Privacy Policy

Last revised: November 1, 2026

This Policy explains the standards for personal information processed in CC, Connect Culture's sign-up, operator-approved matching, 1:1 chat, translation, video calls, mood feed, monthly subscription and Jelly payment, gifting, and report/block features.

Article 1 (Personal Information Collected and How It Is Collected)

1. At sign-up (required)

1-1. Location-based automatic country/region suggestion at sign-up (optional)

• This feature is optional. If you do not press the button, location permission is not requested, and even if you deny permission or do not use the feature, you can continue signing up by entering the country/region yourself.
• Android requests only approximate location permission, and iOS requests location access only while you are using the app. We do not track location in the background or share location in real time.

1-2. Account recovery email and social login (optional)

2. Identity verification (adult confirmation) — Korean users

We confirm adult status (aged 19 or over) through PortOne mobile phone identity verification. Your name, date of birth and resident registration number are not stored on the Company's servers. The mobile phone number confirmed through identity verification is stored as member information (item 1 above). The values the Company stores in connection with identity verification are as follows.

3. Optional input items (profile)

One-line intro, age range (a self-reported range, unrelated to the date of birth from identity verification), occupation, interests, additional profile photos and background photo. Basic use of the Service is not restricted if you do not enter them (gender and one face photo are required items under item 1 above).

4. Information automatically generated and collected while using the Service

• Access logs and Service usage records (login time, most recent activity date)
• Device notification receipt information (push token) — for sending notifications; stops being used when you log out or change devices
• Device identifier — collected only when you enter a referrer (administrator) code or sign up with a code. On Android it is a device-unique value; on iOS it is a random value created by the app and stored on the device. The Company's servers store only a value converted so that the original cannot be recovered, not the original value. It is used to prevent abuse in which the new-sign-up benefit (free subscription) is received repeatedly on the same device; it is not used for advertising or tracking, and is not cross-checked against other apps. It is deleted 1 year after the benefit is granted (see Article 3)
• Chat messages, photo/video/file attachments (1:1 chat between members and free chat) — to prevent acts prohibited by the Terms of Service, such as demanding money or steering to external contacts, we automatically check message text for risk signals, and an operator reviews directly if there are risk signals. Use is not restricted on the automatic check alone. Chat translation is processed on the device by default, and only for messages that are hard to translate, the original text of that message is sent to an external translation service for translation (this happens automatically when the language is not supported by on-device translation, such as Mongolian, or when translation quality is judged to be low — see Article 5)
• Translation quality indicators — when you use chat translation, indicators generated on the device (language identification confidence, ratio of segments excluded from translation, number of sentence splits, number of times the original was viewed again, number of translation failures) are collected grouped into range values. Conversation content is not collected through this route, and the message content cannot be known from the aggregated range values alone. They are used only so that operators can judge whether conversation between users is blocked by a language barrier and offer help
• Payment information (the Company does not keep the payment method itself; it is handled by the payment processor — see Article 5)
• Feed usage records such as mood posts (photos, captions), comments, likes and picks
• Inquiry/suggestion content and administrators' replies (to respond to inquiries)
• Jelly and Gold balances and transaction history, gifting history (sending member, receiving member, quantity, date/time), and attendance check records
• Assigned administrator information — if you entered a referrer (administrator) code, which administrator's code you came through
• Fingerprint value for profile photo similarity check — a 64-bit fingerprint value (hash) calculated from a profile photo to judge whether a photo under approval review is the same as or similar to another account's photo. It is not the original photo, and the photo cannot be reconstructed from the fingerprint value alone. We do not automatically sanction accounts; an operator checks the photo directly and decides
• Report, block and sanction history (for safe operation of the Service)
• Video call metadata (call time and duration; the call content itself is real-time streaming and is not recorded or stored on the server)
• Screen capture detection record during video calls — when a screen capture (screenshot, screen recording or screen mirroring) is detected during a video call, we record the call number, the member who captured, the type (capture or recording/screen mirroring), the device type (Android/iOS) and the time of occurrence, and show a notification on the other party's screen. The content of the captured screen is not collected or stored. The value is reported by the app itself, is used only for an operator handling the other party's report to confirm the facts, and is deleted 1 year after recording (see Article 3)
• App error and crash diagnostic information — only when the app terminates unexpectedly or an error occurs, the error type and location (stack trace), app version, device model, OS version, memory/storage/CPU information, whether the device is rooted or jailbroken, and the app installation identifier are collected automatically. They are recorded together with the member identifier (internal member number) and used to identify errors that repeat for the same user, and are not used for any purpose other than finding and fixing the cause of errors (see Articles 5 and 6)

5. Information the Company does not collect

• Real-time location tracking, and server storage of precise GPS coordinates — location is used only momentarily on the device, only when the user requests it themselves for the automatic country/region suggestion at sign-up (item 1-1 above), and the coordinates themselves are not stored.
• Mandatory collection of email addresses — we do not require an email for sign-up (ID/password method). It is stored only when you enter it yourself for account recovery or it is provided through social login (item 1-2 above).
• Resident registration number, name, or the original date of birth (only confirmed in the identity verification procedure and not stored)

6. App access permissions (requested when you use the feature; if you refuse, you can still use everything else)

Article 2 (Purposes of Using Personal Information)

1. Member identification, identity and adult-status verification, and prevention of duplicate or fraudulent sign-up

1-1. Preventing duplicate or fraudulent receipt of sign-up benefits (free subscription with a referrer code) (using the device identifier hash)

1-2. Checking for stolen profile photos and duplicate accounts (using the photo fingerprint value)

2. Providing services such as matching, 1:1 chat, video calls and free chat

3. Processing monthly subscription and Jelly payments, managing payment history, and processing refunds

3-1. Accumulating Gold according to gifting history, and settling Gold payments to overseas users

4. Safe operation of the Service, such as handling reports and sanctioning abusive users (including operator review after automatic checking of chat messages for risk signals)

4-1. Showing a notification to the other party when a screen capture is detected during a video call, and operator fact-checking when handling a report (the captured screen content is not used)

5. Delivering announcements, responding to inquiries, and statistical analysis for improving the Service

5-1. Judging language barriers through translation quality indicators and connecting operator support (conversation content is not used)

6. (If you agreed) Providing marketing information such as events and promotions — you can withdraw consent to receive it at any time in settings, and sending stops without delay once you withdraw

Article 3 (Retention and Destruction of Personal Information)

Retention periods are explained item by item in the Personal Information Retention and Deletion Schedule. In summary:

• When a member withdraws, information that can identify the member, such as nickname, profile photo, self-introduction, gender, age range, spoken languages and mobile phone number, is deleted immediately or processed so that it can no longer identify the member.
• Payment records are kept for 5 years under the Act on Consumer Protection in Electronic Commerce, consumer complaint and dispute handling records for 3 years, and report and sanction history for 5 years from the date handling is completed, kept separately from other information and then destroyed.
• Identity verification information (adult status and values converted so that linking information cannot be recovered) is kept for 5 years from the withdrawal date (10 years if the member withdrew while permanently suspended) and then destroyed, to prevent minors from signing up by circumvention and sanctioned members from re-registering.
• Chat messages are not deleted even after withdrawal so that the other party can keep seeing the conversation (the withdrawn member can no longer use that chat room). Messages sent by a withdrawn member are stored together with the nickname at the time of sending, so that nickname may continue to be shown on the other party's screen. For chat rooms where all participants have withdrawn, messages and attachments are destroyed after 30 days.
• Mood posts and comments are deleted when a member withdraws and are no longer shown.
• Inquiry/suggestion content and administrators' replies are kept even after withdrawal for 3 years from the date of last activity and then destroyed.
• Jelly and Gold transaction history and gifting history are kept separately as payment and settlement records even after withdrawal and then destroyed (retention periods follow the Personal Information Retention and Deletion Schedule table).
• The profile photo fingerprint value is kept for 5 years from the withdrawal date and then destroyed, to prevent fraudulent sign-up by repeatedly using the same photo. It is a fingerprint value, not the original photo, and the photo cannot be reconstructed from it.
• Information on the device that received the referrer-code sign-up benefit is kept even after withdrawal for 1 year from the date the benefit was granted and then deleted, to prevent abuse in which the benefit is received repeatedly on the same device. Only the converted value, not the original value, is stored.
• The record of screen capture detection during video calls is used as evidence when handling the other party's report, and is kept even after withdrawal for 1 year from the time of recording and then deleted automatically (nickname and the like are anonymized on withdrawal, so the member cannot be identified from the record alone). The content of the captured screen is not stored.
• Login state information expires automatically at most 30 days after issuance, and is discarded immediately on logout, withdrawal or sanction.

Destruction procedure and method: Personal information whose retention period has passed or whose processing purpose has been achieved is destroyed without delay (within 5 days at the latest) through the automatic deletion function or after confirmation by the person in charge. Electronic files are deleted in a way that cannot be recovered, and information remaining in backups is deleted when the backup retention period ends. Paper documents are shredded or incinerated. Information that must be kept under law is kept separately from other information and is not used for any purpose other than the retention grounds and items stated above.

Statistical information: To improve the Service and compile statistics, the Company may use information processed anonymously so that no specific individual can be identified (for example, sign-up and usage statistics) even after the above retention periods have passed. Anonymously processed information cannot identify an individual even when combined with other information.

Article 4 (Provision of Personal Information to Third Parties)

The Company does not provide personal information to third parties without the user's consent. However, the following are exceptions.

1. Where the user has consented in advance
2. Where required by law, or where an investigative agency requests it for investigation purposes under the procedures and methods set by law

Article 5 (Entrustment of Personal Information Processing)

To operate the Service, personal information processing tasks are entrusted to outside parties as follows.

Article 6 (Transfer of Personal Information Overseas)

To provide a stable Service, we use cloud infrastructure with servers located overseas as shown below, and in this process personal information may be transferred to and stored overseas under Article 28-8 of the Personal Information Protection Act. The items transferred are limited to the minimum necessary to provide the Service, and are protected under the security standards set by the provider concerned.

We use Gemini translation with the processing region specified as the Republic of Korea (Seoul). However, Google does not guarantee the processing location of some models through region specification alone, in which case processing may take place in another country where Google affiliates have facilities. The contracting entity for Google Cloud used in Korea is Google Cloud Korea LLC.

Information provided to matched partners (overseas users): When a match is made, the member's profile (nickname, profile photo, one-line intro, etc.) and chat messages are provided on the app screen to the matched partner who lives overseas, such as in the Philippines or Vietnam. This is based on the "Consent to Overseas Transfer of Personal Information" obtained at sign-up, and the partner can see that information while the match is maintained.

Contact details of recipients

If you do not want an overseas transfer: You may refuse or withdraw consent to the overseas transfer by withdrawing your membership or making a request to the contact in Article 11 above. However, because the infrastructure above is essential to core services such as chat, notifications and video calls, refusing the transfer restricts sign-up or use of the relevant features. Because the Company targets overseas users in the Philippines, Vietnam, Thailand, Mongolia and elsewhere, it applies the safeguards necessary to comply with the relevant local laws and personal information protection standards.

Article 7 (Rights of Data Subjects and How to Exercise Them)

Users may exercise the following rights at any time.

1. Request to access, correct or delete personal information
2. Request to suspend processing of personal information
3. Withdrawal of consent (processing based on consent, such as receiving marketing information)
4. Membership withdrawal (processed immediately after password confirmation under Settings > App settings > Delete account in the app)

You can request to exercise these rights through an in-app feature or the inquiry channel of Customer Support, and the Company will act within 10 days of receiving the request and notify you of the result. Information that must be kept under law may continue to be kept for that period even after a deletion request, and in that case we will tell you the reason.

Where the user cannot easily exercise the rights personally, such as a person under adult guardianship, the legal representative may exercise the above rights on their behalf. In this case, the Company may ask for documents proving the representation (such as a guardianship registration certificate).

Article 8 (Measures to Ensure the Security of Personal Information)

1. Administrative measures: We establish and implement an internal personal information management plan, designate the minimum number of staff who handle personal information, and train them regularly.
2. Access control: Administrators' access to member information is limited to their assigned country and region, and records of administrators' viewing, editing and sanctioning of member information are kept for 3 years.
3. Encryption: Passwords are encrypted in a way that cannot be reversed, and identity verification information (such as linking information) is stored not in its original form but only as a value converted so that it cannot be recovered. Communication between the app and the server is encrypted.
4. Login protection: The login state value changes to a new value each time it is used once, so that a stolen value cannot be reused.

Article 9 (Cookies and Other Automatic Collection Devices)

This Service is a native mobile app that does not use web cookies. It uses only minimal local storage on the device (login session, language setting, etc.), and does not use tracking SDKs for advertising.

Article 10 (Protection of Children's Personal Information)

This Service can be used only by people aged 19 or over. Overseas users confirm for themselves that they are adults at sign-up, and we store the record of that confirmation. For details, see the Minor Protection Policy.

Article 11 (Personal Information Protection Officer)

Complaints and inquiries about personal information processing can be submitted through the contact above or Customer Support.

Article 12 (Remedies for Infringement of Rights)

If you need to report or consult about a personal information infringement, you can contact the following agencies.

• Personal Information Protection Commission (privacy.go.kr / dial 182 without an area code)
• Personal Information Infringement Report Center (privacy.kisa.or.kr / dial 118 without an area code)
• Supreme Prosecutors' Office Cybercrime Investigation Unit (spo.go.kr / dial 1301 without an area code)
• National Police Agency Cyber Bureau (cyberbureau.police.go.kr / dial 182 without an area code)

Article 13 (Duty of Notice)

If content of this Policy is added, deleted or modified, we will announce it through the in-Service notices. Changes that materially affect users' rights, such as the personal information items collected, purposes of use, retention periods and overseas transfer, will be notified separately and consent obtained again under the relevant laws (Articles 15, 18 and 28-8 of the Personal Information Protection Act).