English
Who we are
JC Studio operates Telepathy Memo (텔레파시 메모), package com.jcstudio.telepathymemo. This policy covers the app and this support website. Contact: whdcjf8172@gmail.com.
Data and purposes
Personal drawings, drafts and preferences are stored on your device. Rooms require no visible sign-in: Supabase Auth creates an anonymous installation account and stores its session securely. Starting or restoring Plus also creates this private account if needed, and RevenueCat links the purchase to its ID. Supabase processes your account ID, nickname, room name, capacity, memberships, private invitation code/hash and expiry, current shared drawing, revision, edit timestamps and delivery jobs. Private request receipts prevent duplicate creation, joins and saves; save receipts retain drawing hashes, not drawing history. Device registration uses an installation ID, Firebase Cloud Messaging token, notification preference and language. RevenueCat processes the app user ID, purchase/product and entitlement state, store, environment and expiry. Google Mobile Ads may process device or advertising identifiers, IP address, interactions and diagnostic data to request and measure ads, subject to the consent choices available in your region. We do not request contacts, microphone, camera or precise location access.
Login-free rooms and legacy identities
The current app does not offer Google sign-in or account recovery and does not request Google email or profile access. If an earlier test version linked a Google identity, removing the login UI does not automatically delete that identity from shared Supabase Auth or change other apps. Contact support about legacy identity deletion; verification and other-app dependencies are checked separately. Firebase push delivery is independent of Google sign-in.
Install and launch statistics
Production mobile builds send a separately generated random installation ID, random launch ID, platform, app/build version and device language to our Supabase analytics endpoint. Server timestamps and Korea-standard calendar dates are stored to count first launches, daily activity and launches. These records do not contain drawings, nicknames, emails, account IDs, partner IDs, push tokens or GPS coordinates. This is pseudonymous data, not a claim of complete anonymity; first recorded launches are not store download counts. Development and web previews do not submit these events.
Recipients and security
Everyone in a room can see and replace its shared drawing and see members' nicknames. Only its creator can retrieve an active invitation code; the creator chooses where to share it using their own messaging apps. Share text contains a six-digit code and one invitation URL on our Cloudflare site, not authentication tokens. The invitation also attaches a picture made on your device: the room's current shared drawing (or a blank paper with the day's prompt), your nickname and the code; it is sent only through the app you choose, and you can send text only instead. Opening that URL sends the code in the request address to Cloudflare, which may process it with the visitor's IP address and technical logs. The page offers an app-opening button and a Google Play installation link. That link passes the code to Google Play as an install referrer, so the newly installed app reads it once on its first launch to open the invitation. Anyone who obtains the code may join until it expires or fills the room. Supabase provides authentication, database and server functions; Firebase delivers encoded drawings to devices; RevenueCat manages Plus purchases; Google AdMob supplies ads; and Cloudflare hosts the public support pages. An owner-restricted Telegram bot displays aggregate statistics, not note contents or individual analytics IDs. Providers may process IP addresses and technical logs for operation/security, including outside your country. We use HTTPS and access controls, but notes are not end-to-end encrypted and delivery is not guaranteed. We do not sell personal data. Free users may see a banner above the bottom navigation on the main tabs. They may also see an interstitial only after a successful save, with a four-hour cooldown, no more than four in a rolling 24 hours and no more than two per app session. Plus users do not receive these ads. Development builds request test ads only.
International transfers
The providers below are headquartered or process data outside Korea, so the following personal information may be transferred abroad. Each transfer happens over encrypted HTTPS whenever you use the related feature.
· Supabase, Inc. (US company; database in the Seoul, South Korea region; privacy@supabase.io) — anonymous account ID, nickname, room name, capacity, memberships, invitation code/hash and expiry, shared drawing, revision, save times, delivery jobs and request receipts; installation ID, FCM token, notification preference and language; install/launch statistics / when you create, join or save rooms and when the app launches / authentication, rooms, widget delivery and statistics / rooms are deleted seven days after their last successful save; other records as described under Retention and deletion.
· Google LLC (USA; https://support.google.com/policies/contact/general_privacy_form) — Firebase Cloud Messaging: FCM token and encoded drawings; Google Mobile Ads (free users): device or advertising identifiers, IP address, ad interactions and diagnostics; Google Play billing: payment information; Google Play install referrer: the invitation code when the app is installed from an invitation page / when drawings are delivered, ads are requested, you buy Plus, or you install from an invitation / widget delivery, ad serving and measurement, payment, opening the invitation after installation / per Google's policies.
· RevenueCat, Inc. (USA; privacy@revenuecat.com) — app user ID, purchased product, Plus entitlement, store, environment and expiry / when you buy or restore Plus and when the app checks it / subscription verification / per RevenueCat's policy.
· Cloudflare, Inc. (USA; privacyquestions@cloudflare.com) — the invitation code in an invitation URL, the visitor's IP address and technical logs / when you open these pages or an invitation link / serving and securing the site / per Cloudflare's policy.
If you do not want these transfers, you can avoid the related feature or uninstall the app. Refusing the transfers needed to show ads may limit free use; Plus users do not receive ads, so no ad data is sent for them.
Retention and deletion
Personal notes remain on the device until you delete them or clear app storage. A room expires seven days after creation or its latest successful save. Viewing, joining and failed or duplicate saves do not renew this period. At expiry, access is denied; a scheduled cleanup deletes the room, its drawing, memberships, invitations, legacy shared history and request receipts from the active database. Room caches and unfinished room drafts are removed when the device next processes expiry or syncs; a powered-off, force-stopped or suspended device may clean them later. Leaving removes your membership and local room cache, not remaining members' room. Full rooms lose their invitation code permanently; an unfilled room's invitation shares the room's current deadline. External screenshots and copies cannot be remotely erased. The in-app deletion action removes the Telepathy profile, memberships, device registrations and local data, not shared Supabase Auth identities, independent analytics, store purchase history or the minimum subscription status needed to honor an active purchase. It does not cancel Plus; manage or cancel it in Google Play. RevenueCat and Google retain purchase and advertising records under their policies and legal obligations. Analytics currently have no automatic age-based purge. Limited provider backups/security logs may remain under their retention process or legal obligations and are not active app records.
Your choices and rights
You can use personal notes without pairing, disconnect, delete local notes, turn off notifications in system settings, and request access, correction, deletion, restriction or objection as applicable to your location. See account and data deletion or contact whdcjf8172@gmail.com. We ask only for information needed to verify a request; never send a password, OTP, invitation code or private drawing. If we cannot identify a disconnected random analytics record, we will explain the limitation. Depending on your region, you may contact your data-protection authority.
Privacy officer and remedies
Privacy officer: Jongcheol Lee (owner), whdcjf8172@gmail.com. We reply to access, correction, deletion and suspension requests within 10 days.
You can also contact these Korean authorities about a privacy infringement:
· 개인정보분쟁조정위원회 (Personal Information Dispute Mediation Committee): 1833-6972 (www.kopico.go.kr)
· 개인정보침해신고센터 (KISA Personal Information Infringement Report Center): 118, no area code (privacy.kisa.or.kr)
· 대검찰청 사이버수사과 (Supreme Prosecutors' Office Cyber Investigation Division): 1301, no area code (www.spo.go.kr)
· 경찰청 사이버수사국 (Korean National Police Agency Cyber Investigation Bureau): 182, no area code (ecrm.police.go.kr)
Website, children and updates
These pages use no analytics scripts, advertising tags, forms or non-essential cookies added by JC Studio. Cloudflare still processes network requests to serve and secure the site. The app is not directed to children under 13; any higher local minimum age or required parental permission also applies. Contact us if a child’s data needs removal. We will post policy changes with a new effective date and provide additional notice when required.
Provider policies
Google · Supabase · Firebase · RevenueCat · Cloudflare · Telegram
Policy history
November 1, 2026: invitations attach a picture of the paper, and an invitation page's Play link passes the code as an install referrer
October 25, 2026: shared rooms became free with no room-count limit, so Plus no longer needs a server room check
October 16, 2026: added privacy officer, international transfers and remedies
September 23, 2026: previous version