Itemtify Privacy Policy

This is an unofficial English translation provided for convenience. In the event of any discrepancy between this translation and the Korean original, the Korean version prevails.

Effective Date: August 12, 2026

Cubed (representative: Ruan) (the "Operator"), in providing the mobile application "Itemtify" (the "Service"), complies with the Personal Information Protection Act and other applicable laws, and establishes and discloses the following Privacy Policy to process users' personal information safely.

1. Items of Personal Information Collected and Methods of Collection

Upon Membership Registration

• The Service does not create or store a separate password. Authentication is performed through the login procedures of Google and Apple.
• A Nickname is automatically generated and stored upon registration.

In the Course of Using the Service

• Photographs: The original photographs taken by the user with the in-app camera, and the images with the background removed or cut into a shape chosen by the user (square or circle). Where an image is cut into a shape, that processing takes place on the device and the photograph is not sent to any external provider.
• Room background photo: A photograph the user selects from the device photo library to use as a Room background. It is stored in the form the user adjusted for the background, and nothing other than the selected photograph is stored.
• Photo identifier: A hash value (SHA-256) of the original photograph — used to verify the authenticity of the Item
• Service usage records: Item and Room information, Gold grant and deduction history, auction and bid history, Item holding transfer history, appraisal results, and attendance, mission achievement, and reward receipt records
• Content created by the user: Comments and memos left on Items, profile images drawn by the user, and the content of inquiries and feedback the user sends (including star ratings)
• Conversations in Shared Rooms: The content of messages exchanged in a Shared Room, the time sent, and the sending user. They are displayed only to the Participants of the same Shared Room; a message deleted by the user disappears from the screen but is retained in a state marked as deleted for the handling of reports and for operational verification. For the same reason, records remain even after the Shared Room connection is released.
• Report and block records: The reported target and time, and the list of blocked users (for responding to inappropriate content and protecting users). Conversations written in a Shared Room by a blocked user are not displayed on screen.
• Room sharing information: Shared Room connection relationships and Participant information, and the history of Shared Room invitations sent and received (sending user, receiving user, time, and outcome)
• "Notify me" requests: The search term a user registers via "Notify me when it shows up" while searching the Auction House, together with the time of registration. It exists so that we can notify the user when an item matching that term is put up for auction, and it is stored together with the user's account. The registration screen may show how many people are waiting for the same term; it is not shown when that number is small.
• Popular search term counts: The terms users search for in the Auction House and how often. We do not store who searched (unlike the "Notify me" requests above, no user information is stored alongside).
• Saved (favorited) item list: The items a user has marked as favorites and the time of marking
• Purchase offer records: The item, amount and time offered, and the outcome
• Mini-game records: The room used, the items stacked and how many, the score, the time taken, and the reward received
• Automatically collected information: Service access records (access date and time, access date, error logs, etc.), app language settings, device information (operating system category and device model name), and the app version in use
• Whether device notifications are allowed: Whether notifications for this app are enabled on the device, and the time this was checked. This is used so that notifications are not repeatedly sent to members they cannot reach; the contents of notifications and other device settings are not collected. It is updated each time the app is launched and is a different value from the in-app "Notification settings" the member chooses.

In the Course of Collecting App Usage Statistics

• Usage statistics information: Information collected by Google Analytics (Firebase) to improve the Service and measure advertising performance — a per-installation identifier (app instance ID), usage events such as first launch and subsequent launches, device information (model, operating system version, screen size, language), and the country and region estimated from the access IP address
• This information is processed for statistical purposes, not to identify individual users. The app instance ID disappears when the app is deleted.
• On iOS, install performance is aggregated in a form that cannot identify individuals, through the advertising performance measurement method provided by Apple (SKAdNetwork).
• Install source information (Android): A value indicating the route through which the app was downloaded, delivered by Google Play at the time of installation (the attribution marker contained in an advertisement or link). It is recorded once on the member account and is not changed thereafter. It is not collected on iOS.

When Using the Friend Referral Feature

• Referral code: A six-character value automatically generated for each account upon registration. It is used when a Member recommends the Service to another person, and it does not change.
• Referral relationship: Where a Member enters another Member's referral code, the identifier of the inviting Member and the time of entry are recorded. A referrer may be designated only once, within the period set by the Service after registration, and cannot be changed thereafter.
• Referral reward grant history: The recipient, amount, and grant time of Gold paid out through referrals
• Installation identifier: A random value the app stores on the device. It identifies neither an individual nor the device itself. It is recorded only at the moment a referrer is registered, in order to prevent the repeated acquisition of referral rewards by switching accounts on a single device, and it disappears if the app is deleted or its app data is cleared. It is destroyed upon withdrawal.
• This information serves as the basis for reward payment and as a means of preventing duplicate or fraudulent payment, and is processed together with Gold grant records.

When Using Push Notifications

• Device registration token: A per-device token issued by Firebase Cloud Messaging and device category information to deliver notifications to that device. If you do not wish to receive notifications, you may block them in the in-Service settings or device settings, and they are destroyed upon withdrawal.

In the Course of Displaying Advertisements

• The advertising service (Google AdMob) may collect an advertising identifier (ADID/IDFA) and device information to serve advertisements. See Section 6 below for details.

When Paying for Paid Products

• Payment records: The identifier of the purchased product, the transaction identifier issued by the store (purchase token, order number, etc.), and the payment and grant times. Used to process payment and confirm product grant, prevent duplicate grants, and retain records under applicable laws.
• Actual payment (payment-method information such as card numbers) is processed by Apple and Google, and the Service does not store it.

※ The Service does not access location information or contacts. Camera permission is used only when taking photographs to create Items. The photo library is used only when the user chooses a Room background photo, solely to receive the single photograph selected at that moment; the Service does not view other photographs or collect any listing of the library. The "country and region" in the usage statistics above is an approximate value estimated from the access IP address; the device's location permission is not used.

2. Purposes of Processing Personal Information

3. Retention and Use Period of Personal Information

1. A Member's personal information is destroyed without delay upon withdrawal of membership. However, the following are exceptions.
2. Where retention is required under applicable laws, the information is stored separately for the relevant period.
   • Service access records under the Protection of Communications Secrets Act: 3 months
   • Records of contracts, payments, and supply of goods under the Act on the Consumer Protection in Electronic Commerce: 5 years (payment and supply of goods); Records of consumer complaints or dispute handling: 3 years
3. Records necessary to maintain transaction integrity, such as Gold grants and deductions, Item holding transfers, and friend referral relationships and reward grant history, are processed so that individuals cannot be identified upon withdrawal and then preserved. This is to ensure that the transfer history of Items held by other users is not broken.
4. To prevent fraudulent use, use-restriction records may be retained for 1 year after withdrawal.

4. Provision of Personal Information to Third Parties

The Operator does not provide users' personal information to third parties. However, the following are exceptions.

• Where the user has consented in advance
• Where required by the provisions of law or by an investigative agency in accordance with the procedures prescribed by law

※ Due to Service features, the following information is displayed to other users.

※ The public profile is displayed by default, and a Member may turn it off at any time under "Menu › Make my profile public." Once it is off, other users see only the Nickname, profile image and ranking, and no other item is displayed. However, the information displayed by other features (the table above) — such as auctions, comments and guestbooks — and the display in the wealth ranking are maintained as they are.

※ Publishing a Shared Room is different. Because a Shared Room places the Items of several Members in one space, when the Room Owner turns publication on the Items of the other participating Members also become visible. For that reason all Participants are notified at the time publication is turned on, and a Member who does not wish to be shown may move their Items to a Room that is not shared, or leave the Shared Room.

※ For features that only begin when the user turns them on — such as Room publishing — the screen used to turn the feature on explains what will be shown and to whom, and the user makes the choice. In such cases the items collected by the Operator do not increase; only the scope the user has chosen to make public changes. Publishing can be turned off at any time, but what other users have already seen while it was public cannot be undone.

5. Entrustment of Personal Information Processing

The Operator entrusts the processing of personal information as follows to provide the Service.

6. Overseas Transfer of Personal Information

In the course of providing Service features, information is transmitted to and processed by overseas providers as follows.

• Transmission is carried out over encrypted communication (TLS) at the time of Service use (Item creation and appraisal, notification receipt, advertisement viewing, social login) and when the app is launched (checking for fixes).
• Where a photograph is cut into a chosen shape (square or circle), the photograph is not transferred overseas — that processing takes place on the device. It is transferred to Replicate in the table above only when background removal is used.
• No account information or usage records are transmitted to Shorebird — only the app and device information needed to determine which fix should be received.
• If you do not wish to have information transferred, you may refuse by not using the relevant feature (e.g., blocking notifications) or by withdrawing membership. However, if you refuse transfers related to essential Service features such as login or Item creation, Service use may be restricted.
• Details on Google's processing of personal information: https://policies.google.com/privacy
• Details on Apple's processing of personal information: https://www.apple.com/legal/privacy/
• Details on Replicate's processing of personal information: https://replicate.com/privacy
• Details on Shorebird's processing of personal information: https://shorebird.dev/privacy

7. Procedures and Methods for Destroying Personal Information

1. Personal information for which a reason for destruction has arisen is destroyed without delay.
2. Information in electronic file form is deleted by a method that cannot be recovered, and other records are shredded or incinerated.
3. Upon withdrawal, original photographs, image files of held Items, Room background photos, device registration tokens, access records, and the content of conversations exchanged in Shared Rooms are deleted, and profile information such as Nicknames is replaced with unidentifiable values.

8. Users' Rights and How to Exercise Them

1. A user may at any time request access, correction, deletion, or suspension of processing of their personal information.
2. Rights may be exercised through in-Service features (re-drawing a Nickname, notification receipt settings, Item deletion, membership withdrawal, etc.) or through the contact in Section 10 below, and the Operator takes measures without delay.
3. Personal information of children under 14 years of age is not collected. If it is confirmed that a person under 14 has registered, the relevant account and information are deleted without delay.

9. Measures to Ensure the Security of Personal Information

• End-to-end encrypted communication (TLS). The Service does not store passwords and delegates authentication to external providers (Google and Apple).
• Database access control: separation of access rights per user (row-level security, RLS), and separate storage of server-only keys
• Design to prevent forgery or alteration of Gold and Item transfer records (append-only ledger)
• Minimization of access rights to personal information

10. Personal Information Protection Officer

Inquiries, complaints, and requests for relief regarding personal information may be received at the above contact. For other reports and consultations, you may contact the following organizations.

• Personal Information Infringement Report Center: privacy.kisa.or.kr / 118 (no area code)
• Personal Information Dispute Mediation Committee: kopico.go.kr / 1833-6972

11. Changes to the Privacy Policy

If the contents of this Policy are added, deleted, or modified, the Operator will announce the changes and their effective date through in-Service announcements or a notice shown when the app is launched.

Addendum

This Policy takes effect on August 12, 2026.

Revision History

• July 22, 2026: Enacted.
• August 6, 2026: The items collected and the details of overseas transfers were brought up to date.
• August 11, 2026: The information displayed and the usage statistics items were revised.
• August 12, 2026: With the addition of the Shared Room conversation feature, conversation content was specified in the items collected (Sections 1, 2, 3, and 7), and the information displayed to other users for Shared Room invitations and publishing a Shared Room was reflected in Section 4. With the addition of the feature that cuts a photograph into a chosen shape, it was clarified in Sections 1 and 6 that such processing takes place on the device. In connection with the delivery of fixes that correct the app without a store update, Shorebird, Inc. was added to the overseas transfers in Section 6.