Privacy Policy

Article 1 (Personal Information Collected and How It Is Collected)

① Plan-ish Go (the “Service”) collects the following personal information for membership registration and to provide the Service: 1. When registering with email: email address 2. When logging in with a Google account (collected via the authentication service Supabase Authentication): email address, profile name 3. Information the User voluntarily enters while using the Service: a nickname (shown publicly instead of the email address on reviews, comments and notifications), trip title and dates, place names, notes, plans, budget and spending, and other trip-related information 4. Device GPS coordinates, collected only momentarily when the User taps the “Save location” button (used only to build a map link for that plan item; the coordinates themselves are not stored separately) 4-1. Device GPS coordinates, collected only momentarily when the User taps the “Stamp” button (used only to check that the User is near that place; the coordinates are not stored — only a record of which place's stamp was received and when is kept, and it is visible only to that User) 4-2. Device GPS coordinates, collected only momentarily when the User taps “Find places near me” on the add-place screen (used only to find nearby place candidates; for this, the Service's server queries a public lookup server that uses OpenStreetMap data (Photon by komoot) for places around those coordinates. The coordinates are not stored — only the name and location of a place the User creates by tapping “Save here” are stored as that place's information) 5. If the User consents to notifications in the Android app: a device identifier token used to deliver push notifications (Firebase Cloud Messaging) 6. Information generated and collected automatically: access logs, etc. (within the scope typically collected by the hosting provider, Vercel, for operational purposes) ② The Service supports anonymous sign-in, which can be used without registering as a member; in this case no personal information such as an email address is collected at all. ③ The Service does not provide a feature to upload photos or videos to the Service's own servers. A photo a User selects using the “Attach photo” feature stays in that User's own Google Drive, and the Service stores only a link to that file. ④ The Service does not provide payment functionality, so it does not collect payment-related personal information such as credit card or bank account numbers. ⑤ When a User uses the “Report” or “Block” features, the report reason and details and the list of blocked users are stored. Report records are kept to verify policy violations and handle disputes, and are deleted when the reporting User deletes their account.

Article 2 (Purposes of Collecting and Using Personal Information)

The Operator uses the personal information it collects for the following purposes: ① Member management, including member identification, verification, and prevention of fraudulent use ② Providing the Service, including storing and serving each User's own trip data separately from other Users' ③ Delivering notices, such as announcements and notices of Service changes or discontinuation ④ Reviewing and responding to feedback (inquiries) sent by Users ⑤ Statistical analysis to improve the Service (processed in a form that cannot identify an individual)

Article 3 (Retention and Use Period of Personal Information)

① In principle, the Operator destroys a Member's personal information and the trip data that Member registered without delay upon account deletion. ② Where retention is required under applicable law, the Operator retains the information for the period prescribed by that law. ③ If the Service is discontinued entirely, the Operator will destroy all remaining User personal information on its servers (including Supabase account information and trip data) without delay after providing advance notice.

Article 4 (Procedure and Method of Destroying Personal Information)

① A User's personal information is destroyed, either after being retained for a set period or immediately, once the purpose of its collection and use has been achieved, in accordance with the Operator's internal policy and applicable law. ② Information stored as electronic files is deleted using a technical method that prevents the record from being recovered (for example, by relying on a database structure designed so that deleting a Supabase account also deletes the associated trip data).

Article 5 (Outsourcing of Personal Information Processing)

To provide the Service smoothly, the Operator outsources certain personal information processing tasks to the external providers below, and sets out the matters required by applicable law in its contracts with them to ensure personal information is handled securely: ① Supabase, Inc. (Supabase Authentication) — member authentication (login/sign-up), trip database storage ② Upstash, Inc. — storage of certain data such as announcements and feedback (Redis database) ③ Vercel Inc. — hosting of the Service (website and servers) ④ OpenStreetMap Nominatim — receives the search text a User enters for a place name in order to convert it into coordinates (no information identifying the User is sent along with it) ⑤ Google LLC (Firebase Cloud Messaging) — delivering push notifications in the Android app ⑥ Google LLC (Google Analytics) — analyzing usage statistics of the Service (collects pages visited, referrers, approximate region, and device/browser information using cookies and online identifiers; no directly identifying information such as a User's name or email address is sent) ⑦ Details of how each of the above providers processes personal information can be found in their respective privacy policies.

Article 6 (Cross-Border Transfer of Personal Information)

① Supabase (Supabase Authentication), Upstash, Vercel, and other providers the Service relies on may operate servers located outside Korea, in which case a User's personal information may be transferred to and processed in another country. ② Specific details such as the items of personal information transferred, the recipient, the destination country, and the timing and method of transfer may change as these providers update their own policies; the Operator will reflect and disclose any such changes in this policy as they become known. ③ The Operator will use reasonable efforts, including through its contracts, to ensure that its outsourcing providers comply with the protective measures required by the Personal Information Protection Act and other applicable law.

Article 7 (Rights and Obligations of Data Subjects and How to Exercise Them)

① A User may exercise the following personal-information rights against the Operator at any time: 1. Request to view personal information 2. Request to correct errors, if any 3. Request to delete personal information 4. Request to suspend processing ② A request under paragraph ① may be made via the account-deletion feature in the Service or by emailing the Operator (see Article 10 below), and the Operator will act on it without delay. ③ A User may withdraw their consent to the collection and use of personal information at any time by using the account-deletion feature in the Service; upon deletion, all trip data registered under that account is deleted along with it.

Article 8 (Measures to Ensure the Security of Personal Information)

The Operator takes the following measures to ensure the security of personal information: ① User authentication is handled through a dedicated authentication service (Supabase Authentication) rather than a system built in-house, and the Operator does not directly store or manage passwords. ② Each User's trip data is separated using database access control (row-level security), so that only the owner can view or modify it; a trip is viewable by others only if the User has explicitly set it to “Public” or “Shared via link.” By default, the title and places of public trips may appear in Google and other search engine results, and the User can prevent this by turning off “Show in Google search” on the trip screen; if the User turns this off or makes the trip private, it is hidden in the Service immediately, but it may take some time to disappear from search engines. ③ Access to personal information is restricted to the minimum number of personnel necessary.

Article 9 (Installation and Operation of Cookies and Other Automatic Collection Tools)

① The Service stores an authentication token in the browser's storage (localStorage) to keep Users signed in. ② The Service stores “demo trip” data, which lets Users try the Service without registering, only in the User's own browser storage (localStorage); this data is never sent to the Operator's servers and is not synced across devices. ③ Users can restrict the use of cookies and storage through their browser settings, but doing so may make some features of the Service, such as staying signed in, difficult to use. ④ The web Service uses Adsterra to display advertising. Adsterra and its advertising partners may use cookies and advertising identifiers to collect device information for purposes such as personalized advertising; see Adsterra's own privacy policy for details. ⑤ Users can limit information collection for personalized advertising through their browser's own settings (blocking cookies, tracking-prevention features, etc.). ⑥ For Users located in the European Economic Area (EEA), the United Kingdom, or Switzerland, the Service obtains consent before using advertising cookies as required by applicable law, and Users may refuse or withdraw consent at any time. ⑦ The Android app displays advertising through Google AdMob, which may use the device's advertising identifier (advertising ID) to serve and measure ads. Users can reset or delete the advertising ID, or turn off ads personalization, in their device settings (Settings > Google > Ads). ⑧ The Service uses Google Analytics to analyze usage statistics, and Google Analytics collects visit records using cookies (such as _ga). The collected information is not linked to advertising (Google signals and ad personalization are disabled), and Users can refuse collection by blocking cookies in their browser or by installing the Google Analytics Opt-out Browser Add-on (tools.google.com/dlpage/gaoptout). Analytics cookies are not used by default for Users located in the European Economic Area (EEA), the United Kingdom, or Switzerland. ⑨ The Service stores the country and approximate location (city level, coordinates rounded to about 10 km) estimated from the User's IP address in cookies in the User's browser (plg_country, plg_geo, kept for 1 day), and uses them only to show nearby stamp tours and stamps first. This information is not stored in the Operator's database, and the device's location permission (GPS) is not used. ⑩ On place detail screens, if a trip plan or note contains a link to an Instagram post or a YouTube video, the Service shows that content directly using the official embed provided by that service (Instagram post embed, YouTube player). When this happens, the User's browser connects directly to the servers of Meta Platforms, Inc. (Instagram) or Google LLC (YouTube), and each company may process cookies, device information, and IP addresses under its own policies. YouTube videos are loaded from the privacy-enhanced address (youtube-nocookie.com). Video preview images shown in a trip’s “Collected” view are also loaded from YouTube's servers (i.ytimg.com). The Operator does not store the photo or video files of these posts and videos — only the link — and Users can close an embed with the “Hide” button. See the privacy policies of Meta and Google for details. ⑪ To show maps and place photos, the User's browser fetches map data and images directly from the external servers below. These servers may receive ordinary connection information such as the IP address, browser details, and the map area being viewed (the location of map tiles); the Operator does not attach the User's account or location to these requests. - OpenFreeMap (base map data and fonts), OpenStreetMap (some map images) - Wikimedia Commons (photos on place and trip cards) Each server handles this information under its operator's own policies.

Article 10 (Personal Information Protection Officer)

The Operator has designated the following Personal Information Protection Officer, who has overall responsibility for personal information processing and for handling User complaints and remedies related to it: Name: Juhan Park Email: plandiv0@gmail.com Users may direct any inquiries, complaints, or requests for remedy related to personal information protection to the email address above, or through the “Send feedback” feature in the Service, and the Operator will respond to and address such inquiries without delay.

Article 11 (Changes to This Privacy Policy)

① This Privacy Policy may be added to, deleted from, or otherwise amended as applicable law, policy, or security technology changes; when it is amended, the Operator will provide notice on the Service at least 7 days before the change takes effect (or 30 days before, for changes that materially affect User rights). ② This policy takes effect on August 30, 2026.