the IP address, go with them. Names, photos and videos, space and album names and IDs, and comments are not sent, and screen tracking and ad personalization signals are turned off. It is sent only while Settings → "Send anonymous usage stats" is on; once you turn that off, nothing more is sent, and the measurement records kept on your phone are deleted. It isn't sent on iPhone, or in the European Economic Area, the United Kingdom and Switzerland or when the country can't be told (where the app asks about anonymous usage statistics first). (Sharing with a third party, section 8)

6. Processors and systems

• Cloudflare, Inc. (USA): running the server and storing data (including photos and recordings received with reports, and held files), server request logs, and the backup server transfer relay (Realtime TURN) — the information in section 2, for the periods in section 3
• Oracle Corporation (Oracle Cloud Infrastructure, Seoul region): running the server transfer relay server — the IP address and account ID while relaying, and relay usage
• Google LLC (USA) Firebase Cloud Messaging: push notifications — push tokens and notification text
• Code Town, Inc. (Shorebird, USA): delivering app updates (patches) — when the Android app starts or comes back to the front, it sends the app version, patch number, a random value created per install and its IP address to check for a new update. It doesn't send what you use the app for, such as photos, names or comments.
• Apple Inc. (USA) Apple Push Notification service: delivering notifications on iPhone — push tokens and notification text
• Google LLC (USA) Google Play: checking Android subscriptions — Google purchase tokens
• Apple Inc. · Google LLC: payments for subscriptions and Extra space — each store handles payment, and the operator doesn't receive card details.

7. International transfers

Some of these companies are located abroad, so while you use the app, the information below is transferred to servers in those countries. Under Korea's Personal Information Protection Act (Article 28-8(1)(3)), these transfers are outsourcing and storage needed to provide the service, disclosed in this policy. The Oracle relay server is in Seoul, so it is not an international transfer. Information sent to Google (USA) for ads and for ad performance measurement (Google Analytics on Android) is a disclosure to a third party, described with its country in section 8.

Cloudflare

Google (notifications and subscription checks)

Shorebird (app updates)

Apple (iPhone notifications)

For people in the EEA and UK: the operator is based in the Republic of Korea, for which the European Union has adopted an adequacy decision. Our processors are located in the United States and Korea (section 6), and Cloudflare may process data in its data centers worldwide. Transfers to them rely on the processors' standard contractual clauses and other safeguards they provide.

8. Sharing with third parties

We don't sell personal information. However, on the free plan, the Google ads SDK in the app sends Google the advertising identifier and other information (section 5), which Google uses to show and measure ads and for personalized ads. Because Google also uses it for its own purposes, this is a disclosure to a third party, transferred to the United States, as follows.

Also, on Android, while "Send anonymous usage stats" is on, Google Analytics for Firebase in the app sends Google ad performance measurement information (section 5). Google uses it to measure ads and to optimize Moa's ads, so this too is a disclosure to a third party, transferred to the United States, as follows.

Apart from that, we don't provide personal information to third parties. We share information only where the law specifically requires it, such as when an investigative authority requests it through the procedure set by law. Even then, the operator can't read encrypted photos, videos or comments, so they can't be provided. Sending photos and comments to members of your space is sharing you do yourself.

9. Controller

The controller responsible for your personal information is 예인 (대표 이호민), the operator of Moa, an individual business based in the Republic of Korea, at 경기도 남양주시 두물로39번길 34-14, 401호 (별내동). The operator's email is moa@hmini.me. The operator is also the privacy officer (see section 17).

10. Legal bases (EU/UK)

If you are in the European Economic Area or the United Kingdom, we rely on these legal bases under Article 6 of the GDPR (and the UK GDPR):

• Performance of the service (contract): syncing spaces, join requests, push notifications, relay and holding, background upload, purchases and subscriptions, your account and support code, and answering messages sent through Contact us.
• Legitimate interests: keeping the service secure, preventing abuse, handling reports (including any reported photo, recording or AI text the reporter chooses to send) and restrictions, server request logs, the operator action log, limiting failed coupon attempts, and space usage numbers (photo and video counts, sizes and transfer amounts per space) for running the service and managing server costs.
• Consent: personalized ads (in the EEA and UK we ask through Google's consent form, and you can change your choice in Settings → "Ad privacy settings"; on iPhone, also the tracking prompt), sending photo locations, optional diagnostics and the phone info and app logs sent with a message, anonymous usage statistics (in the EEA, UK and Switzerland we ask the first time you open the app, before any are recorded or sent) and Help improve Moa. You can withdraw consent at any time in Settings.
• Legal obligation: keeping purchase records where the law requires it.

Whether you have to give us information: no law requires you to. The information processed for performance of the service is made by the app as you use Moa and is needed to provide it under our terms; without it, Moa can't work. Information based on consent, and messages through Contact us, are optional; if you don't provide them, only that feature isn't available.

Automated decisions: we don't make decisions about you based solely on automated processing, including profiling, that have legal or similarly significant effects on you. Personalized ads, if you allow them, are chosen by Google (section 5).

11. Your rights

You can ask to access, correct or delete your personal information, to stop or restrict its processing, or to object to it, and (depending on where you live) to data portability. You can withdraw consent at any time without affecting earlier processing. A legal representative or someone you authorize can also make a request; please include proof of the authorization. Send requests through Settings > Contact us in the app, and we will answer within 10 days. If you've deleted the app, you can ask by email as described on the data deletion page, which also lists what we delete and what we keep. A request may be limited where the law requires us to keep the information or where it would infringe someone else's rights; we will tell you why.

Because Moa has no sign-up accounts, we identify your request by your support code, which goes with every message you send through Contact us. Some things you can do yourself in the app: turn off diagnostics, usage statistics and photo locations in Settings, and leave a space to delete your push token and notification state for it right away (when the last member leaves, all of that space's server records are deleted). Your photos, videos, comments and other content are encrypted and kept on members' phones, so the operator can't read or export them; you can find them on your own phone.

You can also complain to your local data protection authority. In Korea, you can contact the Personal Information Dispute Mediation Committee (1833-6972, www.kopico.go.kr), the Personal Privacy Infringement Report Center (118, privacy.kisa.or.kr), the Supreme Prosecutors' Office (1301, www.spo.go.kr) or the Korean National Police Agency cyber bureau (182, ecrm.police.go.kr).

12. Security

• End-to-end encryption: photos, videos, comments, voice comments, album names, nicknames and photo locations are encrypted with the space key on members' phones, and the operator can't see them.
• Encryption in transit: all traffic between the app and the server uses HTTPS (TLS), and relay and holding handle only encrypted data.
• Least access: only the operator can access server information, and operator tools can be used only by an authenticated operator. Operator actions are logged for 1 year.
• Minimal retention: server request logs are kept for 3 months, diagnostics for 30 days and usage statistics for 3 months, and we don't receive card details.

13. US state privacy (e.g. California)

• We don't sell personal information for money.
• Showing AdMob ads on the free plan may count as "sharing" personal information for cross-context behavioral advertising under some state laws. You can opt out with the tracking prompt on iPhone or the ad settings on Android, or by using Moa Plus, which doesn't load ads.
• Ad performance measurement on Android (section 5) can be turned off with Settings → "Send anonymous usage stats".
• We don't use or disclose sensitive personal information.

14. Children

Moa is a photo app for a general audience. Children under 14 need the consent of a parent or legal guardian to use it (in some EU countries, people under 16 need a parent's consent). In the United States, Moa is not for children under 13, and they may not use it. Moa doesn't ask you to enter your date of birth or age, and doesn't ask for your name or contact details. The app does check on your phone whether it can be used, based on the age range (for example, 18 or older) and parental approval that Apple or Google provides. It does this once when your phone has no result yet (for example, the first time you open the app after installing it); if the store doesn't answer, nothing is kept and the app checks again the next time you open it. Once there is a result, it checks again only on the screen that limits use, when you tap "Check again" or come back to the app (for example, after verifying your age in the store or Settings), and on iPhone (iOS 26 or later) when you tap "Age check" in the app's Settings. On iPhone (iOS 26 or later), Apple's age range sharing sheet may appear during the check, and you choose whether to share. Only where the law requires it (US store accounts that the store says the check applies to) can the result limit use of the app; anywhere else, you can keep using Moa whatever you choose. The age range is used only for this check and is never stored or sent to us; your phone keeps only the result (whether the app can be used and, if not, why). If a child uses Moa, we process the information in section 2 in the same way. A parent or guardian can ask to access or delete a child's information (section 11).

15. Changes to this policy

When we change this policy, we announce what changes and when it takes effect in the app or on our website (moa.hmini.me) at least 7 days in advance, or at least 30 days in advance if the change is unfavorable to you.

16. Language

This English version is a translation for convenience; the services are the same in every language.

17. Contact

• Operator and privacy officer: 예인 (대표 이호민)
• Address: 경기도 남양주시 두물로39번길 34-14, 401호 (별내동)
• Phone: 010-4163-6626
• Business registration number: 831-01-01981
• Mail-order business report number: 제2026-별내-2127호
• Email: moa@hmini.me

Send questions, requests to see, correct, delete or stop processing your personal information, and appeals against restrictions through Settings > Contact us in the app. Your support code goes with it, so you don't need to add it, and we answer within 10 days.