Privacy Policy

withpic ("the Service") lets people share event photos anonymously and in real time. The Service operator ("the Operator") complies with Korea's Personal Information Protection Act and related laws, and processes personal data as described below.

1. Personal data collected and how

The Service is designed for anonymous (non-member) participation without sign-up. The data processed is:

Precise capture location (EXIF GPS) is automatically stripped on the server at upload. Even with location features on, only approximate location — never precise coordinates — is used.

2. Purposes of use

• Providing photo/video sharing and albums, and interactions such as likes and comments
• Preventing duplicate/abusive uploads, blocking spam and misuse, ensuring service stability
• Sending notifications (e.g. new photos) where the user has consented
• Handling inquiries and disputes

3. Retention, use period, and destruction

• Bucket (event album) content: active for 7 days from creation by default → access then locks, and after a grace period the content is permanently deleted. If the operator/host pays to extend, it is kept for that period. Buckets set to unlimited are kept until deleted.
• Access logs: retained for a limited period for abuse prevention and statistics, then destroyed; raw event logs are deleted per the configured retention policy (default 180 days).
• Member data: destroyed without delay on withdrawal or a deletion request.
• Method of destruction: electronic files are deleted irrecoverably.

4. Processing entrustment and storage location

The Service runs on the Operator's own servers and may use object storage (e.g. Cloudflare R2) to store photos/videos. In that case data may be stored outside Korea (in the provider's region) and is entrusted for storage only. Where social login is used, authentication is performed by the respective provider (Google, Kakao, etc.) under that provider's policy.

5. Provision to third parties

The Operator does not provide users' personal data to third parties beyond the purposes in Section 1, except where required by law or upon a lawful request from an investigative authority.

6. Children under 14

The Service is not directed at children under 14. Those under 14 may participate only as anonymous non-members, without sign-up (social login), in which case no identifiable personal data is collected. Membership is available only to those 14 or older. If personal data of a child under 14 is found to have been collected without a legal guardian's consent, it is deleted without delay.

7. Rights of users and legal guardians

Users may request access to, correction of, deletion of, or suspension of processing of their personal data and uploaded content. Given the anonymous nature of participation, requests are handled to the extent identity can be verified, or via the bucket's host/operator. Requests may be submitted to the contact below.

8. Cookies and automatic collection

The Service uses cookies and browser storage (localStorage) to keep login state, identify anonymous devices, and provide features. Users may refuse storage in browser settings, but some features may then be limited.

9. Security measures

• Encryption in transit (HTTPS), access control for private buckets, and non-public caching
• Access control for admin functions, and secure storage of passwords/keys
• Data minimization, including stripping EXIF location from photos

10. Data protection contact

For inquiries, access, or deletion requests regarding personal data, please contact:

• Contact: [email protected]

11. Notice of changes

Any addition, deletion, or amendment to this policy will be announced in the Service before it takes effect. Material changes are announced at least 7 days in advance.