Privacy Policy

1. Introduction

Mamuri ("we," "us," or "our") operates the Mamuri mobile application (the "App"). This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you use our App.

By using Mamuri, you agree to the collection and use of information as described in this policy. If you do not agree, please do not use the App.

Contact: sunjunapps@gmail.com

2. Information We Collect

2.1 Account Information

Data	Purpose	Required
Email address	Account authentication, communication	Yes
Password	Account security (stored as bcrypt hash)	Yes (email signup)
Nickname	Personalization, displayed in-app	Yes
AI companion name	Personalize AI responses	Optional

2.2 Social Login Information

If you sign in with Google or Apple, we receive:

Data	Source	Purpose
OAuth provider identifier	Google / Apple	Link your social account
Profile image URL	Google / Apple	Display your avatar (optional)
Email address	Google / Apple	Account identification

We do not receive or store your social media passwords.

2.3 User-Generated Content

Data	Purpose
Diary entries (title, content, date)	Core app functionality
Conversation messages with AI	AI companion interaction

2.4 Automatically Collected Data

Data	Purpose
AI usage metrics (token count, model used)	Service quality and cost management
Device language preference	Localization
Authentication tokens	Secure session management

2.5 Information We Do NOT Collect

• Location data
• Phone number
• Government-issued ID
• Biometric data
• Contacts or address book
• Browsing history
• Advertising identifiers
• Analytics or tracking data

3. How We Use Your Information

Purpose	Data Used	Legal Basis
Provide the diary service	Diary content, account info	Contract performance
Generate AI companion responses	Diary content, nickname, AI name	Contract performance
Manage your account	Email, password, auth tokens	Contract performance
Process subscriptions	Email, Stripe customer ID	Contract performance
Detect crisis content	Diary content (keyword matching)	Legitimate interest (user safety)
Improve service quality	Anonymized usage metrics	Legitimate interest

4. AI Processing and Third-Party Data Sharing

4.1 OpenAI API

What is sent to OpenAI:

• Your diary entry (title and content, up to 3,000 characters)
• Your nickname (for personalized responses)
• Your AI companion's name
• Recent conversation history (up to 10 messages)

What is NOT sent to OpenAI:

• Your email address
• Your password
• Your user ID
• Payment information
• Social login credentials

OpenAI processes data according to their API data usage policy. As of this policy's effective date, OpenAI states that API data is not used to train their models.

4.2 Firebase Authentication (Google)

We use Firebase Authentication for social login (Google and Apple Sign-In). See Google's Privacy Policy.

4.3 Stripe (Payment Processing)

Payment is processed by Stripe, Inc. We share your email and subscription selection. We do not store credit card information. See Stripe's Privacy Policy.

4.4 No Other Third-Party Sharing

• We do not sell your personal data
• We do not share data with advertising networks
• We do not use analytics or tracking SDKs
• We do not share data with data brokers

5. Data Storage and Security

5.1 Storage

• Server-side data is stored in PostgreSQL databases hosted on Self-hosted, Republic of Korea
• Device authentication tokens use native secure storage (iOS Keychain / Android Keystore)
• Passwords are hashed using bcrypt

5.2 Security Measures

• All communication uses HTTPS/TLS encryption
• JWT access tokens expire after 1 hour
• Refresh tokens expire after 7 days
• Token reuse detection with automatic session invalidation
• Password requirements: minimum 8 characters with letters and numbers

5.3 Data Retention

Data	Retention Period
Active account data	Until account deletion
Diary entries	Until individually deleted or account deletion
AI comments and conversations	Until associated diary or account is deleted
Account deletion records	Retained indefinitely (legal compliance)
AI usage logs	Retained indefinitely (anonymized)
Safety event records	Retained indefinitely (anonymized after deletion)

6. Crisis Detection and Safety

7. Your Rights

• Access: View all your data within the App
• Correction: Edit diary entries and profile information anytime
• Deletion: Delete your account via Settings > Account > Delete Account (3-step process)
• Withdraw Consent: Stop using the App at any time

EU/EEA users may have additional rights including objection to processing, restriction of processing, and filing complaints with data protection authorities. Contact sunjunapps@gmail.com to exercise your rights.

8. International Data Transfers

Service	Location	Purpose
OpenAI	United States	AI response generation
Stripe	United States	Payment processing
Firebase	United States (Google Cloud)	Authentication
Mamuri Server	Republic of Korea	Primary data storage

9. Children's Privacy

Mamuri does not knowingly collect personal information from children under 13 (or the minimum age required by applicable law). Contact sunjunapps@gmail.com if you believe a child has provided personal information.

10. Subscriptions

Tier	AI Replies / Day	Price
Free	1	Free
Deluxe	3	₩4,900/month
Premium	Unlimited	₩9,900/month

New users may receive a 7-day free trial. Subscriptions can be cancelled at any time.

11. Changes to This Policy

We may update this policy. Significant changes will be posted in the App with an updated "Last Updated" date.

12. Contact Us

Email: sunjunapps@gmail.com

Developer: SUNJUN KIM

Address: 24, Suseong-ro 276beon-gil, Jangan-gu, Suwon-si, Gyeonggi-do, Republic of Korea