Privacy Policy

Hindsight (the “Service”) is operated by [COMPANY LEGAL NAME] (“we,” “us”), business registration no. [BUSINESS REGISTRATION NO.], represented by [CEO/OWNER NAME], located at [BUSINESS ADDRESS], Republic of Korea. We are the controller responsible for the personal information processed through the Service.

Questions about privacy can be sent to [PRIVACY CONTACT EMAIL]. Our designated Chief Privacy Officer is [CPO NAME], reachable at the same address.

We collect only what the Service needs to work:

• ·Account information — your email address, and an authentication record managed by our login provider. We do not store your password.
• ·Your journal entries — the text you upload or write, along with dates and any tags or emotion labels generated from it. Because journals can reveal health, beliefs, relationships and other sensitive matters, we treat all entry content as sensitive personal information.
• ·Analysis results — the summaries, patterns and “portrait” we generate from your entries, cached so we don’t re-read the same archive on every visit.
• ·Usage and technical data — limited logs such as analysis counts, rate-limit records, error logs, and standard request metadata (e.g. IP address, browser type) used to operate and secure the Service.
• ·Payment information — if and when paid plans launch, card payments are handled by our payment processor. We receive a billing token and transaction status; we never see or store your full card number.

We use your information to provide the Service: to store your archive, to generate the analyses you request, to maintain your account and quota, to process payments where applicable, to keep the Service secure, and to respond to your support requests. We do not use your information for advertising, and we do not use your journal content to train any AI model — ours or anyone else’s.

To analyze your writing, the relevant entry text is sent to third-party AI and infrastructure providers that process it on our behalf. These providers act under contract and are not permitted to use your content to train their models. Our current providers are:

• ·Anthropic (Claude) — generates the written analyses from your entries and powers “Ask your journals.”
• ·Supabase — hosts the database and authentication where your account and archive are stored.
• ·Vercel — hosts and serves the application.
• ·A payment processor (Toss Payments) — processes card payments if you subscribe to a paid plan.
• ·An email provider — sends account emails such as sign-in and confirmation messages.

Some of the providers above process and store data on servers located outside the Republic of Korea, including in the United States. By using the Service you acknowledge that your information — including entry content — may be transferred to and processed in those countries to provide the Service. We rely on these transfers because they are necessary to perform the Service you have requested.

We keep your entries and analyses for as long as your account exists, so your archive is there when you return. You can delete all of your entries and analyses at any time from Settings, and you can delete your entire account, which permanently removes your data from our database (provider backups roll off on their own retention cycles). We keep limited records longer only where the law requires it — for example, certain transaction records under Korean e-commerce law.

Wherever you live, you can access, correct, export, or delete your archive directly in the app, or by contacting us. Under Korea’s PIPA you may also withdraw consent and request that processing stop. If you are a California resident, the CCPA/CPRA gives you the right to know what personal information we collect, to access and delete it, to correct it, and to not be discriminated against for exercising these rights.

We do not sell or share your personal information, and we do not process it for cross-context behavioral advertising. To exercise any right, email [PRIVACY CONTACT EMAIL]; we will verify your request against your account and respond within the period required by applicable law.

Your data is encrypted in transit. Access is isolated per account at the database level so one user cannot read another’s archive, privileged operations run only on our servers, and access to production systems is limited. No system is perfectly secure, but we design for the sensitivity of what you trust us with.

We use only the cookies necessary to keep you signed in and to operate the Service. We do not use advertising or cross-site tracking cookies. Because we do not track users across other websites, we do not respond differently to browser “Do Not Track” signals.

The Service is not directed to children. You must be at least 14 years old (or the minimum age in your country, whichever is higher) to use Hindsight. We do not knowingly collect information from children below that age; if we learn that we have, we will delete it.

We may update this policy as the Service evolves or the law changes. We will revise the “Last updated” date above and, for material changes, give notice in the app. For any privacy question or request, contact [CPO NAME] at [PRIVACY CONTACT EMAIL]. You may also lodge a complaint with Korea’s Personal Information Protection Commission (PIPC) or your local data protection authority.