Privacy Policy

Effective Date: November 27, 2026 (v5.4) · Until then, the previous version (v5.3) applies

Elpis Studio ("Company") values the privacy of the D.off app ("Service") users and establishes this Privacy Policy in accordance with applicable laws.

1. Information We Collect

We collect the following information to provide our service:

Required: Email address, password (encrypted)
Social login: Nickname, profile photo (optional)
App usage data and settings: blocking group settings (group names and limits, the package names and names of the apps you put in a group, and, on iOS, the app-selection tokens issued by the system), app settings and in-app records (such as streak records and your answers to the onboarding questions), the daily usage time of the apps in your groups, and your free transcription records — stored on your device and also backed up to your account while you are signed in. On Android, from app version 1.48.13 this backup happens only if you agree to the in-app notice, and usage time on iOS is kept on the device only from app version 1.48.12 (earlier versions back this data up on both Android and iOS; Section 5)
Automatic: Device info, OS version, app version
Device integrity signals: a device hash together with the identifiers of the accounts signed in on that device, used solely to prevent abuse of the self-control mechanism (Section 10)
Diagnostics & analytics: Firebase Analytics (Google Analytics for Firebase / GA4) and Crashlytics crash reports collect aggregated, non-advertising usage events (for example, completing onboarding, creating a group, setting up blocking, first unlock) and crash logs to keep the app stable and improve features. Not used for cross-app tracking or advertising.
Service usage records: the dates you opened D.off, the platform you used most recently (Android, iOS or web) and the app version — saved at most once a day while you are signed in (Section 18)
Apple Ads attribution (iOS): whether you installed through an Apple Ads ad on the App Store and the IDs of the related campaign and ad group — received from Apple, not from you (Section 18)
App category information (Android; from app version 1.48.13, if you agree to the in-app notice): to show and suggest apps by category, the package names of the apps installed on your device are sent to our server to look up their categories, and when adding an app to a group sets or changes that app's category, the app's package name and category are stored together with your account identifier (Section 5)

2. How We Use Information

Account registration and management
Service delivery (screen time management, statistics)
Customer support
Service improvement
Service usage statistics (measuring whether people keep opening the app after installing it)
Ad measurement (iOS — checking whether people who installed through Apple Ads ads run by the Company keep using the app; not used for personalized advertising or tracking)

3. Data Retention and Deletion

Your personal information is destroyed without delay when you delete your account. Where retention is required by law, it is stored separately from other personal information for the applicable period and then destroyed.

Items retained under law: contract and payment records for 5 years under the Korean E-Commerce Act; access logs for 3 months under the Korean Protection of Communications Secrets Act
Service usage records and Apple Ads attribution: kept until you delete your account, then destroyed without delay. Turning off "Send analytics data" does not automatically erase information already stored; on request, we delete just this information (Section 18).
Account backup and app category records: destroyed without delay when you delete your account. If you withdraw your consent to "Send backups & app categories" on Android, nothing more is sent from that device from then on, but information already stored is not erased automatically; on request, we delete just this information (Section 5).
Device integrity records: when you delete your account, your account identifier is removed from the device-integrity record right away, so the device hash is no longer linked to your account. The device hash record itself is deleted by a daily cleanup once the 7-day re-registration cooldown plus 90 days have passed since the device was last checked (Section 10).
Request-limit and sign-up verification records: to block repeated requests, we record on our server the number of requests and the time of the first request for each IP address, account identifier or email address, and these records are deleted in a daily cleanup once 30 days have passed. When you delete your account, request-limit records and sign-up verification records keyed by your account identifier or email address are deleted right away.
Organization activity log: when you delete your account, in the activity log of the organization you belong to at that time (joining, leaving, status changes and similar events), your account identifier is replaced with a random label and your nickname and email are removed. Only what happened and when remains as the organization's operating record.
Records that may remain after you delete your account: promo-code redemption records (code, account identifier, email), records of premium granted by the Company as customer support (account identifier, reason), subscription event records (account identifier, event type, product, expiry time) and the activity logs of organizations you left earlier (account identifier, nickname and similar).
Destruction procedure: The Company identifies the personal information for which grounds for destruction have arisen and destroys it with the approval of the Personal Information Protection Manager.
Destruction method: Information stored as electronic files is permanently deleted by technical means that make recovery or reproduction impossible; information printed on paper is shredded or incinerated.

4. Third-Party Sharing

The Company does not provide users' personal information to third parties. It is provided only in the following cases, in accordance with Article 17 of the Korean Personal Information Protection Act.

Where there are special provisions in law, or where provision is unavoidable in order to comply with a legal obligation
When you use an organization (B2G) service — Recipient: the organization you joined with an invitation code (its name is shown on the app's organization info screen right after you join) / Purpose of provision: reporting usage status at the organization level / Items provided: nickname, email address, join date, membership status (active, graduated, dropped), monthly average usage time, quota compliance rate (aggregate) — monthly average usage time and quota compliance rate are calculated from the daily usage records backed up to your account; while you have not agreed to the account backup in the Android app from version 1.48.13, and in the iOS app from version 1.48.12, no new records are uploaded, and from when you choose not to agree on Android until you agree again on any Android device, these two values are neither calculated nor provided, including from records already backed up (Section 5) / Retention and use period: until the organization's contract ends or you leave the organization
Individual app package names, hour-by-hour usage patterns, and transcription content are NOT provided to organization administrators.
Joining an organization is optional. From app version 1.48.13, the invitation-code sign-up screen tells you the recipient, purpose, items and retention period and that you may refuse, and your consent is obtained with the "Agree and join" button. If you do not consent, you can use the Service without joining an organization. App versions before 1.48.13 state on the sign-up screen that organization administrators see your nickname, join date, monthly average usage time and quota compliance rate (aggregate) and that you may decline to join, and you join with the "Join" button.

5. App Usage Data and Account Backup

On Android, D.off reads app usage time through the Usage access (UsageStats) permission. On iOS, Apple's Screen Time features (Section 11) check usage time on the device, and D.off works out each group's usage time from signals that usage has reached set steps. This data and your account backup are handled as follows:

Usage record backup on Android: daily usage records are backed up to your account while you are signed in — the usage time, limit and whether the limit was exceeded for each group, the package names and per-app usage time of the apps in your groups, and the daily total and compliance rate. They are uploaded mainly when you close the app or switch to another app, at most once every 30 minutes, and only for days within the last 90 days whose content has changed. They are used to restore your statistics after you reinstall the app or switch devices. Hour-by-hour usage records (when you opened which app) are not sent.
iOS: from version 1.48.12, the iOS app keeps usage time on the device only and never sends it to a server, so iOS usage statistics from then on are not restored if you reinstall the app. Earlier versions of the iOS app backed up to your account the per-group usage time calculated through Screen Time plus the daily total and compliance rate, and devices that have not been updated still do. Records backed up this way remain until you delete your account, are used to restore your statistics when you reinstall the app and, if you join an organization (B2G), may be used for the organization reporting described in Section 4.
Account backup on all platforms: your blocking group settings (including the app-selection tokens on iOS), app settings and in-app records, and your free transcription records (the date, the sentences you typed with their sources and categories, and the number of sentences) are backed up to your account while you are signed in. The sentences you type to unlock apps and the Android site block list are kept on the device only.
App categories on Android: to show and suggest apps by category, the package names of installed apps that appear in your app launcher (excluding built-in system apps that have never been updated) whose category has not yet been received from our server, or was received more than 30 days ago, are sent to our server while you are signed in. The Company does not store these lookups linked to your account; the server keeps package names with no category, or an outdated one, in a queue and checks their category against public information on the Google Play Store. When adding an app to a group sets or changes that app's category, the app's package name and category are stored with your account identifier, one record per app, so that they can be counted together with other users' classifications.
Consent on Android: the Android usage record backup above, the account backup made from an Android device, and Android app category lookups and stored categories take place, from app version 1.48.13, only if you agree to the notice shown in the app after you sign in, and this processing is based on that consent. If you don't agree, this information is not sent to our server from that device. Blocking, limits and unlocking by transcription still work, but records made while you have not agreed are not backed up and cannot be restored if you reinstall the app or change devices in the meantime, app categories come only from information on your device, and even if you joined an organization (B2G) those records are not used in its reports. If you agree later, the records from the last 90 days still on your device are backed up at that point. Records already backed up before this consent step or before you withdraw remain until you delete your account. If you belong to an organization, records already backed up may be used in its reports while you have not yet made a choice, but if you choose not to agree (including turning it off in Settings), we stop providing your monthly average usage time and quota compliance rate to the organization from then on, including figures from records already backed up. If you agree again, they are provided again. You can agree or withdraw at any time in Settings > About > "Send backups & app categories". Your choice, its time and the version of the notice are recorded on your account and on the device, and we ask again if the notice changes. This choice applies to each device separately: if you decline or withdraw on one device, other Android devices signed in to the same account keep sending according to their own choice, and devices without this consent step (iOS, the web and Android app versions before 1.48.13) keep sending as before, so if you use several Android devices, please choose on each one. We ask again after you reinstall the app or sign in on another device. Whether figures are provided to your organization follows the choice last recorded on your account, whichever device it was made on. There is no such consent step on iOS or the web. Android app versions before 1.48.13 do not have this consent step either, so until the app is updated, the backups and app category lookups and stored categories described above take place while you are signed in.
Purposes: managing limits and locking, showing statistics and reports, restoring data after you reinstall the app or switch devices, and classifying and suggesting apps. If you join an organization (B2G), the daily summaries (daily total and compliance rate) are also used for the organization reporting described in Section 4; per-app usage is not provided to the organization.
Retention and deletion: data in the app's database on your device is erased when you uninstall the app, but values stored in the iOS Keychain (Section 13) may remain on the device after the app is deleted. Data backed up to your account, and app category records stored with your account identifier, remain after you uninstall the app and are deleted when you delete your account (Section 3). On Android, turning off Settings > About > "Send backups & app categories" stops sending from that device from then on (other Android devices on the same account follow their own setting); on iOS and the web, and in Android app versions before 1.48.13, there is no separate setting to turn off the account backup.
Separate from service usage records (Section 18), which store the dates you opened D.off — those records contain no usage time of other apps and no Screen Time totals

6. Your Rights

You may exercise the following rights regarding your personal information processed by the Company at any time. The legal representative of a minor aged 14 or over may also exercise these rights on the minor's behalf.

Right of access (Article 35 of the Korean Personal Information Protection Act)
Right to correction or deletion (Article 36) — you can also delete the information stored on your account yourself using the account deletion feature (see Section 3 for records that may remain afterwards).
Right to suspension of processing (Article 37)
How to exercise: submit your request to chrislee.krh@gmail.com. If a representative exercises the right on your behalf, please also submit a document evidencing the delegation.
Processing period: We act on your request and inform you of the result within 10 days of receipt. If a request is refused, we notify you of the reason.

7. Personal Information Protection Manager and contact

Please direct any question, complaint, or remedy request regarding the handling of personal data to the contact below. We respond without undue delay.

Personal Information Protection Manager: Jangchun Lee (Owner)
Organization: ELPIS / Title: Owner
Phone: +82 10-6570-9004
Email: chrislee.krh@gmail.com
You may also seek dispute resolution or counseling for remedies against privacy infringement from the Personal Information Dispute Mediation Committee (1833-6972), the Privacy Infringement Report Center (118), the Supreme Prosecutors’ Office Cybercrime Division (1301), or the National Police Agency Cyber Bureau (182) (Korean domestic hotlines).

8. Service Providers (Processors)

The Company entrusts personal data processing to the following external providers to deliver the Service:

Google LLC (Firebase Auth, Firestore, Cloud Functions, Storage, FCM, Hosting) — data storage, authentication, running server functions, push notifications, hosting / United States, multi-region
RevenueCat, Inc. — subscription receipt validation and management / United States
Anthropic, PBC (Claude API) — generating AI insight responses for administrators / United States
Canva Germany GmbH (Pexels API) — supplying exercise video search results (no user-identifying information is sent) / Germany
Google LLC (Firebase Analytics, Crashlytics) — aggregated usage analytics and crash diagnostics / United States

9. International Data Transfer

Under Article 28-8(1)3 of the Korean Personal Information Protection Act, the Company transfers personal information overseas for the purposes of entrusted processing and storage in order to perform the contract and enhance user convenience, and discloses the matters listed in paragraph 2 of the same Article as follows:

Items transferred: the same as the items collected under §1
Destination countries: United States (Google LLC, RevenueCat, Anthropic), Germany (Canva Germany GmbH)
Timing and method of transfer: transmitted over the network from time to time while you use the Service. No transfer via separate storage media takes place.
Recipients and their contacts: Google LLC (1600 Amphitheatre Parkway, Mountain View, California, United States / https://support.google.com/policies) · RevenueCat, Inc. (United States / https://www.revenuecat.com/privacy) · Anthropic, PBC (United States / https://www.anthropic.com/legal/privacy) · Canva Germany GmbH (Pappelallee 78/79, 10437 Berlin, Germany / https://www.canva.com/privacy/)
Purpose of use and retention period of the recipients: the same as the retention policy in §3 and the entrusted work in §8
How to refuse the transfer and its effect: you may refuse the transfer by deleting your account, in which case use of account-based features will be restricted. On Android, from app version 1.48.13, you can also refuse only the account backup and app category transfers by turning off Settings > About > "Send backups & app categories"; this setting applies to each device separately (Section 5).
Apple Ads attribution lookup (iOS) — disclosed for transparency, separately from the entrusted processing and storage above: when you sign in after installing the app, your device sends Apple Inc. (One Apple Park Way, Cupertino, California, United States / https://www.apple.com/legal/privacy/) only the one-time attribution token that Apple itself issued, over the network (HTTPS). No account information held by the Company, such as your email or user ID, is sent, and Apple's privacy policy governs how Apple handles the request. If you turn off "Send analytics data" (Section 16), the lookup does not take place, with no effect on your use of the Service.

10. Device Attestation & Re-registration Cooldown

D.off is a self-control tool. To prevent users from circumventing their own self-imposed limits by deleting and recreating their account, we use device attestation:

What we collect: A device hash (SHA-256). On devices that cannot obtain a Google Play Integrity (Android) or Apple DeviceCheck (iOS) attestation token, the hash is derived from a device identifier set per app developer (the Android ID or identifierForVendor). Attestation tokens received from other devices are neither used to derive the hash nor stored until server-side verification of those tokens is in place. Stored with the hash are the identifiers of the accounts signed in on that device and of the accounts that turned on blocking on it, the first and last time the device was checked, the number of accounts that turned on blocking, the number of detected re-registrations and the time of the most recent one, and the end time and reason of any cooldown. A hash derived from a device identifier comes out the same on the same device until that identifier changes (for example, after a factory reset or, on iOS, after all apps from the same developer are deleted), so it keeps pointing to that device. Advertising identifiers, IMEI, MAC address and device serial numbers are not used, and on some devices where no device identifier is available, several devices may share the same hash.
When we collect: when you open the app while signed in (once per launch, and again if the device clock needs to be re-checked) and when you save a blocking group (once per launch). Each check updates the time the device was last checked.
Purpose: If the same device hash already has a record of active blocking sessions and you sign up under a new account, a 7-day cooldown is applied during which all blocking remains active.
Opt out: You may decline by not signing up; the cooldown is part of the core self-control mechanism and cannot be disabled while using the Service, and it does not depend on the "Send backups & app categories" setting. Uninstalling erases the app's database on the device, but the device-time record used for the cooldown that is kept in the iOS Keychain may remain (Section 13).
What it is not: This hash is never used for advertising, cross-app tracking, profile building, or third-party sharing. The Google/Apple attestation APIs themselves are subject to their own privacy policies.
Retention: when you delete your account, your account identifier is removed from the device-integrity record right away, so the device hash is no longer linked to your account. The device hash record itself, used to enforce the 7-day re-registration cooldown, is deleted by a daily cleanup once the 7-day cooldown plus 90 days have passed since the device was last checked.

11. iOS Screen Time Data (Family Controls)

On iOS 16+ devices, D.off uses Apple's Family Controls framework to apply restrictions to apps that you yourself select.

Data collected: Only opaque tokens representing user-selected apps. D.off cannot see app names, bundle IDs, or exact usage time — these are handled internally by iOS. D.off only receives signals that usage has reached set steps.
Processing: blocking and usage checks take place on the device (ManagedSettings and DeviceActivity), and from app version 1.48.12 usage time is never sent to a server (earlier versions of the iOS app backed up per-group usage time to your account). However, the backup of your group settings on your account includes your app selection (a value containing the opaque tokens) (Section 5).
Purpose: Applying user-configured blocks, schedules, and unlock challenges. No third-party monitoring, surveillance, or remote control.
Your rights: You can revoke at any time via iOS Settings → Screen Time → D.off permissions. All ManagedSettings are automatically deleted immediately upon app uninstallation.
Apple policy: This feature operates under Apple's Family Controls Distribution Entitlement approval, and Apple's Privacy Policy (https://www.apple.com/legal/privacy/) applies in conjunction.

12. Sign in with Apple

On iOS, D.off supports Sign in with Apple as one of multiple sign-in methods (Apple App Store Guideline 4.8). When you use this method:

Data collected: Apple ID identifier (Firebase UID), email address (real or Apple-relay), and — only on first sign-in — your full name if you choose to share it. Re-login does not transmit your name again (Apple SDK policy).
Hide My Email: If you select "Hide My Email," Apple issues a private relay address (*@privaterelay.appleid.com) and forwards email to your real inbox. D.off stores only the relay address — your real email is never disclosed to D.off.
Display name preservation: Because Apple delivers your name only on first sign-in, D.off backs up your display name to device-local storage to restore it during subsequent logins on the same device.
Account deletion (Guideline 5.1.1(v)): when you delete your D.off account, your Firebase account and the information stored on your account are deleted (see Section 3 for records that may remain). Our server asks Apple's /auth/revoke endpoint to revoke D.off's authorization on Apple's side only when the app holds a token received from Apple at sign-in, and the current iOS app does not receive this token, so deleting your account does not by itself send this request. You can remove D.off yourself from the Sign in with Apple list in iOS Settings (tap your name, then Sign-In & Security).
No data sale or marketing: D.off does not send any external marketing emails to Sign in with Apple users. Email is used only for transactional purposes initiated by you.

13. Local Data Storage & Encryption

D.off stores app data on your device using the following mechanisms:

Local database (RxDB / IndexedDB): Quota settings, app group selections, transcription journal entries, weekly stats, and category preferences are stored in your device's local store inside the app sandbox, not accessible to other apps.
Device-level encryption: D.off relies on OS-level full-disk / file-based encryption (Android FBE for Android 10+, iOS File Data Protection) to protect data at rest. Confidentiality depends on you keeping a device passcode/biometric lock enabled and your device not being jailbroken or rooted.
Sensitive token storage: Apple Sign-In access tokens and the device-time anchor used for the cooldown mechanism are stored in OS-secured storage: iOS Keychain (this-device-only, iCloud sync disabled) and Android EncryptedSharedPreferences (Keystore-backed AES-256-GCM).
In transit: All network requests to Firebase, Cloud Functions, RevenueCat, and Apple/Google identity endpoints use HTTPS (TLS 1.2+).
Removal: Uninstalling D.off removes the app sandbox, including the local database, from the device. However, values stored in the iOS Keychain (the sensitive tokens above — the Apple Sign-In token and the device-time record for the cooldown — and the display name backed up for Sign in with Apple) may remain on the device after the app is deleted.

14. Children under 14

D.off is intended for users aged 14 and over. We do not collect personal data from children under 14, and users under 14 may not use the Service.

Before you begin using the Service, the initial setup screen requires you to confirm that you are 14 or older and to accept the Terms.
If a user is found to be under 14, the account is terminated and the related data is destroyed.
If we become aware that we have collected personal data from a child under 14, we destroy that data without delay.
A parent or guardian may request confirmation or deletion of a child’s account at chrislee.krh@gmail.com.

15. Changes to This Policy

If we change this Policy, we announce the reason for and the content of the change through an in-app notice.

Notice is given at least 7 days before the change takes effect; for changes that materially affect user rights, notice is given at least 30 days in advance.
The previous version and a change history are posted together so that you can compare the policy before and after the change.
The effective date and version are shown at the top of this Policy.
Change history: v5.4 (effective November 27, 2026) — added the collection and use of service usage records and Apple Ads attribution (Sections 1, 2, 3, 5, 9, 16 and 18). We also corrected the description of information sent to and stored on our servers — such as the account backup, app category lookups on Android and device integrity records — together with how long it is kept and how the backup is encrypted, to match actual processing (Sections 1, 3, 5, 10, 11 and 17). We also made the account backup and app category transfers on Android take place only with in-app consent and added a setting to turn them off (Sections 1, 3, 5 and 9), corrected the items provided to organizations and the notice on the sign-up screen (Section 4), and noted that values stored in the iOS Keychain may remain after the app is deleted (Sections 5, 10 and 13). We also stated or corrected that iOS app versions before 1.48.12 backed up usage records (Sections 1, 4, 5 and 11), which records may remain after you delete your account, how long request-limit records are kept and when authorization on Apple's side is revoked (Sections 3, 6 and 12), that usage summaries of members who chose not to agree on Android are not provided to organizations (Sections 4 and 5), and when collection stops after you turn off "Send analytics data" (Sections 16 and 18). Full text of the previous version (v5.3, effective August 3, 2026): https://doff-elpis.web.app/privacy-v5.3.html

16. Automatic Data Collection Tools and How to Refuse

The following tools and features collect information automatically to keep the app stable, improve features, compile service usage statistics and measure our ads. This app does not use browser cookies.

Tools and items: Firebase Analytics (GA4) and Crashlytics automatically collect an app instance identifier, aggregated usage events, and crash logs. They are not used for advertising or cross-app tracking.
D.off's own records: while you are signed in, the app saves a service usage record to your account at most once a day and, on iOS, the Apple Ads attribution once per installation (Section 18).
How to refuse: turn off Settings > About > "Send analytics data" and all of the above stops; Crashlytics crash reporting may stop only from the next time the app is launched. The choice is saved on each device (each browser on the web), so if you use several devices, turn it off on each one. You can change it at any time.
Refusing does not limit your use of the Service in any way.

17. Security Measures for Personal Data

The Company implements the following measures under Article 29 of the Korean Personal Information Protection Act.

Administrative: personal data handling is limited to the representative alone, and the Personal Information Protection Manager directly oversees processing.
Access control: under Firebase security rules, data stored on your account can be written from the app only by your own account and cannot be read by other users, and unauthenticated access is denied. Of the information stored outside your account, app category records and device integrity records cannot be read or written directly from the app and are handled only by the Company's server functions. If you join an organization (B2G), its administrators can read that organization's member records and activity log (joining, leaving, status changes and similar events) in the app (only the Company's server functions can write them), and what is provided is as described in Section 4. Access on the Company's side is limited to the person handling personal data (the representative).
Encryption: data in transit is encrypted with TLS, and passwords are stored using one-way hashing that cannot be reversed (Firebase Authentication). The Company adds no encryption of its own to the data backed up to your account; encryption at rest follows the default encryption of Google Cloud (Firestore).
Access logs: administrative access to the cloud infrastructure is automatically recorded and retained (Google Cloud audit logs).
Protection by data minimization: hour-by-hour app usage records (when you opened which app), the sentences you type to unlock apps, URLs checked during site blocking and the Android site block list are never sent to a server. App-related information sent to the server is limited to what Section 5 describes.
Physical security: servers run in Google data centers; the Company operates no physical servers of its own.

18. Service Usage Records and Apple Ads Attribution

To check whether people keep using D.off after installing it, and to measure whether the ads the Company runs on the App Store reach people who actually use the app, we store the following information on your account. It never includes Screen Time usage (time spent in other apps, iOS DeviceActivity totals, etc.).

Service usage records (Android, iOS, web): the dates you opened D.off (year, month and day on your device; no time of day), the platform you used most recently (Android, iOS or web) and the app version (not recorded on the web). Saved at most once a day when you open the app or bring it back to the screen while signed in; the platform and app version overwrite the previous values.
Apple Ads attribution (iOS only): whether this installation came through an Apple Ads ad on the App Store and, where Apple provides them, the IDs of the campaign and ad group, the conversion type (first download or redownload), the ad's country or region and the date and time of the ad click, together with the time the Company received this information. Campaign and ad group IDs refer to ads the Company ran; they do not identify you. An installation that did not come through an ad is stored as "not from an ad." If Apple returns its fixed test response for development and testing, the Company also stores a flag marking it as a test response so that it can be told apart in measurement.
How it is obtained (Apple Ads attribution): your iOS device creates a one-time attribution token with Apple's AdServices framework and, after you sign in, sends only that token to Apple's attribution server (api-adservices.apple.com, United States) to receive the result. We do not send your email, user ID or any other account information to Apple. The token is never stored on our servers; a token kept on your device is not used after 24 hours and is deleted from the device once a result is received. The result is saved once per installation, only to the account signed in when the result arrives, and is never written over an account that already has one.
Source: Apple Ads attribution is received from Apple Inc., not from you directly. Apple states that this information does not identify a user or device and that AdServices does not engage in tracking as defined under the App Tracking Transparency framework. D.off does not collect the advertising identifier (IDFA) and does not show a tracking permission prompt. You may also request that we stop processing this information (Section 6).
Purposes: (1) Service usage statistics — counting, by platform and version, whether people still open the app days after installing it, to improve features and stability. (2) Ad measurement (iOS) — measuring whether people who installed through Apple Ads ads keep using the app compared with others, and which campaigns and ad groups brought them, so that we can adjust the Company's own ad spending.
Legal basis: Article 15(1)6 of the Korean Personal Information Protection Act (the Company's legitimate interest). This information is processed without consent, and you can refuse its collection at any time as described below.
Retention: kept until you delete your account, then destroyed without delay together with your other account data (Section 3).
Refusal and deletion: turn off Settings > About > "Send analytics data" and collection stops on that device (Section 16). Information already stored is deleted when you delete your account; to delete just this information before then, contact us as described in Section 6 (chrislee.krh@gmail.com). Refusing does not limit your use of the Service.
What it is not used for: this information is not used for personalized advertising, cross-app tracking or choosing who sees ads; it is not provided or sold to any third party, including advertisers, ad networks and data brokers, and it is not provided to organization (B2G) administrators. It is stored in Google Firebase (Firestore) (Sections 8 and 9).

← Back to D.off