etamong playground 약관 및 개인정보etamong playground Terms & Privacy

Purpose

These terms set out the conditions and procedures for using bandstand (the "Service"), and the rights and obligations between the operator and users.

What the Service Provides

The Service provides the following.

• Uploading and storing score files (Guitar Pro, MusicXML)
• Converting PDF and image scores into score data through optical music recognition (OMR)
• A practice view that flows measure by measure
• Building and managing setlists
• Offline reading when the network is unavailable

Signing Up

You sign up by logging in through single sign-on (OIDC/SSO).

Using the Service

The Service is free. Your account tier caps how many scores you may convert per month; even at the cap you can keep opening and practising the scores you already have stored.

The operator works to keep the Service stable, but it may be interrupted without notice. The Service is provided AS-IS.

Rights in Uploaded Material

You may upload only scores you hold the copyright to, have been licensed to use by the rights holder, or that are out of copyright (public domain).

Uploaded scores are linked only to your own account, stay private, and are not made visible to other users. If an infringement report is received, the operator may restrict or delete the material concerned.

Prohibited Conduct

You must not upload illegal content, material that infringes others' rights, or malware. The operator may restrict or delete data judged to be abusive without prior notice.

Deletion and Account Closure

You can delete your uploaded scores and setlists at any time; deleted material cannot be recovered.

To close your account, send a request to the contact below and all linked scores, setlists, and conversion records will be deleted.

Limitation of Liability

The Service is provided AS-IS with no warranty of fitness for a particular purpose. The operator is not liable for service interruption or data loss caused by force majeure such as natural disaster or system failure.

Intellectual Property

Copyright and intellectual property in the Service belong to the operator. Rights in the scores you upload and the data you enter belong to you or to the original rights holder.

Changes to These Terms

Changes to these terms are announced within the Service. Material changes are announced at least 7 days before they take effect.

Governing Law

These terms are interpreted, and disputes resolved, under the laws of the Republic of Korea. Contact: [email protected]

Effective Date

These terms take effect on 3 August 2026.

Purpose

These terms set out the conditions and procedures for using bandstand (the "Service"), and the rights and obligations between the operator and users.

What the Service Provides

The Service provides the following.

• Uploading and storing score files (Guitar Pro, MusicXML)
• Converting PDF and image scores into score data through optical music recognition (OMR)
• A practice view that flows measure by measure
• Building and managing setlists
• Offline reading when the network is unavailable

Signing Up

You sign up by logging in through single sign-on (OIDC/SSO).

Using the Service

The Service is free. Your account tier caps how many scores you may convert per month; even at the cap you can keep opening and practising the scores you already have stored.

The operator works to keep the Service stable, but it may be interrupted without notice. The Service is provided AS-IS.

Rights in Uploaded Material

You may upload only scores you hold the copyright to, have been licensed to use by the rights holder, or that are out of copyright (public domain).

Uploaded scores are linked only to your own account, stay private, and are not made visible to other users. If an infringement report is received, the operator may restrict or delete the material concerned.

Prohibited Conduct

You must not upload illegal content, material that infringes others' rights, or malware. The operator may restrict or delete data judged to be abusive without prior notice.

Deletion and Account Closure

You can delete your uploaded scores and setlists at any time; deleted material cannot be recovered.

You can close your account yourself from the settings screen in the Service. Signing back in within 30 days of the request undoes it. The Service keeps working during the window, and anything you upload in the meantime is deleted along with the rest when the closure completes.

After 30 days your account and identifying data are de-identified beyond recovery, and your uploaded scores, conversions, setlists and conversion records are deleted. It cannot be undone after that; signing in again with the same identity creates a new account.

Limitation of Liability

The Service is provided AS-IS with no warranty of fitness for a particular purpose. The operator is not liable for service interruption or data loss caused by force majeure such as natural disaster or system failure.

Intellectual Property

Copyright and intellectual property in the Service belong to the operator. Rights in the scores you upload and the data you enter belong to you or to the original rights holder.

Changes to These Terms

Changes to these terms are announced within the Service. Material changes are announced at least 7 days before they take effect.

Governing Law

These terms are interpreted, and disputes resolved, under the laws of the Republic of Korea. Contact: [email protected]

Effective Date

These terms take effect on 3 August 2026.

Purpose of Processing

bandstand (the "Service") processes personal data for the following purposes.

• Account identification and management: identifying you and confirming eligibility through single sign-on (OIDC/SSO)
• Service delivery: uploading and storing score files, rendering the measure-by-measure practice view, and building and managing setlists
• Score conversion: converting uploaded PDF and image scores into playable score data through optical music recognition (OMR)
• Usage management: counting monthly score conversions against your account tier

Personal Data Collected

The following is collected through single sign-on (OIDC).

• Email address
• Authentication subject identifier (sub)

The following is created and stored as you use the Service.

• Sign-up time and last seen time
• Uploaded score files and their metadata (title, file format, file size, measure structure, playback duration)
• Setlists and their items
• Optical music recognition (OMR) job records (progress state, error code on failure)
• Monthly conversion count and account tier

Uploaded score files are stored in object storage the operator runs itself and are linked only to the uploader's account. Optical music recognition is performed by a conversion engine the operator runs itself; files are never sent to an external cloud service.

So that scores stay readable with the network off, the Service keeps the app shell and the scores you have opened in your browser's local storage. Clearing that storage removes the data.

Retention Period

Account data is retained for as long as the account exists.

Uploaded scores and setlists are retained until you delete them; deleting one removes both the database record and the file in object storage.

If a conversion request is judged not to be a score, or you reject the conversion result, the uploaded original file is deleted immediately.

On an account deletion request, the account record and all linked scores, setlists, and conversion records are deleted. Where the law requires retention, the data is kept for that period and then destroyed.

Disclosure to Third Parties

The Service does not disclose personal data to third parties. Uploaded scores are linked only to the uploader's account, stay private, and are not made visible to other users.

Processing Consignment and Operator Access

Data storage, authentication, and optical music recognition all run on self-hosted infrastructure the operator manages directly; none of it is consigned to an outside vendor.

To operate the Service, the operator (administrator) can view and modify the account list, account tiers, and score conversion job records through an administration tool (back-office console).

Your Rights

You may exercise the following rights at any time.

• Request access to your personal data
• Request correction or deletion of your personal data
• Request that processing be suspended
• Delete your uploaded scores and setlists
• Request account deletion

Destruction Procedure

Deleting a score or setlist removes both the database record and the file in object storage, and cannot be undone.

On an account deletion request, the account record and all linked scores, setlists, and conversion records are deleted. Send requests to the contact below.

Data the law requires us to retain is kept separately from other personal data for that period and then destroyed.

Data Controller

For questions about how personal data is handled, contact:

• Data controller: etamong
• Contact: [email protected]

Cross-Border Transfer

Personal data is transferred overseas as follows in order to operate the Service.

• Recipient: Cloudflare, Inc. ([email protected])
• Destination country: United States (globally distributed edge PoPs)
• Timing and method: automatically, over the network, on every request you make to the Service (via the Cloudflare CDN and security edge)
• Items transferred: IP address, User-Agent, request URL, access time, service authentication and session cookies
• Purpose: content delivery network (CDN), DDoS and bot mitigation, traffic security
• Retention: per Cloudflare's operational policy (short-term security log retention)
• How to refuse and its effect: given how the Service works, refusing means the Service cannot be used.

Automatic Collection Tools

The following tool is used to compile usage statistics.

• Tool: Cloudflare Web Analytics
• Operator: Cloudflare, Inc. (United States)
• Items collected: page URL, referrer, browser and OS type, device type, country of access (derived from IP, which is discarded immediately), page load time
• Method: an automatic beacon sent by the browser on page load
• Purpose: aggregating anonymous access statistics
• Cookies: not used
• How to refuse: block static.cloudflareinsights.com in your browser, or use an ad/tracker blocker

The following self-hosted tool is also used to diagnose front-end errors and improve performance.

• Tool: self-hosted web performance and error collection
• Operator: etamong (self-hosted; collected data is not sent externally)
• Items collected: page path (query string excluded), browser and OS type, front-end error messages, page load and response times, a randomly generated session identifier
• Method: sent automatically by the browser while you use the Service
• Purpose: error diagnosis and performance improvement
• Cookies: not used
• Email, authentication identifiers, and anything you type or upload are not collected.
• How to refuse: use an ad/tracker blocker in your browser

Effective Date

This privacy policy takes effect on 3 August 2026.

Purpose of Processing

bandstand (the "Service") processes personal data for the following purposes.

• Account identification and management: identifying you and confirming eligibility through single sign-on (OIDC/SSO)
• Service delivery: uploading and storing score files, rendering the measure-by-measure practice view, and building and managing setlists
• Score conversion: converting uploaded PDF and image scores into playable score data through optical music recognition (OMR)
• Usage management: counting monthly score conversions against your account tier

Personal Data Collected

The following is collected through single sign-on (OIDC).

• Email address
• Authentication subject identifier (sub)

The following is created and stored as you use the Service.

• Sign-up time and last seen time
• Uploaded score files and their metadata (title, file format, file size, measure structure, playback duration)
• Setlists and their items
• Optical music recognition (OMR) job records (progress state, error code on failure)
• Monthly conversion count and account tier

Uploaded score files are stored in object storage the operator runs itself and are linked only to the uploader's account. Optical music recognition is performed by a conversion engine the operator runs itself; files are never sent to an external cloud service.

So that scores stay readable with the network off, the Service keeps the app shell and the scores you have opened in your browser's local storage. Clearing that storage removes the data.

Retention Period

Account data is retained for as long as the account exists.

Uploaded scores and setlists are retained until you delete them; deleting one removes both the database record and the file in object storage.

If a conversion request is judged not to be a score, or you reject the conversion result, the uploaded original file is deleted immediately.

When you ask to close your account, the account data is retained for 30 days. During that window you can sign back in and undo the request; the data is retained for that purpose only and is not used for anything else. The Service keeps working during the window, and anything you upload in the meantime is deleted with the rest.

After 30 days, identifying data such as your email and authentication identifier is de-identified beyond recovery — treated as destruction. Your uploaded score files and their conversions are removed from object storage, and setlists and conversion records linked to the account are deleted. Data the law requires us to retain is kept for that period and then destroyed.

Disclosure to Third Parties

The Service does not disclose personal data to third parties. Uploaded scores are linked only to the uploader's account, stay private, and are not made visible to other users.

Processing Consignment and Operator Access

Data storage, authentication, and optical music recognition all run on self-hosted infrastructure the operator manages directly; none of it is consigned to an outside vendor.

To operate the Service, the operator (administrator) can view and modify the account list, account tiers, and score conversion job records through an administration tool (back-office console).

Your Rights

You may exercise the following rights at any time.

• Request access to your personal data
• Request correction or deletion of your personal data
• Request that processing be suspended
• Delete your uploaded scores and setlists
• Close your account (from the settings screen in the Service; undoable within 30 days)

Destruction Procedure

Deleting a score or setlist removes both the database record and the file in object storage, and cannot be undone.

You can close your account yourself from the settings screen in the Service. A 30-day grace period applies from the request, during which the data is retained only so the request can be undone.

After 30 days, identifying data is de-identified beyond recovery and the scores, conversions, setlists and conversion records linked to the account are deleted. Once de-identified it cannot be restored; signing in again with the same identity creates a new account.

Data the law requires us to retain is kept separately from other personal data for that period and then destroyed.

Data Controller

For questions about how personal data is handled, contact:

• Data controller: etamong
• Contact: [email protected]

Cross-Border Transfer

Personal data is transferred overseas as follows in order to operate the Service.

• Recipient: Cloudflare, Inc. ([email protected])
• Destination country: United States (globally distributed edge PoPs)
• Timing and method: automatically, over the network, on every request you make to the Service (via the Cloudflare CDN and security edge)
• Items transferred: IP address, User-Agent, request URL, access time, service authentication and session cookies
• Purpose: content delivery network (CDN), DDoS and bot mitigation, traffic security
• Retention: per Cloudflare's operational policy (short-term security log retention)
• How to refuse and its effect: given how the Service works, refusing means the Service cannot be used.

Automatic Collection Tools

The following tool is used to compile usage statistics.

• Tool: Cloudflare Web Analytics
• Operator: Cloudflare, Inc. (United States)
• Items collected: page URL, referrer, browser and OS type, device type, country of access (derived from IP, which is discarded immediately), page load time
• Method: an automatic beacon sent by the browser on page load
• Purpose: aggregating anonymous access statistics
• Cookies: not used
• How to refuse: block static.cloudflareinsights.com in your browser, or use an ad/tracker blocker

The following self-hosted tool is also used to diagnose front-end errors and improve performance.

• Tool: self-hosted web performance and error collection
• Operator: etamong (self-hosted; collected data is not sent externally)
• Items collected: page path (query string excluded), browser and OS type, front-end error messages, page load and response times, a randomly generated session identifier
• Method: sent automatically by the browser while you use the Service
• Purpose: error diagnosis and performance improvement
• Cookies: not used
• Email, authentication identifiers, and anything you type or upload are not collected.
• How to refuse: use an ad/tracker blocker in your browser

Effective Date

This privacy policy takes effect on 3 August 2026.

Article 1 (Purpose)

This agreement sets forth the terms and procedures for using the Book Train service, as well as the rights and obligations of both users and operators.

Article 2 (Definitions)

"Service" refers to the web/app functions governed by this Terms of Service. "User" denotes an individual who utilizes the Service in accordance with these Terms of Service.

Article 3 (Effectiveness and Amendment of the Terms)

These terms take effect upon posting on the service. Changes will be implemented seven days in advance (or thirty days for material or urgent changes).

Article 4 (Service Provision, Modification, and Suspension)

The Operator may modify or suspend the service content at its discretion based on operational needs or technical requirements, and it shall notify such changes in advance.

Article 5 (User Obligations)

The user must comply with applicable laws and these terms of service. The user must not infringe on the rights of others or interfere with the operation of the service.

Limitation of Liability

This service is provided as a non-commercial and personal operation service, without any warranty of availability or data retention. We shall not be liable for any losses incurred due to force majeure or user negligence.

Article 7 (Membership Withdrawal and Account Closure)

You may request to withdraw your membership at any time. Upon request, your personal information and the data you created are retained for 30 days, during which you can cancel the withdrawal (restore your account) by logging in again. After 30 days, identifying information such as your email and name is de-identified beyond recovery, and the data you own is deleted (equivalent to disposal). The detailed retention and disposal procedure follows the Privacy Policy.

Article 8 (Applicable Law and Jurisdiction)

This Agreement shall be governed by the laws of the Republic of Korea. Any disputes arising thereunder shall be exclusively subject to the jurisdiction of the courts having jurisdiction over the operator.

Article 1 (Purpose)

This agreement sets forth the terms and procedures for using the Book Train service, as well as the rights and obligations of both users and operators.

Article 2 (Definitions)

"Service" refers to the web/app functions governed by this Terms of Service. "User" denotes an individual who utilizes the Service in accordance with these Terms of Service.

Article 3 (Effectiveness and Amendment of the Terms)

These terms take effect upon posting on the service. Changes will be implemented seven days in advance (or thirty days for material or urgent changes).

Article 4 (Service Provision, Modification, and Suspension)

The Operator may modify or suspend the service content at its discretion based on operational needs or technical requirements, and it shall notify such changes in advance.

Article 5 (User Obligations)

The user must comply with applicable laws and these terms of service. The user must not infringe on the rights of others or interfere with the operation of the service.

Limitation of Liability

This service is provided as a non-commercial and personal operation service, without any warranty of availability or data retention. We shall not be liable for any losses incurred due to force majeure or user negligence.

Article 7 (Membership Withdrawal and Account Closure)

You may request to withdraw your membership at any time. Upon request, your personal information and the data you created are retained for 30 days, during which you can cancel the withdrawal (restore your account) by logging in again. After 30 days, identifying information such as your email and name is de-identified beyond recovery, and the data you own is deleted (equivalent to disposal). The detailed retention and disposal procedure follows the Privacy Policy.

Article 8 (Applicable Law and Jurisdiction)

This Agreement shall be governed by the laws of the Republic of Korea. Any disputes arising thereunder shall be exclusively subject to the jurisdiction of the courts having jurisdiction over the operator.

Purpose of Processing Personal Information

The personal information is processed for the purposes of member identification and service provision and operation. It shall not be used for any other purpose beyond those explicitly stated.

Article 2 (Personal Information Items Processed)

Email, Name (Google Account, via Authentik OIDC). Train booking requests and reservation records.

Article 3 (Retention Period and Disposal)

The data will be deleted without delay upon the achievement of the processing purpose or upon member withdrawal. If there is a legal obligation to retain the data, it will be kept for the prescribed period.

Article 4 (Third-Party Provision of Personal Information)

We do not provide personal information to third parties unless with the user's consent or where there are special provisions under applicable law.

Article 5 (Data Processing Delegation and Operator Access)

The operator (administrator) may view, modify, and delete member data through the management tool (back-office console) for the purpose of service operation.

Article 6 (Rights and Procedures of Data Subjects)

The data subject may request at any time to view, correct, delete, or pause the processing of their personal information by contacting the controller at the following contact details.

Article 7 (Measures to Ensure Security)

The following measures are applied: access permission control, encryption during transmission (HTTPS), and retention of access records.

Article 8 (Personal Data Protection Officer)

The contact information for the Personal Data Protection Officer is the same as that listed at the top of this policy.

Article 9 (Obligation to Notify)

This policy will be implemented seven days before any changes are made (or thirty days for significant or urgent changes).

Cross-border Transfer

In order to operate the service, we transfer personal information as follows:

• Recipient: Cloudflare, Inc. ([email protected])
• Country of transfer: United States (worldwide distributed edge PoPs)
• Timing and method of transfer: Automatic transfer at every moment a user accesses the service via network transmission (Cloudflare CDN and security edge)
• Items transferred: IP address, User-Agent, requested URL, time of access, service authentication/session cookies
• Purpose of transfer: Content delivery network (CDN), DDoS/bot blocking, traffic security
• Duration of retention and use: According to Cloudflare's operating policy (short-term retention of security logs)
• Refusal method and effects: Due to the nature of our service, refusal results in the inability to use the service.

Automatic Collection Tools

We use the following automatic collection tools for service usage statistics.

• Tool: Cloudflare Web Analytics
• Operator: Cloudflare, Inc. (USA)
• Items Collected: Page URL, Referring Page (referrer), Browser/OS Type, Device Type, Access Country (IP extracted and immediately discarded), Page Load Time
• Collection Method: Automatic beacon transmission by the browser upon page load
• Purpose of Collection: Aggregation of anonymous access statistics
• Cookie Usage: Not used
• How to Opt Out: Block `static.cloudflareinsights.com` in your browser or use an ad/tracking blocker

Purpose of Processing Personal Information

The personal information is processed for the purposes of member identification and service provision and operation. It shall not be used for any other purpose beyond those explicitly stated.

Article 2 (Personal Information Items Processed)

Email, Name (Google Account, via Authentik OIDC). Train booking requests and reservation records.

Article 3 (Retention Period and Disposal)

When you request to withdraw your membership, your personal data is retained for 30 days, during which you can cancel the withdrawal (restore your account) by logging in again. After 30 days, identifying information such as your email and name is de-identified so that it cannot be restored, and your stored booking credentials (encrypted KTX/SRT login information) together with your train-booking requests and reservation history are deleted (equivalent to disposal). Where a retention obligation exists under applicable law, the data is kept for the period required.

Article 4 (Third-Party Provision of Personal Information)

We do not provide personal information to third parties unless with the user's consent or where there are special provisions under applicable law.

Article 5 (Data Processing Delegation and Operator Access)

The operator (administrator) may view, modify, and delete member data through the management tool (back-office console) for the purpose of service operation.

Article 6 (Rights and Procedures of Data Subjects)

The data subject may request at any time to view, correct, delete, or pause the processing of their personal information by contacting the controller at the following contact details.

Article 7 (Measures to Ensure Security)

The following measures are applied: access permission control, encryption during transmission (HTTPS), and retention of access records.

Article 8 (Personal Data Protection Officer)

The contact information for the Personal Data Protection Officer is the same as that listed at the top of this policy.

Article 9 (Obligation to Notify)

This policy will be implemented seven days before any changes are made (or thirty days for significant or urgent changes).

Cross-border Transfer

In order to operate the service, we transfer personal information as follows:

• Recipient: Cloudflare, Inc. ([email protected])
• Country of transfer: United States (worldwide distributed edge PoPs)
• Timing and method of transfer: Automatic transfer at every moment a user accesses the service via network transmission (Cloudflare CDN and security edge)
• Items transferred: IP address, User-Agent, requested URL, time of access, service authentication/session cookies
• Purpose of transfer: Content delivery network (CDN), DDoS/bot blocking, traffic security
• Duration of retention and use: According to Cloudflare's operating policy (short-term retention of security logs)
• Refusal method and effects: Due to the nature of our service, refusal results in the inability to use the service.

Automatic Collection Tools

We use the following automatic collection tools for service usage statistics.

• Tool: Cloudflare Web Analytics
• Operator: Cloudflare, Inc. (USA)
• Items Collected: Page URL, Referring Page (referrer), Browser/OS Type, Device Type, Access Country (IP extracted and immediately discarded), Page Load Time
• Collection Method: Automatic beacon transmission by the browser upon page load
• Purpose of Collection: Aggregation of anonymous access statistics
• Cookie Usage: Not used
• How to Opt Out: Block `static.cloudflareinsights.com` in your browser or use an ad/tracking blocker

Purpose of Processing Personal Information

The personal information is processed for the purposes of member identification and service provision and operation. It shall not be used for any other purpose beyond those explicitly stated.

Article 2 (Personal Information Items Processed)

Email, Name (Google Account, via Authentik OIDC). Train booking requests and reservation records.

Article 3 (Retention Period and Disposal)

When you request to withdraw your membership, your personal data is retained for 30 days, during which you can cancel the withdrawal (restore your account) by logging in again. After 30 days, identifying information such as your email and name is de-identified so that it cannot be restored, and your stored booking credentials (encrypted KTX/SRT login information) together with your train-booking requests and reservation history are deleted (equivalent to disposal). Where a retention obligation exists under applicable law, the data is kept for the period required.

Article 4 (Third-Party Provision of Personal Information)

We do not provide personal information to third parties unless with the user's consent or where there are special provisions under applicable law.

Article 5 (Data Processing Delegation and Operator Access)

The operator (administrator) may view, modify, and delete member data through the management tool (back-office console) for the purpose of service operation.

Article 6 (Rights and Procedures of Data Subjects)

The data subject may request at any time to view, correct, delete, or pause the processing of their personal information by contacting the controller at the following contact details.

Article 7 (Measures to Ensure Security)

The following measures are applied: access permission control, encryption during transmission (HTTPS), and retention of access records.

Article 8 (Personal Data Protection Officer)

The contact information for the Personal Data Protection Officer is the same as that listed at the top of this policy.

Article 9 (Obligation to Notify)

This policy will be implemented seven days before any changes are made (or thirty days for significant or urgent changes).

Cross-border Transfer

In order to operate the service, we transfer personal information as follows:

• Recipient: Cloudflare, Inc. ([email protected])
• Country of transfer: United States (worldwide distributed edge PoPs)
• Timing and method of transfer: Automatic transfer at every moment a user accesses the service via network transmission (Cloudflare CDN and security edge)
• Items transferred: IP address, User-Agent, requested URL, time of access, service authentication/session cookies
• Purpose of transfer: Content delivery network (CDN), DDoS/bot blocking, traffic security
• Duration of retention and use: According to Cloudflare's operating policy (short-term retention of security logs)
• Refusal method and effects: Due to the nature of our service, refusal results in the inability to use the service.

Automatic Collection Tools

We use the following automatic collection tools for service usage statistics.

• Tool: Cloudflare Web Analytics
• Operator: Cloudflare, Inc. (USA)
• Items Collected: Page URL, Referring Page (referrer), Browser/OS Type, Device Type, Access Country (IP extracted and immediately discarded), Page Load Time
• Collection Method: Automatic beacon transmission by the browser upon page load
• Purpose of Collection: Aggregation of anonymous access statistics
• Cookie Usage: Not used
• How to Opt Out: Block `static.cloudflareinsights.com` in your browser or use an ad/tracking blocker

Article 1 (Service Introduction)

eventops (hereinafter referred to as "the Service") is a personal management tool that helps users plan festival performance schedules, provide instructions on stage transitions, and assist in subscribing to selected schedules via calendar (ICS) or sharing through links. It is provided 'as-is' without any commercial intent.

Article 2 (Eligibility)

To utilize the service, an integrated login (Authentik) account is required. The account qualification policy follows that of the respective authentication provider.

Article 3 (User's Responsibility)

The user shall be responsible for the schedule data that they input or share. The shared link and ICS subscription address contain a secret token, allowing anyone who knows it to view the schedule.

Article 4 (Accuracy of Festival Information)

Lineups, schedules, and travel times are reference information input by the manager and may differ from official information. For the actual schedule, please refer to the official announcement by the organizer.

Limitation of Liability

The operator shall not be liable for any damages arising from the use or inability to use the service, data loss, missed appointments, or any other losses, to the extent permitted by law.

Article 6 (Terms of Service Changes)

The terms and conditions may be modified. Any changes will be communicated at least seven days in advance (or thirty days for material or significant changes).

Article 1 (Service Introduction)

eventops (hereinafter referred to as "the Service") is a personal management tool that helps users plan festival performance schedules, provide instructions on stage transitions, and assist in subscribing to selected schedules via calendar (ICS) or sharing through links. It is provided 'as-is' without any commercial intent.

Article 2 (Eligibility)

To utilize the service, an integrated login (Authentik) account is required. The account qualification policy follows that of the respective authentication provider.

Article 3 (User's Responsibility)

The user shall be responsible for the schedule data that they input or share. The shared link and ICS subscription address contain a secret token, allowing anyone who knows it to view the schedule.

Article 4 (Accuracy of Festival Information)

Lineups, schedules, and travel times are reference information input by the manager and may differ from official information. For the actual schedule, please refer to the official announcement by the organizer.

Limitation of Liability

The operator shall not be liable for any damages arising from the use or inability to use the service, data loss, missed appointments, or any other losses, to the extent permitted by law.

Article 6 (Membership Withdrawal and Account Closure)

You may request to withdraw your membership at any time. Upon request, your personal information is retained for 30 days, during which you can cancel the withdrawal (restore your account) by logging in again. After 30 days, identifying information such as your email and name is de-identified beyond recovery, and the schedules you own together with the comments and votes you have made and your calendar-subscription token are deleted (equivalent to disposal). The detailed retention and disposal procedure follows the Privacy Policy.

Article 7 (Terms of Service Changes)

The terms and conditions may be modified. Any changes will be communicated at least seven days in advance (or thirty days for material or significant changes).

Article 1 (Service Introduction)

eventops (hereinafter referred to as "the Service") is a personal management tool that helps users plan festival performance schedules, provide instructions on stage transitions, and assist in subscribing to selected schedules via calendar (ICS) or sharing through links. It is provided 'as-is' without any commercial intent.

Article 2 (Eligibility)

To utilize the service, an integrated login (Authentik) account is required. The account qualification policy follows that of the respective authentication provider.

Article 3 (User's Responsibility)

The user shall be responsible for the schedule data that they input or share. The shared link and ICS subscription address contain a secret token, allowing anyone who knows it to view the schedule.

Article 4 (Accuracy of Festival Information)

Lineups, schedules, and travel times are reference information input by the manager and may differ from official information. For the actual schedule, please refer to the official announcement by the organizer.

Limitation of Liability

The operator shall not be liable for any damages arising from the use or inability to use the service, data loss, missed appointments, or any other losses, to the extent permitted by law.

Article 6 (Membership Withdrawal and Account Closure)

You may request to withdraw your membership at any time. Upon request, your personal information is retained for 30 days, during which you can cancel the withdrawal (restore your account) by logging in again. After 30 days, identifying information such as your email and name is de-identified beyond recovery, and the schedules you own together with the comments and votes you have made and your calendar-subscription token are deleted (equivalent to disposal). The detailed retention and disposal procedure follows the Privacy Policy.

Article 7 (Terms of Service Changes)

The terms and conditions may be modified. Any changes will be communicated at least seven days in advance (or thirty days for material or significant changes).

Article 1 (Personal Information Collected)

• Account Identifier: The email address transmitted by Authentik(OIDC) during login. Used for user identification and distinguishing data ownership.
• Display Information: The display name and profile picture URL provided by the OIDC provider (e.g., Google). Used to indicate commenters, co-workers, and schedule creators in shared events.
• Usage Data: The created calendar sets, selected performances, calendar subscription tokens, notification settings, and comments made by the user.
• Push Subscription Information: If web push notifications are enabled, the browser-provided push endpoint and keys (p256dh, auth). Used exclusively for sending notifications.

Article 2 (Purpose of Use)

This service is used for providing calendar planning, subscription, and sharing functions, as well as displaying comments. It is also used to send notifications about the start of performances, sharing events, and new festival announcements.

Article 3 (Information Displayed to Other Users)

When leaving a comment on a shared schedule, the display name, profile picture, and body of the comment along with the time it was written are shown to other users viewing the same schedule. The full email address is not displayed.

Article 4 (Third-Party Provision)

We do not sell or provide the information we collect to third parties. Profile pictures are loaded directly from the original URL provided by the OIDC provider's browser, and web push notifications use the browser manufacturer's push service.

Article 5 (Retention and Disposal)

Data is stored on our self-hosted PostgreSQL server. Events, comments, and notification settings can be deleted directly from the settings menu, and push subscriptions can be disabled there. Data will be disposed of without delay upon member withdrawal or when the purpose for which it was collected is no longer applicable.

Article 6 (Calendar Subscription Address)

The ICS subscription address is a publicly accessible URL that is authenticated using a secret token. Anyone who knows the address can view the schedule, so do not expose it to the outside.

Article 7 (Operator Access)

The operator (administrator) has the authority to view, modify, and delete member data through the management tool (back-office console) for the purpose of service operation.

Article 8 (Rights of Data Subjects)

The rights to request access, rectification, deletion, and suspension of processing may be exercised by contacting the controller at the designated contact point.

Article 9 (Processing of AI Function and Input Information)

When using the AI features of this service (such as schedule recommendations, playlist retrieval, etc.), the information you provide is collected and analyzed for the purposes of improving service quality and preventing spam and abuse. Before storage, any personally identifiable information (such as email addresses or phone numbers) will be automatically masked. User identifiers and connection information are processed in a de-identified manner (hashing), making it impossible to restore them. Anonymized records are automatically deleted 90 days after collection, and the operator can only view anonymized records through the management console.

Article 10 (Inquiries)

Privacy-related inquiries: Please contact the controller at the top of this policy.

Cross-border Transfer

For the operation of our service, we transfer personal information to third parties outside the country.

• Recipient: Cloudflare, Inc. ([email protected])
• Country of Transfer: United States (worldwide distributed edge PoPs)
• Timing and Method: Automatic transfer via network transmission at every moment a user accesses the service (Cloudflare CDN and security edge relayed)
• Items Transferred: IP address, User-Agent, requested URL, time of access, service authentication/session cookies
• Purpose of Transfer: Content delivery network (CDN), DDoS/bot blocking, traffic security
• Storage and Usage Period: According to Cloudflare's operational policies (short-term retention of security logs)
• Refusal Method and Effect: Due to the nature of our service, refusal may result in the inability to use the service.

Automated Collection Tools

We use the following automated collection tools for service usage statistics.

• Tool: Cloudflare Web Analytics
• Operator: Cloudflare, Inc. (USA)
• Items Collected: Page URL, Referring Page (referrer), Browser/OS Type, Device Type, Access Country (IP extracted and immediately discarded), Page Load Time
• Method of Collection: Automatic beacon transmission by the browser upon page load
• Purpose of Collection: Aggregation of anonymous access statistics
• Use of Cookies: Not used
• How to Opt Out: Block `static.cloudflareinsights.com` in your browser or use an ad/tracking blocker

Article 1 (Personal Information Collected)

• Account Identifier: The email address transmitted by Authentik(OIDC) during login. Used for user identification and distinguishing data ownership.
• Display Information: The display name and profile picture URL provided by the OIDC provider (e.g., Google). Used to indicate commenters, co-workers, and schedule creators in shared events.
• Usage Data: The created calendar sets, selected performances, calendar subscription tokens, notification settings, and comments made by the user.
• Push Subscription Information: If web push notifications are enabled, the browser-provided push endpoint and keys (p256dh, auth). Used exclusively for sending notifications.

Article 2 (Purpose of Use)

This service is used for providing calendar planning, subscription, and sharing functions, as well as displaying comments. It is also used to send notifications about the start of performances, sharing events, and new festival announcements.

Article 3 (Information Displayed to Other Users)

When leaving a comment on a shared schedule, the display name, profile picture, and body of the comment along with the time it was written are shown to other users viewing the same schedule. The full email address is not displayed.

Article 4 (Third-Party Provision)

We do not sell or provide the information we collect to third parties. Profile pictures are loaded directly from the original URL provided by the OIDC provider's browser, and web push notifications use the browser manufacturer's push service.

Article 5 (Retention and Disposal)

Data is stored on our self-hosted PostgreSQL server. When you request to withdraw your membership, your personal data is retained for 30 days, during which you can cancel the withdrawal (restore your account) by logging in again. After 30 days, identifying information such as your email and name is de-identified so that it cannot be restored, and the schedules you own together with the comments and votes you have made and your calendar-subscription token are deleted (equivalent to disposal). Events, comments, and notification settings can be deleted directly before withdrawal, and push subscriptions can be disabled from the settings menu.

Article 6 (Calendar Subscription Address)

The ICS subscription address is a publicly accessible URL that is authenticated using a secret token. Anyone who knows the address can view the schedule, so do not expose it to the outside.

Article 7 (Operator Access)

The operator (administrator) has the authority to view, modify, and delete member data through the management tool (back-office console) for the purpose of service operation.

Article 8 (Rights of Data Subjects)

The rights to request access, rectification, deletion, and suspension of processing may be exercised by contacting the controller at the designated contact point.

Article 9 (Processing of AI Function and Input Information)

When using the AI features of this service (such as schedule recommendations, playlist retrieval, etc.), the information you provide is collected and analyzed for the purposes of improving service quality and preventing spam and abuse. Before storage, any personally identifiable information (such as email addresses or phone numbers) will be automatically masked. User identifiers and connection information are processed in a de-identified manner (hashing), making it impossible to restore them. Anonymized records are automatically deleted 90 days after collection, and the operator can only view anonymized records through the management console.

Article 10 (Inquiries)

Privacy-related inquiries: Please contact the controller at the top of this policy.

Cross-border Transfer

For the operation of our service, we transfer personal information to third parties outside the country.

• Recipient: Cloudflare, Inc. ([email protected])
• Country of Transfer: United States (worldwide distributed edge PoPs)
• Timing and Method: Automatic transfer via network transmission at every moment a user accesses the service (Cloudflare CDN and security edge relayed)
• Items Transferred: IP address, User-Agent, requested URL, time of access, service authentication/session cookies
• Purpose of Transfer: Content delivery network (CDN), DDoS/bot blocking, traffic security
• Storage and Usage Period: According to Cloudflare's operational policies (short-term retention of security logs)
• Refusal Method and Effect: Due to the nature of our service, refusal may result in the inability to use the service.

Automated Collection Tools

We use the following automated collection tools for service usage statistics.

• Tool: Cloudflare Web Analytics
• Operator: Cloudflare, Inc. (USA)
• Items Collected: Page URL, Referring Page (referrer), Browser/OS Type, Device Type, Access Country (IP extracted and immediately discarded), Page Load Time
• Method of Collection: Automatic beacon transmission by the browser upon page load
• Purpose of Collection: Aggregation of anonymous access statistics
• Use of Cookies: Not used
• How to Opt Out: Block `static.cloudflareinsights.com` in your browser or use an ad/tracking blocker

Article 1 (Personal Information Collected)

• Account Identifier: The email address transmitted by Authentik(OIDC) during login. Used for user identification and distinguishing data ownership.
• Display Information: The display name and profile picture URL provided by the OIDC provider (e.g., Google). Used to indicate commenters, co-workers, and schedule creators in shared events.
• Usage Data: The created calendar sets, selected performances, calendar subscription tokens, notification settings, and comments made by the user.
• Push Subscription Information: If web push notifications are enabled, the browser-provided push endpoint and keys (p256dh, auth). Used exclusively for sending notifications.

Article 2 (Purpose of Use)

This service is used for providing calendar planning, subscription, and sharing functions, as well as displaying comments. It is also used to send notifications about the start of performances, sharing events, and new festival announcements.

Article 3 (Information Displayed to Other Users)

When leaving a comment on a shared schedule, the display name, profile picture, and body of the comment along with the time it was written are shown to other users viewing the same schedule. The full email address is not displayed.

Article 4 (Third-Party Provision)

We do not sell or provide the information we collect to third parties. Profile pictures are loaded directly from the original URL provided by the OIDC provider's browser, and web push notifications use the browser manufacturer's push service.

Article 5 (Retention and Disposal)

Data is stored on our self-hosted PostgreSQL server. When you request to withdraw your membership, your personal data is retained for 30 days, during which you can cancel the withdrawal (restore your account) by logging in again. After 30 days, identifying information such as your email and name is de-identified so that it cannot be restored, and the schedules you own together with the comments and votes you have made and your calendar-subscription token are deleted (equivalent to disposal). Events, comments, and notification settings can be deleted directly before withdrawal, and push subscriptions can be disabled from the settings menu.

Article 6 (Calendar Subscription Address)

The ICS subscription address is a publicly accessible URL that is authenticated using a secret token. Anyone who knows the address can view the schedule, so do not expose it to the outside.

Article 7 (Operator Access)

The operator (administrator) has the authority to view, modify, and delete member data through the management tool (back-office console) for the purpose of service operation.

Article 8 (Rights of Data Subjects)

The rights to request access, rectification, deletion, and suspension of processing may be exercised by contacting the controller at the designated contact point.

Article 9 (Processing of AI Function and Input Information)

When using the AI features of this service (such as schedule recommendations, playlist retrieval, etc.), the information you provide is collected and analyzed for the purposes of improving service quality and preventing spam and abuse. Before storage, any personally identifiable information (such as email addresses or phone numbers) will be automatically masked. User identifiers and connection information are processed in a de-identified manner (hashing), making it impossible to restore them. Anonymized records are automatically deleted 90 days after collection, and the operator can only view anonymized records through the management console.

Article 10 (Inquiries)

Privacy-related inquiries: Please contact the controller at the top of this policy.

Cross-border Transfer

For the operation of our service, we transfer personal information to third parties outside the country.

• Recipient: Cloudflare, Inc. ([email protected])
• Country of Transfer: United States (worldwide distributed edge PoPs)
• Timing and Method: Automatic transfer via network transmission at every moment a user accesses the service (Cloudflare CDN and security edge relayed)
• Items Transferred: IP address, User-Agent, requested URL, time of access, service authentication/session cookies
• Purpose of Transfer: Content delivery network (CDN), DDoS/bot blocking, traffic security
• Storage and Usage Period: According to Cloudflare's operational policies (short-term retention of security logs)
• Refusal Method and Effect: Due to the nature of our service, refusal may result in the inability to use the service.

Automated Collection Tools

We use the following automated collection tools for service usage statistics.

• Tool: Cloudflare Web Analytics
• Operator: Cloudflare, Inc. (USA)
• Items Collected: Page URL, Referring Page (referrer), Browser/OS Type, Device Type, Access Country (IP extracted and immediately discarded), Page Load Time
• Method of Collection: Automatic beacon transmission by the browser upon page load
• Purpose of Collection: Aggregation of anonymous access statistics
• Use of Cookies: Not used
• How to Opt Out: Block `static.cloudflareinsights.com` in your browser or use an ad/tracking blocker

Article 1 (Purpose)

This agreement sets forth the terms and procedures for the use of the etamong short URL service (hereinafter referred to as "the Service").

Article 2 (Service Provision and Availability)

The service is provided on a self-hosted basis as-is, without any warranty of continuous operation or a specific level of availability. The provider may make changes or discontinue the service at any time without prior notice, depending on the infrastructure situation.

Article 3 (Prohibited Acts)

Shortening of illegal content, phishing, distribution of malicious code, spam, and links targeting individuals whose rights are infringed is prohibited. The operator may periodically inspect registered links using automated means (including LLM-based checks), and may block, delete, or restrict use of links deemed abusive without prior notice.

Article 4 (Retention of Anonymous Links)

Links created without login are automatically deleted three days after their creation time. To permanently retain a link, you must log in and use it.

Limitation of Liability

The Operator shall not be liable for any direct or indirect damages arising from the content and services provided on the shortened target (destination) page.

Article 6 (Collection of Statistics)

The operator may collect anonymous aggregated statistics (such as the country of access, operating system and browser type, number of clicks, etc.) for the purpose of improving the service. The detailed terms are governed by the Privacy Policy.

Article 7 (Applicable Law and Inquiries)

This agreement shall be governed by the laws of the Republic of Korea. For inquiries, please contact [email protected].

Article 1 (Purpose)

This agreement sets forth the terms and procedures for the use of the etamong short URL service (hereinafter referred to as "the Service").

Article 2 (Service Provision and Availability)

The service is provided on a self-hosted basis, 'as-is,' without any warranty of uninterrupted operation or specific levels of availability. The provider reserves the right to change or terminate the service at any time, without prior notice, depending on the infrastructure situation.

Article 3 (Prohibited Acts)

Shortening of illegal content, phishing, distribution of malicious code, spam, and links targeting individuals whose rights are infringed is prohibited. Links deemed to be in violation may be deleted or access restricted without prior notice.

Article 4 (Retention of Anonymous Links)

Links created without login are automatically deleted three days after their creation time. To permanently retain a link, you must log in and use it.

Limitation of Liability

The Operator shall not be liable for any direct or indirect damages arising from the content and services provided on the shortened target (destination) page.

Article 6 (Collection of Statistics)

The operator may collect anonymous aggregated statistics (such as the country of access, operating system and browser type, number of clicks, etc.) for the purpose of improving the service. The detailed terms are governed by the Privacy Policy.

Article 7 (Applicable Law and Inquiry)

This agreement shall be governed by the laws of the Republic of Korea. For inquiries, please contact [email protected].

Article 1 (Purpose)

This agreement sets forth the terms and procedures for the use of the etamong short URL service (hereinafter referred to as "the Service").

Article 2 (Service Provision and Availability)

The service is provided on a self-hosted basis as-is, without any warranty of continuous operation or a specific level of availability. The provider may make changes or discontinue the service at any time without prior notice, depending on the infrastructure situation.

Article 3 (Prohibited Acts)

Shortening of illegal content, phishing, distribution of malicious code, spam, and links targeting individuals whose rights are infringed is prohibited. The operator may periodically inspect registered links using automated means (including LLM-based checks), and may block, delete, or restrict use of links deemed abusive without prior notice.

Article 4 (Retention of Anonymous Links)

Links created without login are automatically deleted three days after their creation time. To permanently retain a link, you must log in and use it.

Limitation of Liability

The Operator shall not be liable for any direct or indirect damages arising from the content and services provided on the shortened target (destination) page.

Article 6 (Collection of Statistics)

The operator may collect anonymous aggregated statistics (such as the country of access, operating system and browser type, number of clicks, etc.) for the purpose of improving the service. The detailed terms are governed by the Privacy Policy.

Article 7 (Applicable Law and Inquiries)

This agreement shall be governed by the laws of the Republic of Korea. For inquiries, please contact [email protected].

Article 1 (Personal Information Collected)

• Anonymous Users: The URL to be shortened, optional notes, creation and modification timestamps, and click count. No additional personal identifying information is collected.
• Logged-in Users: Email address provided by the authentication provider (Authentik, Google integration) for link owner identification purposes.
• For service improvement, aggregate statistics on clicks are collected (approximate country of access, operating system/browser type, and click count). Individual click logs, precise locations, and IP addresses are not stored; they are only kept in an anonymous aggregate form.

Article 2 (Purpose of Use)

• Creation, redirection, and management of shortened links
• Verification of link ownership
• Prevention of service abuse

Article 3 (Retention and Disposal)

Anonymous links and related data will be automatically disposed of 3 days after their creation. Links used by logged-in users will be retained until the user deletes them manually.

Article 4 (Third-Party Provision and Processing Entrustment)

The service does not provide the collected information to third parties, except as required by law. The service is self-hosted and does not engage in external processing entrustments. Authentication is handled through Authentik, which we operate ourselves.

Article 5 (Operator Access)

To ensure the operation and prevention of abuse, operators (administrators) are permitted to view, modify, and delete link data created by users through the management tool (back-office console). Access is limited to operational purposes only.

Article 6 (Rights of Data Subjects)

Users of the login service have the right to view, modify, and delete any links they create at any time. They can also request protection against the disclosure, correction, deletion, or suspension of personal information through the contact details of the data controller.

Article 7 (Measures to Ensure Security)

We implement measures such as access permission control, encryption of transmission sections using HTTPS, and the preservation of access records.

Article 8 (Data Protection Officer)

The contact details of the Data Protection Officer are the same as those provided at the top of this policy.

Article 9 (Notice Obligation)

We will notify you of any changes to this policy seven days in advance (or thirty days in advance for significant or material changes).

Article 1 (Personal Information Items Collected)

• Anonymous Users: The URL to be shortened, optional notes, creation and modification timestamps, and click count. No additional personal identifiable information is collected.
• Logged-in Users: Email address provided by the authentication provider (Authentik or Google integration) for identifying the link owner.
• For service improvement, aggregate statistics on clicks are collected (approximate country of access, operating system/browser type, and click count). Individual click logs, precise location data, and IP addresses are not stored; they are only kept in an anonymous aggregate form.

Article 2 (Purpose of Use)

• Creation, redirection, and management of shortened links
• Verification of link ownership
• Prevention of service misuse

Article 3 (Retention and Erasure)

Anonymous links and related data will be automatically erased 3 days after their creation. Links used by logged-in users will be retained until the user deletes them manually.

Article 4 (Third-Party Provision and Processing Entrustment)

The service does not provide the collected information to third parties, except as required by law. The service is self-hosted and does not engage in external processing entrustments. Authentication is handled through the self-operated Authentik.

Article 5 (Operator Access)

To ensure the operation and prevention of abuse, operators (administrators) are permitted to view, modify, and delete link data created by users through the management tool (back-office console). Access is limited to operational purposes only.

Article 6 (Rights of Data Subjects)

The user of the login service has the right to view, modify, and delete any links they have created at any time. They can also request protection against the disclosure, correction, deletion, or suspension of their personal information through the contact details of the data controller.

Article 7 (Measures to Ensure Security)

• Implements measures such as access permission control, encryption during transmission (HTTPS), and retention of access logs.

Article 8 (Data Protection Officer)

The contact details of the Data Protection Officer are the same as those provided at the top of this policy.

Article 9 (Obligation to Notify)

The policy will be implemented seven days before any changes are made (or thirty days for significant changes).

Cross-border Transfer

For the operation of our service, we transfer personal information to third parties as follows:

• Recipient: Cloudflare, Inc. ([email protected])
• Country of Transfer: United States (global distributed edge PoPs)
• Timing and Method: Automatic transfer via network transmission at every moment a user accesses the service (Cloudflare CDN and security edge relayed)
• Items Transferred: IP address, User-Agent, requested URL, time of access, service authentication/session cookies
• Purpose of Transfer: Content delivery network (CDN), DDoS/bot blocking, traffic security
• Storage and Usage Period: According to Cloudflare's operational policies (short-term retention of security logs)
• Refusal Method and Effect: Due to the nature of our service, refusal may result in the inability to use the service.

Automatic Collection Tools

For the purpose of collecting service usage statistics, we utilize the following automatic collection tools:

• Tool: Cloudflare Web Analytics
• Operator: Cloudflare, Inc. (United States)
• Items Collected: Page URL, Referring Page (referrer), Browser/OS Type, Device Type, Access Country (IP extracted and immediately discarded), Page Load Time
• Method of Collection: Automatic beacon transmission by the browser upon page load
• Purpose of Collection: Aggregation of anonymous access statistics
• Cookie Usage: Not used
• How to Opt Out: Block `static.cloudflareinsights.com` in your browser or use an ad/tracking blocker

Article 1 (Personal Information Items Collected)

• Anonymous Users: The URL to be shortened, optional notes, creation and modification timestamps, and click count. No additional personal identifiable information is collected.
• Logged-in Users: Email address provided by the authentication provider (Authentik or Google integration) for identifying the link owner.
• For service improvement, aggregate statistics on clicks are collected (approximate country of access, operating system/browser type, and click count). Individual click logs, precise location data, and IP addresses are not stored; they are only kept in an anonymous aggregate form.

Article 2 (Purpose of Use)

• Creation, redirection, and management of shortened links
• Verification of link ownership
• Prevention of service misuse

Article 3 (Retention and Erasure)

Anonymous links and related data will be automatically erased 3 days after their creation. Links used by logged-in users will be retained until the user deletes them manually.

Article 4 (Third-Party Provision and Processing Entrustment)

The service does not provide the collected information to third parties, except as required by law. The service is self-hosted and does not engage in external processing entrustments. Authentication is handled through the self-operated Authentik.

Article 5 (Operator Access)

To ensure the operation and prevention of abuse, operators (administrators) are permitted to view, modify, and delete link data created by users through the management tool (back-office console). Access is limited to operational purposes only.

Article 6 (Rights of Data Subjects)

The user of the login service has the right to view, modify, and delete any links they have created at any time. They can also request protection against the disclosure, correction, deletion, or suspension of their personal information through the contact details of the data controller.

Article 7 (Measures to Ensure Security)

• Implements measures such as access permission control, encryption during transmission (HTTPS), and retention of access logs.

Article 8 (Data Protection Officer)

The contact details of the Data Protection Officer are the same as those provided at the top of this policy.

Article 9 (Obligation to Notify)

The policy will be implemented seven days before any changes are made (or thirty days for significant changes).

Cross-border Transfer

For the operation of our service, we transfer personal information to third parties as follows:

• Recipient: Cloudflare, Inc. ([email protected])
• Country of Transfer: United States (global distributed edge PoPs)
• Timing and Method: Automatic transfer via network transmission at every moment a user accesses the service (Cloudflare CDN and security edge relayed)
• Items Transferred: IP address, User-Agent, requested URL, time of access, service authentication/session cookies
• Purpose of Transfer: Content delivery network (CDN), DDoS/bot blocking, traffic security
• Storage and Usage Period: According to Cloudflare's operational policies (short-term retention of security logs)
• Refusal Method and Effect: Due to the nature of our service, refusal may result in the inability to use the service.

Automatic Collection Tools

For the purpose of collecting service usage statistics, we utilize the following automatic collection tools:

• Tool: Cloudflare Web Analytics
• Operator: Cloudflare, Inc. (United States)
• Items Collected: Page URL, Referring Page (referrer), Browser/OS Type, Device Type, Access Country (IP extracted and immediately discarded), Page Load Time
• Method of Collection: Automatic beacon transmission by the browser upon page load
• Purpose of Collection: Aggregation of anonymous access statistics
• Cookie Usage: Not used
• How to Opt Out: Block `static.cloudflareinsights.com` in your browser or use an ad/tracking blocker

Purpose

These terms set out the conditions and procedures for using stockbook (the "Service") and the rights and obligations between the operator and users.

Service Content

The Service provides the following features.

• Registering and managing personal belongings and assets
• Uploading receipt photos and automatic field extraction
• Organizing and sharing assets by space (vault)
• Notifications such as warranty expiry
• Managing a planned-purchase list

Registration

Registration is performed by logging in via single sign-on (OIDC/SSO).

Use of the Service

The Service is provided free of charge. The operator strives to provide a stable service, but the Service may be interrupted without notice. The Service is provided as-is.

Prohibited Acts

Users must not upload illegal content, material that infringes the rights of others, malicious code, or similar. The operator may restrict use of, or delete, data deemed abusive without prior notice.

Withdrawal and Deletion

You may request to withdraw from the Service. If you log in again within 30 days of the request, you may cancel the withdrawal. After 30 days, your account and personally identifying information are de-identified so that they cannot be restored, and uploaded receipt and item photo images are deleted from object storage.

When you delete a space (vault), all data in that space (items, receipts, invites, notifications) and its images are permanently deleted and cannot be recovered.

Limitation of Liability

The Service is provided as-is, without warranty of fitness for a particular purpose. The operator is not liable for service interruptions or data loss caused by force majeure such as natural disasters or system failures.

Intellectual Property

The copyright and intellectual property rights in the Service belong to the operator. Ownership of data entered or uploaded by a user belongs to that user.

Changes to the Terms

Changes to these terms are announced within the Service. Material changes are announced at least 7 days before the effective date.

Governing Law

The interpretation of these terms and the resolution of disputes are governed by the laws of the Republic of Korea. Contact: [email protected]

Effective Date

These Terms take effect on June 29, 2026.

Purpose

These terms set out the conditions and procedures for using stockbook (the "Service") and the rights and obligations between the operator and users.

Service Content

The Service provides the following features.

• Registering and managing personal belongings and assets
• Uploading receipt photos and automatic field extraction
• Organizing and sharing assets by space (vault)
• Notifications such as warranty expiry
• Managing a planned-purchase list

Registration

Registration is performed by logging in via single sign-on (OIDC/SSO).

Use of the Service

The Service is provided free of charge. The operator strives to provide a stable service, but the Service may be interrupted without notice. The Service is provided as-is.

Prohibited Acts

Users must not upload illegal content, material that infringes the rights of others, malicious code, or similar. The operator may restrict use of, or delete, data deemed abusive without prior notice.

Withdrawal and Deletion

You may request to withdraw from the Service. If you log in again within 30 days of the request, you may cancel the withdrawal. After 30 days, your account and personally identifying information are de-identified so that they cannot be restored, and uploaded receipt and item photo images are deleted from object storage.

When you delete a space (vault), all data in that space (items, receipts, invites, notifications) and its images are permanently deleted and cannot be recovered.

Limitation of Liability

The Service is provided as-is, without warranty of fitness for a particular purpose. The operator is not liable for service interruptions or data loss caused by force majeure such as natural disasters or system failures.

Intellectual Property

The copyright and intellectual property rights in the Service belong to the operator. Ownership of data entered or uploaded by a user belongs to that user.

Changes to the Terms

Changes to these terms are announced within the Service. Material changes are announced at least 7 days before the effective date.

Governing Law

The interpretation of these terms and the resolution of disputes are governed by the laws of the Republic of Korea. Contact: [email protected]

Effective Date

These Terms take effect on June 29, 2026.

Purpose of Processing Personal Information

stockbook (the "Service") processes personal information for the following purposes.

• Account registration and management: identity verification and eligibility checks via single sign-on (OIDC/SSO)
• Service provision: registering and managing personal belongings and assets, uploading receipt photos and automatic field extraction, sharing spaces (vaults), warranty-expiry notifications, and managing a planned-purchase list
• Notifications: sending Web Push notifications such as warranty-expiry alerts

Personal Information Collected

The following information is collected through single sign-on (OIDC) integration.

• Email address
• Name (display name)
• Profile picture URL
• Authentication identifier (sub) and username

The following information is generated and stored during service use.

• Space (vault) information, members, and roles
• Registered item details (name, category, purchase/delivery date, price, brand/model/serial number, warranty expiry date, storage location, tags, notes, item photo)
• Uploaded receipt images and automatically extracted item details (vendor, date, amount, line items, etc.)
• Planned-purchase list
• Invitee email addresses entered when inviting someone to a space
• Web Push subscription details (push service endpoint and encryption keys)

Receipt and item photo images are stored in object storage operated directly by the operator. Uploaded receipt images are analyzed by an AI model operated directly by the operator for automatic field extraction, and are not transmitted to any external cloud AI service.

Retention and Use Period

When you request to withdraw from the Service, your personal information is retained for 30 days. During this period you may log in again to cancel (recover) the withdrawal. The retention is limited to enabling withdrawal cancellation and is not used for any other purpose.

After 30 days, personally identifying information such as email, name, and profile is de-identified (anonymized) so that it cannot be restored, which is treated as equivalent to destruction. At this point, uploaded receipt and item photo images are deleted from object storage.

When a space (vault) is deleted, all data in that space (items, receipts, invites, notifications) and the associated images are permanently deleted.

Provision to Third Parties

The Service does not provide users' personal information to third parties.

Consignment of Processing

The Service's data storage, authentication, and receipt-image analysis are handled on self-hosted infrastructure managed directly by the operator and are not consigned to any external company.

However, to deliver Web Push notifications, an encrypted notification message is transmitted to the push delivery service operated by the manufacturer of the browser you use. The notification body is encrypted with a key on your device before transmission.

Rights of the Data Subject

You may exercise the following rights at any time.

• Request to access your personal information
• Request to correct or delete your personal information
• Request to suspend processing of your personal information
• Leave or delete a space (vault)
• Withdraw from the Service

Destruction Procedure

A 30-day grace period applies after a withdrawal request. During this period, the retention is limited to enabling withdrawal cancellation and the information is not used for any other purpose.

After 30 days, personally identifying information such as email, name, and profile is de-identified (anonymized) so that it cannot be restored. This is treated as equivalent to destruction; uploaded receipt and item photo images are deleted from object storage, and related active data (space members, notifications, push subscriptions, etc.) is deleted.

When a space (vault) is deleted, all data associated with that space (items, receipts, invites, notifications) and its images are deleted immediately.

Personal Information Protection Officer

For inquiries regarding the processing of personal information, please contact the following.

• Data controller: etamong
• Contact: [email protected]

Overseas Transfer

For service operation, personal information is transferred overseas as follows.

• Recipient: Cloudflare, Inc. ([email protected])
• Destination country: United States (globally distributed edge PoPs)
• Time and method of transfer: automatic transfer via network transmission every time a user accesses the Service (through the Cloudflare CDN and security edge)
• Items transferred: IP address, User-Agent, request URL, access time, service authentication/session cookies
• Purpose of transfer: content delivery network (CDN), DDoS/bot mitigation, traffic security
• Retention and use period: per Cloudflare's operating policy (short-term retention of security logs)
• How to refuse and effect: due to the nature of the Service, refusal makes the Service unusable.

Automatic Collection Tools

The Service uses the following automatic collection tool for usage statistics.

• Tool: Cloudflare Web Analytics
• Operator: Cloudflare, Inc. (United States)
• Items collected: page URL, referrer, browser/OS type, device type, country of access (extracted from IP, after which the IP is immediately discarded), page load time
• Collection method: the browser automatically sends a beacon on page load
• Collection purpose: aggregation of anonymous access statistics
• Cookie use: none
• How to refuse: block static.cloudflareinsights.com in the browser, or use an ad/tracking blocker

Effective Date

This Privacy Policy takes effect on June 29, 2026.

Purpose of Processing Personal Information

stockbook (the "Service") processes personal information for the following purposes.

• Account registration and management: identity verification and eligibility checks via single sign-on (OIDC/SSO)
• Service provision: registering and managing personal belongings and assets, uploading receipt photos and automatic field extraction, sharing spaces (vaults), warranty-expiry notifications, and managing a planned-purchase list
• Notifications: sending Web Push notifications such as warranty-expiry alerts

Personal Information Collected

The following information is collected through single sign-on (OIDC) integration.

• Email address
• Name (display name)
• Profile picture URL
• Authentication identifier (sub) and username

The following information is generated and stored during service use.

• Space (vault) information, members, and roles
• Registered item details (name, category, purchase/delivery date, price, brand/model/serial number, warranty expiry date, storage location, tags, notes, item photo)
• Uploaded receipt images and automatically extracted item details (vendor, date, amount, line items, etc.)
• Planned-purchase list
• Invitee email addresses entered when inviting someone to a space
• Web Push subscription details (push service endpoint and encryption keys)

Receipt and item photo images are stored in object storage operated directly by the operator. Uploaded receipt images are analyzed by an AI model operated directly by the operator for automatic field extraction, and are not transmitted to any external cloud AI service.

Retention and Use Period

When you request to withdraw from the Service, your personal information is retained for 30 days. During this period you may log in again to cancel (recover) the withdrawal. The retention is limited to enabling withdrawal cancellation and is not used for any other purpose.

After 30 days, personally identifying information such as email, name, and profile is de-identified (anonymized) so that it cannot be restored, which is treated as equivalent to destruction. At this point, uploaded receipt and item photo images are deleted from object storage.

When a space (vault) is deleted, all data in that space (items, receipts, invites, notifications) and the associated images are permanently deleted.

Provision to Third Parties

The Service does not provide users' personal information to third parties.

Consignment of Processing

The Service's data storage, authentication, and receipt-image analysis are handled on self-hosted infrastructure managed directly by the operator and are not consigned to any external company.

However, to deliver Web Push notifications, an encrypted notification message is transmitted to the push delivery service operated by the manufacturer of the browser you use. The notification body is encrypted with a key on your device before transmission.

Rights of the Data Subject

You may exercise the following rights at any time.

• Request to access your personal information
• Request to correct or delete your personal information
• Request to suspend processing of your personal information
• Leave or delete a space (vault)
• Withdraw from the Service

Destruction Procedure

A 30-day grace period applies after a withdrawal request. During this period, the retention is limited to enabling withdrawal cancellation and the information is not used for any other purpose.

After 30 days, personally identifying information such as email, name, and profile is de-identified (anonymized) so that it cannot be restored. This is treated as equivalent to destruction; uploaded receipt and item photo images are deleted from object storage, and related active data (space members, notifications, push subscriptions, etc.) is deleted.

When a space (vault) is deleted, all data associated with that space (items, receipts, invites, notifications) and its images are deleted immediately.

Personal Information Protection Officer

For inquiries regarding the processing of personal information, please contact the following.

• Data controller: etamong
• Contact: [email protected]

Overseas Transfer

For service operation, personal information is transferred overseas as follows.

• Recipient: Cloudflare, Inc. ([email protected])
• Destination country: United States (globally distributed edge PoPs)
• Time and method of transfer: automatic transfer via network transmission every time a user accesses the Service (through the Cloudflare CDN and security edge)
• Items transferred: IP address, User-Agent, request URL, access time, service authentication/session cookies
• Purpose of transfer: content delivery network (CDN), DDoS/bot mitigation, traffic security
• Retention and use period: per Cloudflare's operating policy (short-term retention of security logs)
• How to refuse and effect: due to the nature of the Service, refusal makes the Service unusable.

Automatic Collection Tools

The Service uses the following automatic collection tool for usage statistics.

• Tool: Cloudflare Web Analytics
• Operator: Cloudflare, Inc. (United States)
• Items collected: page URL, referrer, browser/OS type, device type, country of access (extracted from IP, after which the IP is immediately discarded), page load time
• Collection method: the browser automatically sends a beacon on page load
• Collection purpose: aggregation of anonymous access statistics
• Cookie use: none
• How to refuse: block static.cloudflareinsights.com in the browser, or use an ad/tracking blocker

Effective Date

This Privacy Policy takes effect on June 29, 2026.

Purpose of Processing Personal Information

stockbook (the "Service") processes personal information for the following purposes.

• Account registration and management: identity verification and eligibility checks via single sign-on (OIDC/SSO)
• Service provision: registering and managing personal belongings and assets, uploading receipt photos and automatic field extraction, sharing spaces (vaults), warranty-expiry notifications, and managing a planned-purchase list
• Payment-history management: importing transactions from files selected by the user, preventing duplicates, and organizing them as a ledger
• Personalized monthly spending analysis: explaining card performance targets, payment-method choices, allocation of spending the user already plans for the year, and estimated year-end income deductions
• Notifications: sending Web Push notifications such as warranty-expiry alerts

Personal Information Collected

The following information is collected through single sign-on (OIDC) integration.

• Email address
• Name (display name)
• Profile picture URL
• Authentication identifier (sub) and username

The following information is generated and stored during service use.

• Space (vault) information, members, and roles
• Registered item details (name, category, purchase/delivery date, price, brand/model/serial number, warranty expiry date, storage location, tags, notes, item photo)
• Uploaded receipt images and automatically extracted item details (vendor, date, amount, line items, etc.)
• Payment-ledger information imported by the user (transaction time, merchant, amount, currency, payment-account or card label, category, memo, and transaction, cancellation, or refund type)
• Payment instruments, account-matching rules, payment channels, tax categories, card-benefit rules, performance targets, fallback methods, and budgets configured by the user
• Year-end tax-analysis inputs (tax year, estimated gross salary, optional marginal tax rate, planned remaining spend, completeness of household inputs that affect caps, and annual aggregates outside the ledger)
• Monthly spending-analysis results (versions of inputs and rules used, finding state, evidence transaction references, confidence, and calculation explanation)
• Planned-purchase list
• Invitee email addresses entered when inviting someone to a space
• Web Push subscription details (push service endpoint and encryption keys)

Receipt and item photo images are stored in object storage operated directly by the operator. Uploaded receipt images are analyzed by an AI model operated directly by the operator for automatic field extraction and are not transmitted to an external cloud AI service. External cloud AI services are not used for payment history or personalized financial analysis.

Retention and Use Period

When you request to withdraw from the Service, your personal information is retained for 30 days. During this period you may log in again to cancel the withdrawal. Retention is limited to enabling withdrawal cancellation and the information is not used for another purpose.

While you use the Service, payment ledgers, payment-instrument settings, tax inputs, and monthly spending-analysis results are retained with the personal space (vault) so that results can be reproduced and changes can be inspected. When inputs change, a new result becomes current, but prior completed results remain until the personal space is deleted or withdrawal is completed.

After 30 days, personally identifying information such as email, name, and profile is de-identified so that it cannot be restored. Private tax inputs and annual aggregates outside the ledger are deleted. Payment ledgers, payment-instrument settings, monthly spending analyses, and uploaded images linked to the personal space are deleted with it. Copies remaining in database backups are used only for recovery and expire automatically within 30 days.

When a space (vault) is deleted, all data in that space and its associated images are permanently deleted.

Provision to Third Parties

The Service does not provide users' personal information to third parties.

Consignment of Processing

The Service's data storage, authentication, and receipt-image analysis are handled on self-hosted infrastructure managed directly by the operator and are not consigned to any external company.

However, to deliver Web Push notifications, an encrypted notification message is transmitted to the push delivery service operated by the manufacturer of the browser you use. The notification body is encrypted with a key on your device before transmission.

Rights of the Data Subject

You may exercise the following rights at any time.

• Request to access your personal information
• Request to correct or delete your personal information
• Request to suspend processing of your personal information
• Leave or delete a space (vault)
• Withdraw from the Service

Destruction Procedure

A 30-day grace period applies after a withdrawal request. During this period, retention is limited to enabling withdrawal cancellation and the information is not used for another purpose.

After 30 days, personally identifying information such as email, name, and profile is de-identified so that it cannot be restored. Private tax inputs and annual aggregates outside the ledger are deleted. Payment ledgers, payment-instrument settings, monthly spending analyses, space memberships, notifications, push subscriptions, and uploaded images linked to the personal space are deleted. Actor identifiers are removed from shared records that must remain. Copies in operational database backups expire automatically within 30 days.

When a space (vault) is deleted, all data associated with that space and its images are deleted immediately.

Personal Information Protection Officer

For inquiries regarding the processing of personal information, please contact the following.

• Data controller: etamong
• Contact: [email protected]

Overseas Transfer

For service operation, personal information is transferred overseas as follows.

• Recipient: Cloudflare, Inc. ([email protected])
• Destination country: United States (globally distributed edge PoPs)
• Time and method of transfer: automatic transfer via network transmission every time a user accesses the Service (through the Cloudflare CDN and security edge)
• Items transferred: IP address, User-Agent, request URL, access time, service authentication/session cookies
• Purpose of transfer: content delivery network (CDN), DDoS/bot mitigation, traffic security
• Retention and use period: per Cloudflare's operating policy (short-term retention of security logs)
• How to refuse and effect: due to the nature of the Service, refusal makes the Service unusable.

Automatic Collection Tools

The Service uses the following automatic collection tool for usage statistics.

• Tool: Cloudflare Web Analytics
• Operator: Cloudflare, Inc. (United States)
• Items collected: page URL, referrer, browser/OS type, device type, country of access (extracted from IP, after which the IP is immediately discarded), page load time
• Collection method: the browser automatically sends a beacon on page load
• Collection purpose: aggregation of anonymous access statistics
• Cookie use: none
• How to refuse: block static.cloudflareinsights.com in the browser, or use an ad/tracking blocker

Effective Date

This Privacy Policy takes effect on October 1, 2026.