Privacy Policy
Version 1.0 · Effective 2026-11-30
evergrow (“the service”) is run by Chanyoung Joo (“we”, “us”), an individual operator based in the Republic of Korea. This policy explains what personal information we process, why, who can see it and what your rights are. It is written to comply with Korea’s Personal Information Protection Act (PIPA) and, for users in the EU/UK, the GDPR. The service is a non-commercial personal project with no advertising.
1. What we collect and how
We collect only what the service needs to work.
| Category | Data | Source |
|---|---|---|
| Account (required) | Your account ID at the sign-in provider (Google or Kakao), name or nickname, profile picture URL, and email address if the provider shares it | Received from Google or Kakao when you choose to sign in with them |
| Settings (required) | Display language, time zone | Saved from your browser settings when you first sign in |
| Content you create | Trees (name, settings), decorations, ornaments and presents you leave, sealed notes, join-request messages, member roles and approvals, blocks, reports | Entered by you or created as you use the service |
| Technical data | IP address, browser information (user agent), time of access, pages requested, sign-in session cookies, language cookie | Generated automatically when you use the service |
We do not collect national ID numbers or other special categories of data. Please do not put sensitive information (health, financial details, etc.) in your notes.
2. Why we use it (and legal bases)
- To provide the service: sign you in, keep you signed in, let you create and share trees, handle join requests and roles, and open sealed notes at midnight on December 25 in the tree owner’s time zone. Basis: performing our contract with you (PIPA Art. 15(1)4; GDPR Art. 6(1)(b)).
- To keep the service safe: handle reports and blocks, prevent abuse and fix errors. Basis: our legitimate interest in a safe, working service (GDPR Art. 6(1)(f)), and the contract.
- To meet legal obligations, e.g. responding to lawful requests. Basis: legal obligation (GDPR Art. 6(1)(c)).
We do not use your information for advertising, marketing, selling, profiling or training AI models, and we make no decisions about you based solely on automated processing.
3. Who can see what
- Anyone with a tree’s link (even signed out): the tree’s name, the owner’s display name, how it is decorated and how many people have gathered. Not the names of the people who left something.
- Members of a tree: the display names and profile pictures of people who left an ornament or present on it.
- The owner and managers of a tree: the member list, join requests and their messages, the blocked list, and, once notes open, every note on that tree.
- Viewers: only their own note, never other people’s.
- Public (regional) trees: ornaments and the display names of the people who left them are visible to anyone. Notes are not allowed on public trees.
- Archived trees: visible to their owner only.
As the operator we can technically access the database. We look at content only when needed to handle a report, a lawful request or your own request, and only as much as needed.
4. How long we keep it, and deletion
- We keep your information until you delete your account. Ask for deletion using the contact in section 11; we act within 10 days.
- Deleting your account removes your profile, settings, the ornaments and notes you left, your memberships, requests and reports, and the trees you own, including notes other people left on them. To keep a tree, transfer ownership to a manager first.
- Archiving is not deletion: archived trees are kept until your account is deleted.
- We do not keep separate access logs. Our infrastructure providers (section 6) keep technical logs for a short period under their own policies.
- Deleted data may remain in our providers’ backups for a limited time until the backups are overwritten.
- Deletion means removing the data from the database so it cannot be recovered. We do not process personal information on paper.
- If we shut the service down, we will announce the date and what happens to your data at least 30 days in advance in the service.
5. Sharing with third parties
We do not sell or give your personal information to third parties, except where the law requires it or authorities request it through lawful procedures. What other users of a tree can see is part of how the service works (section 3).
6. Service providers and international transfers
We use the following providers to run the service. They process data on our behalf, and because they are US companies this may involve transferring data outside Korea (and outside the EU/UK). These transfers are necessary to provide the service to you.
| Provider | Purpose and data | Location and method | Retention |
|---|---|---|---|
| Supabase, Inc. (USA) Privacy policy and contact | Database and sign-in. Account data, settings, content, sign-in session data (IP address, browser information) | Stored in Seoul, Korea (AWS ap-northeast-2). Sent over the network as you use the service; may be accessed from abroad for maintenance | Until account deletion or end of our contract with them |
| Vercel Inc. (USA) Privacy policy and contact | Website hosting and delivery. IP address, browser information, pages requested, page content shown to you | Server functions run in Seoul, Korea (icn1); delivery may pass through a global content delivery network | Technical logs for a short period under their policy; other data in transit only |
Google LLC and Kakao Corp. are the sign-in options you choose; we receive the data in section 1 from them, and their own policies apply (Google, Kakao).
If you do not want your data transferred, you can stop using the service and ask us to delete your account. The service cannot run without these providers.
7. Your rights
You can ask to access, correct or delete your personal information, to restrict or object to its processing, and (EU/UK) to receive a copy in a portable format. Contact us using section 11; we respond within 10 days. A legal representative or someone you authorize can make a request for you; we may ask for proof of authorization. If we cannot fulfil a request because the law requires us to keep certain data, we will tell you why.
In the service you can also leave a tree, cancel a join request, and change or archive trees you own.
8. Children
You must be at least 14 to use the service. We do not knowingly collect information from children under 14; if we learn an account belongs to one, we delete it promptly.
9. Cookies
- Sign-in session cookies: keep you signed in. Strictly necessary.
- Language cookie (NEXT_LOCALE): remembers your display language for one year.
We do not use advertising, analytics or tracking cookies, and we do not collect behavioural data for targeted ads. You can block cookies in your browser, but then you cannot sign in.
10. Security
- All connections are encrypted with HTTPS.
- Database row-level security limits access by user and role; sealed notes cannot be read by anyone except their author until they open.
- Administrative access is kept to a minimum, and service keys are never exposed to browsers or the public code repository.
- Our infrastructure providers encrypt stored data.
- Error logs exclude sign-in cookies and URL query strings.
11. Contact and privacy officer
For questions, complaints or to exercise your rights, contact:
- Privacy officer: Chanyoung Joo
- Email: curiosityprocessor@gmail.com
12. Complaints
You can also contact the Korean authorities: the Personal Information Infringement Report Center (118, privacy.kisa.or.kr) or the Personal Information Dispute Mediation Committee (1833-6972, www.kopico.go.kr). If you are in the EU/UK, you can complain to your local data protection authority.
13. Changes to this policy
We will announce changes in the service at least 7 days before they take effect, or 30 days before for changes that significantly affect your rights.
- Version 1.0: effective 2026-11-30 (first version)
The Korean version is the official text; if the versions differ, the Korean version prevails, except where the law of your country requires otherwise.