Privacy Policy
Version 0.5
This is a translation of the Korean original.
DANDI Lab, operated by LEE SEONKYU ("we"), processes your personal information as described below while operating Mukkidex.
1. Information we collect and why
| Category | Items | How | Purpose |
|---|---|---|---|
| Email sign-up | Email, password (stored encrypted), display name (optional) | Sign-up form | Identifying members, sign-in, confirmation and password reset emails |
| Google sign-up | Google account ID, email, name | Google sign-in | Identifying members, sign-in. We never receive your Google password or other Google data. |
| Profile | Handle (public address), nickname, profile photo, about me, interests and country (optional), dex visibility. Location data (EXIF) is removed from photos on your device before upload. | Generated automatically, Edit profile, settings | Showing your public profile and dex |
| Content you post | Posts (food, places, recipes), photos, comments, likes, dex marks, reports | You enter it | Providing the service, moderation (handling reports) |
| Photos | Image files. Location data (EXIF) is removed on your device before upload. | You upload them | Showing posts |
| Access logs | Sign-in history, IP address, browser information (User-Agent), requested address, time, and response | Automatic | Security (detecting unauthorized sign-ins and abnormal access), session management, access statistics (telling people from bots, country estimated from IP) |
| Inbox | Notices from the team, activity notifications (comments and likes on your posts, moderation actions and reasons, report results), read/starred/trash status | Automatic | Notifications, managing your inbox |
| Member messages and blocks | Messages you send and receive (sender, content, time), members you blocked, a send log for the daily limit (kept 7 days), the content of messages you report | You provide, automatic | Delivering messages, blocking, preventing spam, handling reports |
| Notification settings and promotional consent | Comment, reply, like and badge notification settings and whether you accept messages, whether you agreed to promotional messages (inbox, email) and when you agreed or withdrew | Settings | Notifications, sending news and promotions only if you agreed (we don't send promotional email yet), keeping consent records |
| Moderation records | Records and reasons for hiding, deleting and resolving reports by staff | Automatic | Transparency, dispute handling |
| Deletion statistics | Date of deletion and sign-up method. Nothing that identifies you. | Automatic on deletion | Service statistics |
We do not collect phone numbers, home addresses, dates of birth, payment information or location data. Addresses and map links in place posts are business details that you enter to share publicly.
3. Retention and deletion
| Item | Retention |
|---|---|
| Account, profile, posts, photos, comments, likes, dex marks | Deleted immediately when you delete your account (including photo files). |
| Inbox notifications | Deleted 30 days after you move them to the trash (except starred items), and immediately when you delete your account. |
| Reports you sent | The report stays as a moderation record after you leave, but your identity is removed. Retention period: to be decided |
| Moderation records (staff actions) | If the staff member leaves, only their identity is removed. Retention period: to be decided |
| Access logs | Web request logs are deleted automatically after 30 days (Google Cloud logs). Daily access statistics are kept only as numbers, without IP addresses. Countries are estimated from IP addresses with location data (DB-IP) on our server; IP addresses are not sent elsewhere. |
| Photos not attached to a post | Deleted automatically 24 hours after upload if the post is not saved. |
| Replaced or removed profile photos | Deleted automatically within 24 hours after they stop being used on your profile. |
| Promotional consent records | Kept after you withdraw consent, and deleted immediately when you delete your account. Retention period: to be decided |
| Backups | Deleted automatically after backup retention period. |
How we delete: records are deleted from the database and files from storage.
4. Processors and international transfers
To run the service, we store or transmit personal information with the following cloud providers.
| Recipient | Items | Country or region | Purpose |
|---|---|---|---|
| Supabase Inc. | All items in section 1 | Japan (Tokyo) | Database, authentication, file storage |
| Google LLC (Google Cloud) | Requests being processed, server logs | Japan (Tokyo) | Running the web service |
| Cloudflare, Inc. | IP address, request information, inquiry emails | Worldwide (nearest location) | Domain, security, delivery, forwarding inquiry emails |
| Google LLC (Google sign-in) | Sign-in requests | United States and others | Google sign-in (Google members only) |
| Resend (Plus Five Five, Inc.) | Email address, content of our replies | Japan (Tokyo), United States | Confirmation and password reset emails, replies to inquiries |
| Google LLC (Gmail) | Inquiry emails (sender address, content) | United States and others | Storing and replying to inquiries |
Transfers happen over the network while you use the service. You can refuse by not signing up or by deleting your account, in which case you cannot use the service.
5. Your rights
| Right | How |
|---|---|
| Access and correction | Change your photo, nickname, handle, about me, interests and country in Edit profile, and dex visibility, notifications and promotional messages in settings. Edit or delete posts and comments yourself. |
| Deletion | Settings → Delete account. Processed immediately after you type your handle (Google members confirm with Google first). |
| Restriction | Make your dex private, turn off promotional messages (Settings → Notifications), or delete your account. Otherwise, contact us (section 7). |
| Password | Settings → Change password, or Forgot password on the sign-in screen |
| Sign out everywhere | Settings → Log out of all devices |
If you signed up with Google, you confirm with Google once more when you delete your account, and we also remove Mukkidex from "Third-party apps & services" in your Google account. If that fails, we show you how to remove it yourself at your Google account connections. The Google access information received in this step is used only for that request and is not stored.
Removing the connection on Google's side does not delete your Mukkidex account (you just can't sign in with Google). To delete your account, use Mukkidex settings.
6. Security measures
- Row-level access control on every database table, so you can change only your own data.
- Passwords are encrypted by the authentication service and cannot be seen by staff.
- Admin features exist only in a separate console that requires two-factor authentication. Staff actions are logged.
- Encryption in transit (HTTPS). Server secrets are kept in a secrets manager.
- Location data is removed from uploaded photos.
7. Privacy officer and contact
Privacy officer: LEE SEONKYU (Representative) · Contact: support@mukkidex.com
Users in Korea can also report privacy violations to the Personal Information Infringement Report Center (privacy.kisa.or.kr, 118) or the Personal Information Dispute Mediation Committee (kopico.go.kr, 1833-6972).
8. Changes
We announce changes on the site 7 days before they take effect, or 30 days before for changes that significantly affect your rights. Previous versions are available on request.