Picory Privacy Policy

The Company processes personal information to the extent necessary for the following purposes.

1. 1. Membership Registration and Account Management

Picory's photo organization, automatic classification, and duplicate-photo detection features may be used without membership registration or login.

When a user elects to create a Picory account, the Company processes the personal information necessary for the following purposes.

1. 1. Member identification
2. 2. Member authentication through Google Sign-In
3. 3. Login status and account management
4. 4. Processing membership withdrawal and account deletion
5. 5. Member inquiries and customer support
6. 6. Responding to unauthorized account use and security issues

A Picory account is an optional feature for using member functions such as server synchronization and restoring the Picory organization state when changing devices.

2. Picory Data Synchronization and Restoration

The Company provides logged-in members with synchronization functionality that enables restoration of their existing Picory organization state after reinstalling the app or changing devices.

For this purpose, the Company may process the following Picory-related data, rather than the original photos themselves.

1. Identification information and metadata for matching photos
2. Automatic photo classification results or classifications modified by the user
3. Favorites information
4. Collection information and order
5. Home screen frame settings
6. Other Picory service data necessary for a member to use synchronization

3. Provision of Photo Organization Features

When a user permits photo access through the operating system, Picory may access the device's photo library to provide the following features.

1. Photo list indexing
2. Checking newly added photos
3. Automatic on-device photo classification
4. Exact duplicate photo detection
5. Favorites and collection management
6. Processing deletion requests for photos selected by the user

Major photo analysis, including automatic photo classification and exact duplicate photo detection, is in principle performed within the user's device.

4. Customer Support and Service Operations

When a user uses customer support or the inquiry feature, the Company may process information supplied by the user for the following purposes.

1. Receiving and answering inquiries
2. Checking errors and service failures
3. Resolving account and synchronization issues
4. Processing user requests
5. Improving service quality
6. Resolving disputes or complaints

1. Personal Information Processed for Membership Registration and Server Synchronization

When a user uses membership registration and server synchronization features, the Company may process the following information to the extent necessary to provide the Service.

Membership registration and server synchronization are optional features selected by users. If an account is not created, information for member accounts and server synchronization is not processed.

2. Information Processed Within the Device

To provide photo organization features, Picory may process the following information within the user's device.

App Local Settings Not Subject to Server Synchronization

App feature and local state management

Not transmitted

Picory does not upload users' original photos to Picory servers or store them in an original-photo cloud storage service.

However, when a user directly attaches and sends screenshots, photos, or similar materials to the Company during a customer-support inquiry, those materials may be processed for the purpose of handling the inquiry.

3. Information That May Be Automatically Processed When Using the Picory Website

The Company uses Google Analytics 4 (GA4) to review usage of and improve the Picory website, which provides information about the Picory app and customer support.

When using the website, the following information may be processed automatically: page views and navigation paths; website usage events, such as language changes; customer-support inquiry button click events; browser type; operating system; device type; session and analytics identifiers; cookie-based analytics information; and approximate location information at the country or city level.

Google Analytics may use first-party cookies, including _ga, to analyze website usage.

The Company does not intentionally send users' names, email addresses, customer-support inquiry content, or original photos managed by Picory to Google Analytics.

Users may limit or delete cookie storage through their web browser's cookie settings or similar controls.

To provide photo organization features, Picory may request photo access permission provided by the operating system.

Within the scope supported by the operating system, users may choose among the following photo access scopes.

1. Allow access to all photos
2. Allow access only to selected photos
3. Do not allow photo access

When a user permits access only to some photos, Picory provides related features only within the scope of those photos.

Picory distinguishes, where possible, photos that a user did not permit access to or that became inaccessible due to a permission change so that they are not incorrectly treated simply as deleted photos.

Users may change photo access permission or the permitted scope through the operating system settings.

The Picory app itself can run without photo access permission, but all or part of photo-based features, including photo indexing, automatic classification, duplicate photo detection, and organization, may be restricted.

Photo access permission provided by the operating system is a device permission separate from Picory membership registration, Google Sign-In, or separate consent concerning personal information processing.

1. Automatic Photo Classification

Picory may use on-device image analysis technology to help users organize their photos.

It may analyze photo characteristics and automatically classify photos into categories provided by the Service, including people, animals, places, food, fashion, and documents.

Due to technical characteristics, automatic classification results may differ from the actual content of a photo or may not be accurate.

Users may directly change automatic classification results in Picory, and classifications directly specified or modified by users take precedence over automatic classification results.

2. Exact Duplicate Photo Detection

Picory may use file size and hash values based on file contents to detect photos with entirely identical contents.

Edited photos, recompressed photos, resized photos, or visually similar photos may not be determined to be exact duplicate photos.

Picory does not automatically and permanently delete photos it determines to be duplicates.

Users must directly review and select photos to delete, and actual deletion occurs through the approval procedure provided by the operating system.

3. Automated Processing

Picory's automatic photo classification and duplicate photo detection features are convenience features that support users' photo organization.

This automated processing is not used to make decisions that have legal effects on users or materially affect their rights or obligations.

The Company destroys personal information without delay when the purpose of processing has been achieved or the retention period has expired.

Member accounts and Picory data synchronized to servers are in principle deleted upon membership withdrawal.

Members may request membership withdrawal through the following in-app path.

1. Picory > Settings > Account > Withdraw Membership

Once membership withdrawal is completed, the member account and server synchronization data held by the Company are deleted except where retention is required under applicable laws.

Membership withdrawal does not delete original photos stored in the user's device photo library.

Because Picory's core local features may be used while not registered as a member, membership withdrawal alone may not automatically delete Picory local organization data stored on the user's device.

Users may delete Picory data stored on their device through the local data deletion or reset features provided by the Company or through the operating system's app data deletion features.

Deleting the app from a device alone does not automatically delete the Picory member account or synchronization data stored on the server.

Where personal information must be retained for a certain period under applicable laws, the Company keeps it separately from other personal information for the legally prescribed period and then destroys it.

The Company destroys personal information without delay when the purpose of processing has been achieved or the retention period has expired.

Where personal information must be retained for a certain period under law, the Company keeps it separately and does not use it for purposes other than the prescribed purpose.

Personal information in electronic-file form is deleted by secure methods that make recovery or reproduction difficult.

If personal information is retained in physical form, such as paper records, it is destroyed through appropriate methods such as shredding or incineration.

When a processor handles personal information, the Company manages the processor through contracts and related procedures so that personal information is properly deleted or destroyed.

Picory local data stored on the user's device may be deleted through Picory's deletion features, app data reset, or app data deletion features provided by the operating system.

Deletion and restoration of original photos stored in the device photo library are governed by the policies of the relevant operating system and photo management application, such as Android.

In principle, the Company does not provide users' personal information to third parties.

The Company may provide personal information to the extent permitted by applicable laws in any of the following cases.

1. Where the user has given separate prior consent
2. Where there is a special provision in law
3. Where there are other grounds that permit provision of personal information under applicable laws
4. Where the user has given separate prior consent
5. Where there is a special provision in law
6. Where there are other grounds that permit provision of personal information under applicable laws

If a service that provides personal information to third parties is added in the future, the Company will disclose or notify users of the recipient, purpose, items provided, and retention and use period in accordance with applicable laws and obtain separate consent where necessary.

During Google Sign-In, users elect to use Google's authentication service, and processing of the Google account itself is governed by Google's Privacy Policy and service policies. Picory receives account information through Google Sign-In only to the extent necessary to provide the Service.

To provide stable services, the Company may entrust part of its personal information processing work to external specialist providers.

Picory's principal personal information processors are currently as follows.

When entrusting personal information processing, the Company includes in contracts and related documents matters required under applicable laws, including a prohibition on processing beyond the entrusted purpose, security safeguards, and management and supervision of processors.

Google ML Kit Image Labeling used for Picory's automatic photo classification runs in principle within the user's device and does not upload original photos to Picory servers for automatic classification.

In providing the Service, Picory may use cloud, authentication, or other external services provided by overseas businesses.

Where personal information is transferred overseas or processed overseas in this process, the Company discloses or notifies users, in accordance with applicable laws including the Personal Information Protection Act, of the recipient, country of transfer, categories of personal information transferred, purpose of transfer, time and method of transfer, retention period, and legal basis for transfer.

Picory's current overseas processing or transfer of personal information is as follows.

Picory's original photos are not uploaded to Supabase for member authentication, server synchronization, or data restoration and are not included in the server storage and overseas processing described in the table above.

The Company applies necessary safeguards during overseas transfers or processing of personal information, including encrypted communications, access controls, contractual safeguards, and management of processors and sub-processors.

4. Notice of Changes

If a material change occurs to the recipient, country of transfer, transferred items, purpose, time or method, or retention period relating to overseas processing or transfer, and additional disclosure or consent is required under applicable laws, the Company will provide notice through this Privacy Policy or otherwise.

To prevent loss, theft, leakage, forgery, alteration, or damage of personal information, the Company implements technical and administrative safeguards required under applicable laws.

The Company applies the following measures.

1. 1. Minimizing personal information access privileges
2. 2. Access control for administrators and personnel responsible for processing
3. 3. Secure management of authentication and sessions
4. 4. Encrypted communications during transmission of personal information
5. 5. Separate access permissions to server data for each user

6. Access control using Supabase Row Level Security (RLS), etc.

7. Restrictions on storing server secret keys and administrator privilege information in the client app

8. Management to prevent unnecessary recording of personal information in logs

9. Management and supervision of personal information processors

10. Necessary measures to respond to security incidents

1. Picory does not currently provide customized advertising by analyzing users' past behavior, interests, or similar information.

2. During service operations, information necessary to provide the Service, such as app version, operating system information, and synchronization time, may be processed within the purposes stated in this Privacy Policy.

3. If analytics, advertising, or other automatic collection technologies are introduced in the future and change the processing of personal information, the Company will amend this Privacy Policy before actual implementation and provide separate notice or obtain consent where required by applicable laws.

Users may exercise the following rights regarding their personal information as provided by applicable laws.

1. 1. Request confirmation of processing and access to personal information
2. 2. Request correction or deletion of personal information
3. 3. Request suspension of processing of personal information
4. 4. Withdraw consent where personal information processing is based on consent
5. 5. Withdraw membership and delete the account
6. 6. Make inquiries or raise objections concerning personal information processing
7. 7. Other rights recognized under applicable laws

Picory members may request membership withdrawal and account deletion through the following path.

1. Picory > Settings > Account > Withdraw Membership

Users may also make personal information-related requests through the following methods.

The Company may verify whether a user exercising rights relating to personal information is the data subject or a duly authorized representative, and processes the request in accordance with procedures and periods prescribed by applicable laws.

Some requests may be restricted where legal grounds for restriction exist, including where personal information must continue to be retained under applicable laws or where responding may infringe the rights or legitimate interests of others.

Because Google Play requires apps that allow account creation to offer an in-app account deletion path and an account deletion mechanism accessible outside the app, Picory must provide an external account deletion webpage before release.

1. Picory does not offer membership registration to children under 14 years of age.

2. Picory membership registration is available only to users 14 years of age or older.

3. If it is confirmed during membership registration that a user is under 14 years of age, a Picory member account cannot be created.

4. If the Company confirms that personal information of a child under 14 years of age was processed through a member account or server synchronization, it will take necessary measures in accordance with applicable laws and delete the personal information without delay.

5. However, if information must be retained for a certain period under applicable laws, it may be separately retained for the statutory retention period and then destroyed.

1. Members may at any time request membership withdrawal and deletion of their Picory account through the following path in the Picory app.

1. Picory > Settings > Account > Withdraw Membership

2. If the app cannot be used, members may request account deletion through the following external account deletion page.

1. External Account Deletion URL

3. When an account deletion request is properly processed, the member account held by the Company and server synchronization data associated with that account are deleted, except where retention is required under applicable laws.

4. Membership withdrawal or Picory account deletion does not delete original photos stored in the user's operating system photo library.

5. Membership withdrawal alone may not automatically delete Picory local organization data stored on the user's device.

6. Users who wish to delete local organization data may use the local data reset feature provided by the Company or the operating system's app data deletion feature.

7. Deleting the Picory app from a device alone does not automatically delete the Picory account on the server.

8. Account deletion processes actual deletion of the account and associated server data, not merely account deactivation or suspension. However, if certain information must be retained for lawful reasons such as security, legal obligations, or dispute resolution, the Company will provide notice of that fact and the retention period. Google Play also requires deletion of the account and user data associated with it upon account deletion.

The Company designates a chief privacy officer or responsible person to oversee personal information processing and handle user inquiries, complaints, and exercises of rights relating to personal information.

Users may contact the Company's chief privacy officer for inquiries, consultation, reports, or dispute mediation concerning personal information infringements.

If a user is dissatisfied with the Company's handling or needs more detailed help, the user may apply to the following organizations for consultation, reporting, or dispute mediation.

1. 1. Personal Information Infringement Report Center
2. Responsible services: Reporting and consultation concerning personal information infringements
3. Telephone: 118 (without area code)
4. Website: privacy.kisa.or.kr
5. 2. Personal Information Dispute Mediation Committee
6. Responsible services: Personal information dispute mediation and collective dispute mediation
7. Telephone: 1833-6972
8. Website: www.kopico.go.kr
9. 3. National Police Agency Cybercrime Reporting System
10. Telephone: 182 (without area code)
11. Website: ecrm.police.go.kr

These organizations are separate from the Company. Users may seek consultation or remedies from the appropriate organization depending on the nature of the personal information infringement and the damage suffered.

Current guidance from the Personal Information Protection Commission also lists the Personal Information Infringement Report Center at 118 and the Personal Information Dispute Mediation Committee at 1833-6972.

This Privacy Policy applies from its effective date.

The Company may amend this Privacy Policy due to changes in applicable laws, Service features, personal information processing methods, processors, or similar matters.

If this Privacy Policy is amended, the Company will provide notice of the effective date and key changes through notices in the Picory app, the settings screen, or webpages operated by the Company.

General amendments are in principle announced from at least seven days before the effective date.

Amendments that materially affect users' rights are in principle announced from at least 30 days before the effective date.

If personal information processing that requires separate consent under applicable laws is added or changed, the Company obtains user consent in accordance with the relevant procedures.

Previous versions of this Privacy Policy may be retained or made available by a method determined by the Company so that users can review them.

These Terms take effect on September 10, 2026.

If the Company's information or customer support contact details change, the Company will provide the updated information through the Service screen, webpages, or other appropriate means.