Flowin Privacy Policy
Unofficial English translation. The Korean text is the official version.
The Korean text is the official version. Read in Korean
Preamble
ALTIN (the "Company") values users' personal information and complies with the Personal Information Protection Act and related laws of the Republic of Korea. This Policy explains how the Company processes personal information through the Flowin mobile application (the "Service").
A separate privacy policy applies to the Company's website, alt-in.net.
Article 1 (Purposes of processing)
| Category | Purpose |
|---|---|
| Account management | Confirming an application to join, identifying and authenticating the user, maintaining membership, preventing account theft, delivering notices, confirming a request to leave |
| Providing the Service | Storing and syncing tasks and schedules, Project collaboration, Friend connections and Sharing, sending invitation and leadership-transfer emails, sending due and summary notifications, providing iCal feeds, displaying a profile photo |
| Advertising | Showing a banner ad at the bottom of the screen on the free plan. Pro and Pro+ do not show ads |
| Customer support | Receiving inquiries, verifying facts, replying with results, reviewing error reports |
| Improving the Service | Diagnosing errors, maintaining stability, optimizing the use environment |
| Safety and security | Preventing misuse, blocking unauthorized access, investigating Terms violations, retaining records for dispute resolution |
| Legal duties | Complying with statutory duties and responding to lawful demands of investigative or regulatory authorities |
Article 2 (Items processed and how they are collected)
1. Sign-up and sign-in
| Category | Items |
|---|---|
| Email sign-up (required) | Email address, password, display name |
| Google sign-in (required) | Email address, nickname (display name) |
| Kakao sign-in (required) | Email address, nickname (display name) |
If you sign up with a Google or Kakao account, the Company does not send an email verification message. The Company does not collect the Google or Kakao password. A profile photo that may be passed during sign-in is not stored as the Flowin profile photo.
Automatic sign-in — If you turn on automatic sign-in, information needed to sign in is stored on your device. It is not separately sent to the Company's servers, and it is removed when you sign out or delete the app.
2. Information generated while using the Service
| Category | Items |
|---|---|
| User Content | Tasks, schedules, comments, project names, and similar items you enter |
| Profile photo (optional) | A profile image you choose from the album or take with the camera |
| Relationship information | Friend connections, Project members and roles, Sharing recipients and permission scope |
| Contact information | Email addresses and names or nicknames you enter to add a Friend or send an invitation |
| Settings | Notification and display settings |
| Information for sending notifications | Device tokens for push notifications |
| iCal feed information | iCal feed tokens issued at your request |
3. Information collected automatically
Device model name, operating-system version, app version, language and country settings, time of access, and error information generated while using the Service
4. Third-party information you enter
If you enter a third party's email address and name or nickname to add a Friend, send a Sharing invitation, or send a leadership-transfer notice, the Company processes that information to send mail, confirm acceptance, and display Friends and contact lists, and retains it until you delete the item or the account-deletion procedure is completed.
The Company does not access your device address book.
5. Information the Company does not collect
The Company does not collect the following:
- Location information
- Contacts (device address book)
- Voice data
- Payment-method information such as credit-card or account numbers
The Company does not use a separate analytics or crash-reporting tool. Profile photos and advertising identifiers are described in paragraph 8 below and in Article 11.
6. Device calendar information
If you consent to calendar access, the Service adds, edits, or deletes tasks you created on the device calendar. Events already on the device calendar are not brought into the app screen and are not transmitted to or stored on the Company's servers. Calendar read permission is used only to the extent the operating system jointly requires it so that events the Service added can be edited or deleted.
7. iCal feed
If you issue an iCal feed, the Company stores on its servers the unique token that forms the feed address. Schedule data provided through that address can be accessed without a separate sign-in, so anyone who knows the address can view it. You may reissue the feed at any time in in-app Settings to invalidate the previous address.
8. Profile photo and advertising
- A profile photo is optional. An image you choose from the album or take with the camera is stored on the server and shown to you and to members of a Project you share. You can use the rest of the Service without uploading a photo.
- On the free plan, a Google AdMob banner is shown at the bottom of the screen. When an ad is requested, the device advertising identifier (AD ID) is sent to Google LLC. The Company does not store the advertising identifier on its own servers.
- Pro and Pro+ do not show ads, and those plans do not use the advertising identifier to request ads.
Article 3 (Retention periods)
| Category | Retention period | Basis |
|---|---|---|
| Account information | Until withdrawal. Kept in a restoration-pending state for 30 days after a deletion request, then destroyed or anonymized | Preventing mistaken withdrawal and misuse |
| User Content that is not Shared | Until you delete it or the account-deletion procedure is completed | Providing the Service |
| Tasks and comments in a Shared Project | Until the Project is deleted or another member deletes them. Identifying information such as name, email, and profile image is removed when the deletion procedure is completed | Providing the Service |
| Contact information (invitee email addresses, etc.) | Until you delete the item or the account-deletion procedure is completed | Providing the Service |
| iCal feed tokens | Until you reissue the feed, or until withdrawal | Providing the Service |
| Device tokens for push notifications | Until you turn notifications off, or until withdrawal | Providing the Service |
| Profile photo | Until you delete it or the account-deletion procedure is completed | Providing the Service |
| Advertising identifier | Not stored on the Company's servers. Processed by Google AdMob when the free plan requests an ad | Free-plan advertising |
| Inquiry and error-report records | 3 years from receipt | Handling inquiries and keeping a history |
| Records of misuse | 1 year from confirmation of misuse | Preventing recurrence and responding to disputes |
| Access logs related to use of the Service | 3 months | Protection of Communications Secrets Act |
Tasks and comments written in a Project may remain after account deletion for other members' use. Identifying information such as name, email address, profile image, and notification tokens is then removed, and the author is shown as a former member.
If the Company begins a Paid Service, it will retain records of contracts and withdrawals for 5 years, records of payment and supply of goods for 5 years, and records of consumer complaints or dispute handling for 3 years, under the Act on Consumer Protection in Electronic Commerce.
Article 4 (Provision to third parties)
- The Company does not provide personal information to a third party without the user's prior consent.
- Exceptions apply where a statute so provides, or where an investigative authority demands it under the procedures and methods set by law.
- If you add a Friend or Share content, the other party sees your display name and the Shared content. That is provision of the Service at your request and is not provision to a third party.
- If you give an issued iCal feed address to a third party, that third party can access your schedule data. That is your choice. You may reissue the feed to block access.
- To show a banner ad on the free plan, the advertising identifier is provided to Google LLC (Google AdMob). Pro and Pro+ do not show ads.
Article 5 (Entrustment of processing)
| Processor | Work entrusted | Retention and use period |
|---|---|---|
| Supabase, Inc. | Backend infrastructure including database operation, member authentication, and file storage | Until the processing arrangement ends or the user withdraws |
| Google LLC | Google account sign-in authentication, sending push notifications (Firebase Cloud Messaging), and showing free-plan banner ads (Google AdMob) | Until the processing arrangement ends or the user withdraws |
| Kakao Corp. | Kakao account sign-in authentication. Kakao provides the email address and nickname needed to sign up and sign in. | Until the processing arrangement ends or the user withdraws |
| Apple Inc. | Delivering iOS push notifications (APNs) | Until the processing arrangement ends or the user withdraws |
| Resend, Inc. | Sending authentication mail, Friend-request and Sharing-invitation mail, and leadership-transfer notices | Until the processing arrangement ends or the sending purpose is completed |
- When entering into an entrustment contract, the Company reflects in the contract or service terms the matters required by Article 26 of the Personal Information Protection Act, including prohibition of processing beyond the entrusted purpose, technical and organizational safeguards, limits on sub-processing, supervision of the processor, and liability for damages, and confirms that the processor processes personal information securely.
- If the entrusted work or the processor changes, the Company will disclose it through this Policy.
Article 6 (Cross-border transfer)
The Company transfers personal information abroad as follows in order to provide the Service.
| Recipient | Country | Time and method | Items | Purpose | Retention and use period |
|---|---|---|---|---|---|
| Supabase, Inc. ([email protected]) | Stored in the Republic of Korea (Seoul region). Operator located in the United States | Transmission over the network when you use the Service | Email address, display name, profile photo, User Content, relationship information, contact information, iCal feed tokens, device and access information | Operating database and authentication infrastructure; access for operation and technical support | Until the processing arrangement ends or the user withdraws |
| Google LLC | United States | Transmission over the network when you sign in with Google, when sending a notification, and when requesting an ad | Email address and nickname when you sign in with Google, device token for push notifications, notification content, advertising identifier (free plan) | Google account sign-in authentication, sending push notifications, and showing banner ads | Until the processing arrangement ends or the user withdraws |
| Apple Inc. | United States | Transmission over the network when sending a notification | Device token for push notifications, notification content | Delivering iOS push notifications | Until the processing arrangement ends or the user withdraws |
| Resend, Inc. ([email protected]) | United States | Transmission over the network when sending mail | Email address, display name, message content | Sending authentication, invitation, and leadership-transfer emails | Until the processing arrangement ends or the sending purpose is completed |
- Supabase stores data in the Seoul region of the Republic of Korea. Because the operator, Supabase, Inc., is a U.S. corporation that may access data for operation and technical support, the Company discloses this as a cross-border transfer.
- You may refuse a cross-border transfer. The transfers above are necessary to provide the Service, so refusal may limit sign-up and use of the Service.
- To refuse a cross-border transfer, write to the contact in Article 13.
- The Company requires the recipient to take protective measures under Articles 28-8 and 28-9 of the Personal Information Protection Act.
Article 7 (Destruction)
- Procedure — Personal information whose retention period has ended or whose processing purpose has been achieved is destroyed without delay or processed so that it can no longer identify an individual. If another statute requires retention, it is moved to a separate database or stored in a different place.
- Method — Information in electronic files is permanently deleted by a technical method that cannot reproduce the records. Printouts are shredded or incinerated.
Article 8 (Rights of data subjects and legal representatives)
- You may at any time exercise the following rights:
- Access to personal information
- Correction of errors
- Deletion
- Suspension of processing
- Suspension of a cross-border transfer
- You may apply to delete your account directly in the in-app Settings menu, and you may also exercise your rights by email to [email protected]. The Company will act without delay after verifying your identity.
- You may exercise rights through a legal representative or a person you authorize. In that case you must submit a power of attorney in the form in Attached Form No. 11 of the Notification on Methods of Processing Personal Information.
- The Company will act on a request for access, correction, deletion, or suspension of processing within 10 days and notify you of the result.
- Your request may be limited under Article 35(4) or 37(2) of the Personal Information Protection Act or similar provisions. In that case the Company will notify you of the reason.
Article 9 (Personal information of children under 14)
- The Company does not collect personal information of children under 14, and a person under 14 may not use the Service.
- If the Company confirms that personal information of a child under 14 has been collected, it will destroy that information without delay and delete the account.
- A legal representative of a child under 14 may request deletion of that account by email to [email protected].
Article 10 (App permissions and withdrawal of consent)
Under Article 22-2 of the Act on Promotion of Information and Communications Network Utilization and Information Protection, the Company requests access to the user's device only to the minimum extent needed to provide the Service, as follows.
1. Required permissions
Flowin does not require any required permission. You can use basic features such as creating, managing, and Sharing tasks and schedules even if you do not consent to any of the optional permissions below.
2. Optional permissions
| Permission | Purpose | If you refuse |
|---|---|---|
| Notifications | Sending due reminders, summary notifications, Friend requests, and Sharing invitations | You will not receive notifications; other features work normally |
| Calendar (write) | Adding tasks you created in the Service to the device calendar | You cannot export to the device calendar |
| Calendar (read) | Permission the operating system jointly requires so that events the Service added can be edited or deleted | You cannot use device-calendar linking |
| Exact alarm scheduling | Displaying a notification at the specified time | Notifications may be displayed late |
| Photos (album) | Choosing a profile photo | You can use the other features without uploading a profile photo |
| Camera | Taking a profile photo | You can use the other features without taking a profile photo |
Calendar read permission is not used to view or collect events already on the device.
3. Permissions used without a separate consent
The following are classified by the operating system as ordinary permissions and are used without a separate consent procedure. They do not access information stored on your device.
| Permission | Purpose |
|---|---|
| Internet access | Syncing data with the server |
| Boot completed | Re-registering scheduled notifications after a reboot |
| Vibration | Vibration when a notification is received |
4. Permissions the Company does not request
Flowin does not access location, contacts (address book), or the microphone. Adding a Friend and sending an invitation are done only by you entering an email address. Photos, the camera, and the advertising identifier are described in Article 2, paragraph 8, and Article 11.
5. How to withdraw permission
- Android — Settings > Apps > Flowin > Permissions > select the permission and turn it off
- iOS — Settings > Flowin > turn off the permission
Menu names and paths may differ by operating-system version. On Android versions below 6.0, selective permission is not supported, so you may withdraw permission by upgrading the operating system or deleting the app.
Article 11 (Automatic collection devices)
The Service does not use cookies. The Company does not track users with a separate analytics tool.
On the free plan, Google AdMob shows a banner ad at the bottom of the screen. In that process the advertising identifier (AD ID) is collected and sent to Google. It is used to show and measure ads, to prevent invalid clicks, and to limit how often an ad is shown. You can delete the advertising identifier or limit ad personalization in the device settings. Pro and Pro+ do not show ads.
Article 12 (Safeguards)
- Organizational measures — minimizing persons who handle personal information; establishing and implementing an internal management plan
- Technical measures
- Differentiated access rights and access control for personal-information systems
- One-way encryption of passwords stored on the server
- Encryption in transit (HTTPS/TLS)
- Isolation of each user's data through database row-level security
- Ability to reissue iCal feed tokens
- Retention of access logs and prevention of alteration
- Physical measures — applying the data-center security policy of the processor
Article 13 (Personal information protection officer)
| Item | Details |
|---|---|
| Personal information protection officer | Ro Hongseok |
| [email protected] |
You may contact the personal information protection officer about any inquiry, complaint, or remedy relating to personal information that arises while using the Service. The Company will reply and act without delay.
Article 14 (Remedies)
You may apply to the following institutions for dispute resolution or counseling regarding an infringement of personal information.
| Institution | Work | Phone | Website |
|---|---|---|---|
| Personal Information Dispute Mediation Committee | Application for personal-information dispute mediation, collective dispute mediation | 1833-6972 | www.kopico.go.kr |
| Personal Information Infringement Report Center | Reporting and counseling on personal-information infringement | 118 (no area code) | privacy.kisa.or.kr |
| Supreme Prosecutors' Office Cyber Investigation Division | Criminal complaint relating to personal-information infringement | 1301 (no area code) | www.spo.go.kr |
| Korean National Police Agency Cyber Bureau | Criminal complaint relating to personal-information infringement | 182 (no area code) | ecrm.police.go.kr |
A person whose rights or interests are infringed by a disposition or omission of the Company under Articles 35 (access), 36 (correction and deletion), or 37 (suspension of processing) of the Personal Information Protection Act may file an administrative appeal under the Administrative Appeals Act.
- Central Administrative Appeals Commission — 110 (no area code), www.simpan.go.kr
Article 15 (Changes to this Policy)
- This Policy applies from the effective date.
- If items are added, deleted, or amended because of a change in law, policy, or security technology, the Company will give notice through the app and the Company's website from 7 days before the change takes effect.
- For a material change that is unfavorable to users, the Company will give notice from 30 days before it takes effect and, if needed, obtain consent again.
- This Policy was first posted on 2026. 9. 23. At that time the sign-up items were an email address, a password, and a display name. The 2026. 10. 11. revision adds Google sign-in and Kakao sign-in, the email address and nickname received at that time, the fact that no email verification message is sent, and Kakao as the processor for sign-in authentication.
Addendum
- Date of announcement: 2026. 10. 11.
- Effective date: 2026. 10. 11.