Legal

Privacy Policy

Effective date · August 1, 2026


This policy describes what information yul collects, why, and what rights you have over it. yul is operated by studio.soso, a sole proprietorship registered in the Republic of Korea. yul is a global service. This policy is designed to meet the requirements of Korea's Personal Information Protection Act (PIPA), the EU / UK General Data Protection Regulation (GDPR), and the California Consumer Privacy Act (CCPA), among others.

1. What we collect

Account. Your email address and a unique identifier from your Google or Apple account when you sign in. We do not receive your profile image, name, date of birth, or gender.

Your content. The journeys, steps, reflections, and feelings you record in yul.

Device & usage. Push notification tokens, language, timezone, device type (iOS or Android), and basic activity data (which screens you visit) for reliability and improvement.

We do not collect precise location.

2. Why we collect it, and our legal basis

  • To provide yul — the performance of our agreement with you (contract).
  • To send you reminders and re-engagement notifications where you have enabled them — with your consent.
  • To improve the service using aggregated activity data — our legitimate interest in running a reliable product.
  • To respond to your feedback or support requests — to answer you and, where required, to meet a legal obligation.

3. How long we keep it

We keep your data as long as your account is active. When you delete your account, your data is removed immediately. Where law requires (for example, tax or transaction records once payments are introduced), specific records are retained for the period required by that law, then deleted.

4. Your content is private

The reflections, feelings, and journey entries you write are visible only to you. No one at studio.soso reads your content. We access only technical and aggregated data required to keep yul running.

5. Who we share with

We use the following processors to run yul:

  • Google and Apple — sign-in.
  • Supabase — backend database and application infrastructure.
  • Firebase Cloud Messaging (Google) — push notification delivery.
  • Google Analytics and Amplitude — usage analytics.

We do not sell your personal information, do not share it for cross-context behavioral advertising, and do not use it to build advertising profiles. We do not currently use any AI or large language model service; if we introduce one in the future, we will update this policy and, where required, ask for your consent.

6. International transfers

yul is operated from the Republic of Korea. Some of our processors (for example, Firebase, Google Analytics, and Amplitude) store data on servers outside your country, including in the United States. Where required, we rely on the standard contractual protections offered by these providers (such as EU Standard Contractual Clauses and equivalent mechanisms).

7. Your rights

Depending on where you live, you have the right to access your data, correct inaccurate data, delete your data (via Me → Account), receive your data in a portable format, restrict or object to certain processing, and withdraw your consent at any time.

If you are in the EEA, UK, or Switzerland, you have the right to lodge a complaint with your local data protection authority. If you are in Korea, you can also contact the Personal Information Protection Commission (PIPC).

To exercise these rights, email us at the address below.

8. California residents (CCPA)

If you live in California, you have the right to know what personal information we collect, to delete it, to correct it, and to opt out of "sale" or "sharing." As stated above, we do not sell or share your personal information as defined under the CCPA.

9. Cookies and tracking

yul is a mobile app (iOS and Android) and does not use web cookies. We use a minimal set of app identifiers required to keep you signed in, to route notifications, and to run analytics.

10. Children

yul is not intended for children under 13, or the higher minimum age required in your region (for example, 14 in the Republic of Korea). If we learn we have collected personal data from a child under the applicable age without proper consent, we will delete it.

11. Data protection contact

Data Protection Officer: Hoseong Hwang

studio.soso · hello@studiososo.co

If we appoint an EU / UK representative, we will list them here.

12. Changes to this policy

We may update this policy. Material changes will be notified in-app or by email at least 7 days before they take effect (30 days if the change reduces your rights).


VERSION HISTORY

VERSIONEFFECTIVE

v1.0.0-