snap.log Privacy Policy

Read this first. snap.log is a personal journaling app. Photos, videos and audio stay on your device by default; the only things that go to a server are the features you turn on yourself (Backup & sync, AI recall and Pinpoint are all off by default). This policy states specifically what goes where when each feature is turned on.

Article 1 (Purposes of processing personal information)

The Company processes personal information for the purposes below. It is not used for any purpose other than these, and if a purpose changes the Company will take the necessary measures, such as obtaining separate consent under Article 18 of the Personal Information Protection Act.

1. Identifying and managing users
   Identifying and authenticating users through an anonymous session or social sign-in (Google/Apple), syncing records across devices, and preventing abuse of the Service
2. Providing the journaling service
   Storing and retrieving the records you create (notes, photos, videos, audio, location) and presenting them as a timeline, album, calendar and map
3. Providing optional features
   Cloud backup and sync, AI recall (natural-language question answering) and automatic place logging (Pinpoint) — each only if you turn it on in Settings
4. Managing subscriptions and payments
   Verifying purchases, restores and renewals of paid plans, and eligibility for the free trial
5. Improving the Service and keeping it stable
   Usage statistics, analysis and resolution of errors and failures, and development of new features
6. Serving advertising
   Showing ads to users on the free tier (no ads are shown to users on a paid plan)

Article 2 (Categories of personal information processed)

1. Account information

If you choose Hide My Email with Sign in with Apple, an anonymised relay address is provided instead. We do not collect your name, profile picture or phone number.

2. Information you create yourself

• Record content: text notes, photos, videos, audio, tags
• The time of the record (including the capture time) and location information (latitude/longitude and the reverse-geocoded address)
• The name and coordinates of places you name (e.g. "Home", "Work")

3. Location information

• Location at the time of a record: the coordinates and address when you save a record. For photos and videos, the capture location embedded in the file is also read.
• Background location (Pinpoint): collected only if you turn Pinpoint on. Even when the app is not running, the operating system's geofencing and visit detection are used to notice that you have stayed in one place for a while, and the coordinates and address of that spot are used as a candidate record. You can turn this off in Settings at any time; doing so stops background location collection immediately.

4. Information kept on the device and never sent to a server

• App settings (language, sync conditions, Pinpoint settings, and so on)
• Original photos, videos and audio while sync is off
• Anything read through photo-library permission that you did not choose to save as a record

5. Information generated or collected automatically

• Service usage: event names and timestamps for creating and deleting records, signing in, viewing screens, purchases, paywall views, accepting or dismissing Pinpoint, AI recall queries, and similar
• Device information: operating system and version, device model, app version and the running bundle identifier
• Error and crash information: error messages, stack traces, and device state at the time
• Advertising identifier (free tier only)

Article 3 (Where information is stored and how far it travels)

Because of how the Service is built, where a given piece of information is stored depends on your settings. The following table is the whole of it.

Original video files are never transmitted to a server under any circumstances. Even with video backup on, only a re-encoded 720p copy is uploaded; the original stays on your device (and in your photo library).

Article 4 (The AI recall feature)

"AI recall" generates answers to natural-language questions about your own records. It is off by default and only works if you turn it on in Settings. The app asks for your consent, naming the recipient and the categories of data, before anything is sent. When it is on, the following happens.

• A sentence combining a record's text, transcript, tags and address is converted into an embedding (vector) and stored in a search index.
• Your question, and the content of the records relevant to it, are sent to OpenAI, L.L.C. (United States) to generate an answer.
• A representative image from your photos and videos is sent to OpenAI so that search tags can be generated automatically. When generating tags we instruct the model not to extract people's identities or proper nouns.
• Voice memos and the audio track of videos are sent to OpenAI to be transcribed into text. For this reason, turning AI recall on also authorises the upload of video audio tracks.

Turning AI recall off stops indexing and requests deletion of the vectors already created. Audio-track files that have already been uploaded are not deleted automatically, so if you want them removed please ask using the contact details in Article 12.

Article 5 (Entrustment of personal information processing)

To provide the Service, the Company entrusts the processing of personal information as follows.

When entering into an entrustment agreement the Company stipulates the measures necessary for personal information to be managed safely — including that the processor affords protection equal to or greater than that described in this policy — and will disclose any change of processor through this policy.

Article 6 (Transfer of personal information overseas)

Most of the processors in Article 5 are located outside the Republic of Korea, so using the Service involves transferring personal information abroad.

• Recipients: the processors listed in Article 5
• Countries: the United States and other countries where each processor's data centres are located
• Categories transferred: the categories listed in Article 5
• Time and method of transfer: transmitted over an encrypted channel across the information and communications network at the time the Service is used
• Purpose and retention period: as stated in Articles 1 and 7

You may refuse the overseas transfer of your personal information, but some or all of the Service may then be unavailable to you. If you leave Backup & sync, AI recall and Pinpoint turned off, the range of information transferred abroad is greatly reduced.

Article 7 (Retention period and destruction)

1. The Company retains personal information for as long as you use the Service and destroys it without delay when you close your account.
2. Where retention is required by law, the information is kept for that period. (Act on Consumer Protection in Electronic Commerce: contract and withdrawal records 5 years, payment records 5 years, consumer complaint and dispute records 3 years.)
3. When you delete an individual record in the app, that record and the files linked to it are deleted.
4. Method of destruction: personal information stored electronically is permanently deleted so that it cannot be restored.

Article 8 (Your rights and how to exercise them)

1. You may at any time request access to, correction of, deletion of, or suspension of the processing of your personal information.
2. Rights you can exercise directly in the app: viewing, editing and deleting records; turning off Backup & sync, AI recall and Pinpoint; signing out.
3. Other requests may be made by email using the contact details in Article 12, and the Company will act on them without delay.
4. To have your account and data deleted, please follow the account and data deletion request instructions. The same page is linked from Settings > Account in the app.
5. You may withdraw location, photo-library, notification and other permissions in your operating system settings at any time. The corresponding feature then stops working, but records already saved are kept.

Article 9 (Measures to secure personal information)

• Administrative: minimising the number of people who handle personal information, and managing internal access rights
• Technical: encryption in transit (TLS) and access control over stored data — the record database is enforced by server-side security rules so that you can only reach your own data, and media upload addresses are issued only as short-lived server-signed links
• Physical: physical access control at cloud data centres (provided by the processors)

Article 10 (Behavioural information and advertising identifiers)

Ads are shown to users on the free tier, and the advertising identifier may be used in the process. You can reset the advertising identifier or limit personalised advertising in your operating system settings.

• iOS: Settings > Privacy & Security > Tracking / Apple Advertising
• Android: Settings > Google > Ads

No ads are shown on a paid plan.

Article 11 (Children under 14)

The Service is not directed at children under the age of 14, and the Company does not knowingly collect personal information from children under 14. If the Company becomes aware that it has collected such information, it will destroy it without delay.

Article 12 (Privacy officer and contact)

The Company has overall responsibility for personal information processing and has designated a privacy officer as below to handle user complaints and remedy damage relating to that processing.

• Company: avarlabs Co., Ltd. (주식회사 에이바랩스)
• Representative: Jihoon Lee
• Business registration number: 836-87-03668
• Address: 221-127, 2F, 284 Gilju-ro, Wonmi-gu, Bucheon-si, Gyeonggi-do, Republic of Korea
• Privacy officer: Jihoon Lee
• Email: root@avarlabs.com

If you need to report or consult about an infringement of your personal information, you may contact the following bodies in the Republic of Korea.

• Personal Information Infringement Report Centre (privacy.kisa.or.kr / 118)
• Personal Information Dispute Mediation Committee (kopico.go.kr / 1833-6972)
• Supreme Prosecutors' Office Cybercrime Investigation Division (spo.go.kr / 1301)
• National Police Agency Cyber Bureau (ecrm.police.go.kr / 182)

Article 13 (Changes to this policy)

This policy applies from its effective date. If its contents are added to, removed or amended because of changes in law, policy or the Service, the changes will be announced in the app or on this page at least 7 days before they take effect — or 30 days before, if they materially change users' rights.