Privacy Policy

1. Why we process information

The Operator processes personal information only for these purposes. If a purpose changes, we'll take the steps the law requires, such as getting separate consent. - Posting and managing drops: letting you drop links and edit or delete them with an owner key - Likes, comments, and posts: preventing duplicate likes and letting only authors delete or edit - Abuse prevention: posting limits, bot checks, and blocking spam and duplicate submissions - Email (optional): sending owner links and the weekly digest (neither feature is live yet) - Handling and replying to removal and rights requests

2. Information we process

- IP address: we don't store the address itself, only an HMAC hash made with a server secret. It's used for limits and to prevent duplicates and abuse. Logs kept by justdrop don't contain raw IP addresses either. - Anonymous token: a random value placed in a cookie when you like something or write a comment or post. It's used for likes and to confirm authorship, and the server stores only its hash. - Drops: the link (URL) you drop; the title, description, thumbnail, and language pulled from what that page makes public; and the type, category, made-with tool, and tip link you choose - Comments and posts: the text, title (posts), name (optional), and a 4-character tag made from your anonymous token - Email (optional): only if you enter it when dropping a link - Removal requests: the email address, name, request details, and evidence you send

We don't ask for your name, phone number, address, national ID number, or sensitive information. Please don't put personal information in comments or posts.

3. Retention and deletion

We keep personal information only for the periods below, and destroy it without delay once the period ends or the purpose is fulfilled. - Anonymous token cookie: expires in your browser after 1 year. - Drop info, email, and IP hash: kept while the drop exists. Destroyed immediately if you delete the drop with the owner key. For drops the Operator removes for breaking the rules, a record stays so the same link can't be dropped again. - Comments: destroyed immediately when deleted, or when the drop or post they're on is deleted. - Posts: kept until the author or the Operator deletes them. - Likes: deleted when you undo the like. - Limit counters (IP hash): deleted by a scheduled job once the counting period passes. - Removal request emails: kept as long as needed to handle the request and keep a record of it. - Backups: the database is backed up daily and only the latest 7 are kept, so deleted information may remain in backups for up to 7 days.

Personal information is kept only in electronic form. To destroy it, we delete it from the database, and backups are deleted when their retention period ends.

4. Sharing with third parties

The Operator doesn't provide personal information to third parties, except where the law specifically provides for it or investigative authorities request it through legal procedures.

5. Processors

To run the Service, the Operator entrusts the following tasks: - Cloudflare: security and networking - Amazon Web Services: content delivery - Oracle: hosting - Kakao: receiving questions by email

If a processor changes, we'll update this policy right away. If we add processors when we launch email or payment features, we'll update this policy and let you know before they start.

6. International transfers

Of the companies above, Cloudflare, Amazon Web Services and Oracle process personal information outside the Republic of Korea. Data is sent over the network when you use the Service. - Cloudflare (US): connection information / security and networking - Amazon Web Services (US): requests and responses / content delivery - Oracle (Japan): everything under “Information we process” / hosting

Retention follows “Retention and deletion”. Records left with each company during transfer follow that company's policy.

If you don't want your information transferred abroad, please don't use the Service. We can't provide the Service without these companies.

7. Cookies and browser storage

justdrop uses only the following. We don't use advertising or tracking cookies. - Anonymous token cookie: for likes and confirming authorship. 1 year, HttpOnly, Secure, SameSite=Lax - Language cookie: remembers the language you chose - Browser storage (localStorage): keeps values the page needs, such as the IDs of comments you wrote, on this device only, so we can show you a delete button

The bot check is shown by Cloudflare and handled under Cloudflare's policy.

You can block or clear cookies and storage in your browser settings. If you do, likes, comments, posts, and editing or deleting your own posts may not work properly.

8. Your rights and how to use them

You can ask at any time to access, correct, delete, or stop processing your personal information. You can also do this through a legal representative or someone you authorize. - Drops: edit or delete them yourself on the owner key page. - Comments and posts: delete them yourself from the browser you used. - Cookies: clear them in your browser. - Other requests: email wdh1105@kakao.com with the drop or post URL and what you'd like us to do. For email-related requests, please write from that email address.

The Operator will handle requests within the period set by law and let you know the result. Because justdrop doesn't hold identifying information such as raw IP addresses or names, we may not be able to handle a request if we can't connect you to a record. Please don't include your owner key in emails.

9. Security measures

- IP addresses are stored only as HMAC hashes, and owner keys and anonymous tokens only as hashes. - All connections to the Service are encrypted with HTTPS. - The database can't be reached directly from outside. - Secrets are kept separate from the code, and logs kept by justdrop never contain raw IP addresses, emails, or tokens. - Only the Operator can use the admin tools, and every admin action is logged. - The database is backed up daily.

10. Children under 14

justdrop doesn't knowingly collect personal information from children under 14. If you're under 14, please don't enter your email. If we learn we've received the email of a child under 14, we'll delete it without delay.

11. Privacy officer

For privacy questions, complaints, or remedies, contact: - Privacy officer: justdrop operator - Email: wdh1105@kakao.com

For advice or remedies regarding privacy violations, you can also contact these Korean agencies: - Personal Information Infringement Report Center: 118 (no area code, within Korea) - Personal Information Dispute Mediation Committee: 1833-6972 - Supreme Prosecutors' Office: 1301 (no area code, within Korea) - Korean National Police Agency: 182 (no area code, within Korea)

12. Changes to this policy

If we change this policy, we'll post what changed and the effective date on this page in advance.