Pausio Privacy Policy
Effective: April 18, 2026
Pozio ("Company") values user privacy and strives to comply with the Korean Personal Information Protection Act (PIPA), the Act on Promotion of Information and Communications Network Utilization and Information Protection, and other applicable laws. This policy describes how personal information is collected, used, stored, and destroyed when using the Pausio service ("Service").
Article 1 (Information Collected)
1. Registration & Service Use
Required: Email, password (hashed), display name (optional)
Google OAuth: Google email, profile name & photo (public profile scope)
2. Calendar Integration
- Google Calendar API access/refresh tokens (encrypted)
- Connected Google account email
Calendar event details (titles, descriptions, attendees, locations) are analyzed only on-device and are never transmitted to or stored on Company servers.
3. Automatically Collected
- Device info (OS, app version, model)
- IP address, access time, URL
- Usage records (session type, time, duration — anonymous aggregates)
- Cookies and session identifiers
4. Payment
- Payment info is collected directly by Apple, Google, or Stripe — the Company does not collect or store credit card numbers
- Amount, date, subscription status
5. Customer Inquiries
- Name/nickname, email, inquiry content
Article 2 (Purpose of Use)
- Service delivery: sound playback, calendar-based recommendations, session tracking
- Account management: identity verification, fraud prevention
- Payment management: billing, refunds, subscription status
- Service improvement: analytics, feature development
- Customer support: inquiries, notices
- Legal compliance: record retention as required by law
Article 3 (Retention Periods)
| Category | Period | Basis |
|---|
| Account info | Until withdrawal | User consent |
| Session records (anonymous) | 2 years | Service improvement |
| Payment records | 5 years | E-Commerce Act |
| Dispute records | 3 years | E-Commerce Act |
| Login/access logs | 3 months | Telecommunications Privacy Act |
Article 3A (Health Data Processing — Find My Mood)
- With user consent, the Company processes heart rate, heart rate variability (HRV / SDNN / RMSSD), and resting heart rate from Apple HealthKit on the user's device only.
- Analysis of SDNN / RMSSD is for wellness purposes and is not intended for medical diagnosis, treatment, or prevention. The algorithm is built on published HRV research (Plews et al. 2017; Shaffer & Ginsberg 2017) with reference to Open Wearables patterns (MIT-licensed).
- Raw health data is never transmitted to our servers and is not shared with any third party.
- Only anonymized metadata (stress bucket, recommended action) may be collected for service improvement. Users can stop this collection at any time via Privacy & Data → Stop data collection in the app.
- Users can immediately erase all on-device measurement records via Privacy & Data → Delete pulse history in the app.
Article 4 (Third-Party Disclosure)
Personal information is not shared with third parties except: with prior consent, when required by law, or when provided in de-identified form for statistics/research.
Article 5 (Processing Delegation)
| Delegate | Task | Location |
|---|
| Supabase, Inc. | Authentication, database | USA |
| Amazon Web Services | Content storage (S3) | USA |
| Google LLC | OAuth, Calendar API | USA |
| Stripe, Inc. (planned) | Payment processing | USA |
| Apple Inc. | App Store payments | USA |
| Mureka | AI music composition (only Company-designed prompts are sent; no personal data, listening history, or HRV data is shared) | USA |
Article 6 (Overseas Transfer)
Personal information is transferred to the United States for service provision (to Supabase, AWS, Google, Stripe). Users may refuse overseas transfer, but this may limit service availability.
Article 7 (User Rights)
- Request access to personal information
- Request correction or deletion
- Request processing suspension
- Request account deletion
Requests can be made via in-app settings or hwayoung.0904@gmail.com.
Article 8 (Cookies & Analytics)
Cookies are used for session management and analytics. Users may disable cookies via browser settings. Google Analytics (anonymous aggregation) may be used for service improvement.
Article 9 (Security Measures)
- Administrative: Minimized access, regular training
- Technical: bcrypt password hashing, encrypted token storage (OS keychain), SSL/TLS, access controls
- Physical: Data center access controls (AWS/Supabase international security standards)
Article 10 (Privacy Officer)
- Name: Hwayoung Kim
- Title: Privacy Officer
- Contact: hwayoung.0904@gmail.com
Article 11 (Remedies)
- Personal Information Dispute Mediation Committee: 1833-6972
- KISA Privacy Center: 118
- Supreme Prosecutors' Office Cyber Investigation: 1301
- National Police Agency Cyber Bureau: 182
Article 12 (Policy Changes)
Changes will be announced at least 7 days (30 days for significant changes) before taking effect.
Addendum: This policy is effective from April 18, 2026.
Company Information
- Company: Pozio
- Representative: Taeheon Kim
- Business Registration: 689-03-03631
- Address: 80 Jeongja-illo, Bundang-gu, Seongnam-si, Gyeonggi-do, Korea
- Email: hwayoung.0904@gmail.com
← Back to pausio