MOAVO (CEO: Jae-Young Dokgo, hereinafter the “Company”) operates the MOAVO Habits service (hereinafter the “Service”) in compliance with the Personal Information Protection Act (PIPA) of the Republic of Korea and other applicable laws and regulations, in order to protect the freedom and rights of data subjects and to process personal information lawfully and manage it securely. Pursuant to Article 30 of the Personal Information Protection Act, the Company establishes and discloses this Privacy Policy to inform data subjects of the procedures and standards for the processing and protection of personal information, and to handle related complaints promptly and smoothly.
*This English version is provided for the convenience of users. In the event of any discrepancy between the Korean version and this English translation, the Korean version shall prevail. Unless otherwise specified, all references to laws and regulations in this Privacy Policy refer to the laws and regulations of the Republic of Korea.*
The Company processes personal information for the following purposes. Personal information being processed will not be used for any purpose other than those stated below, and if the purpose of use changes, the Company will take necessary measures in accordance with applicable laws.
1. Membership Registration and Management
Verifying intent to register, identifying and authenticating users, maintaining and managing membership status, preventing fraudulent use, delivering notices, and handling inquiries and complaints.
2. Service Provision
Providing habit creation, tracking, and management services; providing habit achievement statistics and analysis; generating AI-based habit coaching comments and reports; providing photo attachment features; providing a home screen widget; and sending service-related notifications such as habit reminders.
3. Subscription and Payment Management
Providing paid subscription (Premium) services, verifying and managing subscription status, managing free trial periods, and responding to payment-related inquiries.
4. Complaint Handling
Receiving and processing inquiries and complaints, retaining records for dispute resolution, and identifying and responding to service errors.
5. Service Stability and Security
Detecting abnormal logins and service use, limiting login attempts, responding to system failures, and managing security logs.
6. Statistical Analysis and Service Improvement
Analyzing service usage, improving quality, researching and developing new features, and compiling statistics and conducting internal analysis for research and materials related to behavioral science and habit formation. In such cases, the Company pseudonymizes or anonymizes personal information to the extent possible and does not combine it with identifiable information.
The Company processes the following personal information.
1. Personal Information Processed Without the Data Subject’s Consent
| Category | Purpose of Processing | Personal Information Items | Legal Basis |
|---|---|---|---|
| Membership registration (email) | User identification and execution/performance of the service agreement | Email address, password (hashed), nickname | Article 15(1)4 of the Personal Information Protection Act |
| Membership registration (social login) | User identification and execution/performance of the service agreement | Google ID or Apple ID (unique identifier), email address, name or nickname | Article 15(1)4 of the Personal Information Protection Act |
| Habit tracking service | Provision of habit tracking and management services | Habit information (title, identity statement, category, color, goal, start date, location), habit records (achievement date, record time, notes), streak count, statistical data | Article 15(1)4 of the Personal Information Protection Act |
| Subscription management | Provision of paid services and management of subscription status | Subscription status, subscription product, subscription period, RevenueCat customer ID | Article 15(1)4 of the Personal Information Protection Act |
| Service stability | Prevention of fraudulent logins and security management | Access IP address, login attempt records | Article 15(1)6 of the Personal Information Protection Act |
2. Personal Information Processed With the Data Subject’s Consent
The Company provides separate consent options for service notifications and marketing communications during sign-up or in the settings screen. Consent to receive marketing communications is optional, and declining consent does not restrict the use of basic Service features.
| Category | Purpose of Processing | Personal Information Items | Legal Basis |
|---|---|---|---|
| Profile photo | Displaying user profile | Profile image | Article 15(1)1 of the Personal Information Protection Act |
| Habit record photos | Attaching photos to habit achievement records | Photo file, file size, file format (MIME type) | Article 15(1)1 of the Personal Information Protection Act |
| AI coaching | Generating AI-based habit coaching comments and reports | Habit title, identity statement, streak count, note content, achievement statistics, recent record information | Article 15(1)1 of the Personal Information Protection Act |
| Service push notifications | Sending habit reminders and service notifications | Device push token (FCM token), notification settings | Article 15(1)1 of the Personal Information Protection Act |
| Marketing communications | Sending app update announcements, events, benefits, and promotional notifications | Device push token (FCM token), marketing consent status and consent date/time | Article 15(1)1 of the Personal Information Protection Act |
3. Information Automatically Generated and Collected During Service Use
The Company may automatically generate and collect the following information in the course of providing the Service.
| Category | Items | Purpose of Processing |
|---|---|---|
| Service usage records | Account creation date/time, data modification date/time, synchronization time records | Service provision and error response |
| Device and app information | OS version, app version, device model information (to the extent necessary for handling inquiries or analyzing errors) | Customer support and quality improvement |
| Access information | Access IP address, failed login records | Security management and prevention of fraudulent use |
4. Notice Regarding Sensitive Information
The Company does not intentionally collect sensitive information under applicable law, such as a user’s ideology, beliefs, or health status. However, content that users voluntarily enter or attach within the Service — such as habit titles, notes, and photos — may contain sensitive information, so please refrain from entering unnecessary sensitive information. Information voluntarily entered by users is processed only within the scope of providing the services requested by the user.
The Company processes and retains personal information within the retention and use period prescribed by law or the retention and use period consented to by the data subject at the time of collection.
1. Retention Periods for Key Personal Information
The Company operates its systems so that short-term data such as expired tokens, session information, and password reset tokens are automatically expired, invalidated, or deleted.
| Category | Retention Period | Basis |
|---|---|---|
| Member information (email, nickname, social login identifier) | Until membership withdrawal | Service agreement |
| Habit record data (including habit information, records, photos, and AI coaching outputs) | Until membership withdrawal or individual deletion by the user | Service agreement |
| Subscription and payment information | Until membership withdrawal; provided that information subject to statutory retention obligations is stored separately for the required period | Service agreement and applicable laws |
| Access token (JWT Access Token) | 15 minutes from issuance | Security operations policy |
| Refresh token (JWT Refresh Token) | 30 days from issuance | Security operations policy |
| Password reset token | 1 hour from issuance or immediately upon use | Security operations policy |
| Service push token (FCM token) | Until notification settings are disabled, membership withdrawal, or token renewal | Service provision |
| Marketing consent history | Until consent withdrawal or membership withdrawal; may be stored separately where necessary for dispute response or legal compliance | Consent management and applicable laws |
2. Destruction Upon Membership Withdrawal
When a user requests membership withdrawal through the in-app function [Settings] > [Delete Account], the Company will destroy the user’s personal information — including member information, habit records, photos, AI-generated content, and tokens — without delay, except for information that must be retained separately under applicable laws.
3. Retention Under Applicable Laws
In accordance with applicable laws, the following information is stored separately for the specified periods.
| Retained Item | Retention Period | Governing Law |
|---|---|---|
| Records regarding contracts or withdrawal of offers | 5 years | Article 6(1)2 of the Enforcement Decree of the Act on Consumer Protection in Electronic Commerce |
| Records regarding payment and supply of goods or services | 5 years | Article 6(1)3 of the Enforcement Decree of the Act on Consumer Protection in Electronic Commerce |
| Records regarding consumer complaints or dispute resolution | 3 years | Article 6(1)4 of the Enforcement Decree of the Act on Consumer Protection in Electronic Commerce |
| Records regarding display and advertising | 6 months | Article 6(1)1 of the Enforcement Decree of the Act on Consumer Protection in Electronic Commerce |
The Company destroys personal information without delay when it becomes unnecessary, such as upon expiration of the retention period, achievement of the processing purpose, or membership withdrawal. However, if the information must be retained under other laws, the Company transfers it to a separate database (DB) or stores it in a different location for safekeeping.
1. Destruction Procedure
The Company identifies personal information for which grounds for destruction have arisen and destroys it in accordance with internal procedures.
2. Destruction Method
Personal information in electronic file format is permanently deleted using technical methods that make recovery or restoration impossible. Photo files and similar data stored on servers are completely deleted from the storage media.
3. Handling of Backup Data
Personal information contained in system backup files is securely deleted according to the backup operation cycle, and even when recovery is necessary, the Company ensures that information already withdrawn or deleted is not reused.
The Company does not, in principle, provide data subjects’ personal information to external parties.
However, exceptions apply in the following cases:
1.Where the data subject has given separate prior consent
2.Where there are special provisions in the law or it is necessary to comply with legal obligations
3.Where it is deemed necessary for the urgent protection of the life, body, or property of the data subject or a third party
The Company outsources the following personal information processing tasks to provide the Service smoothly.
When entering into outsourcing agreements, the Company specifies in contracts or other documents, in accordance with applicable laws, matters such as the prohibition of processing personal information beyond the purpose of the outsourced task, security measures, restrictions on sub-outsourcing, supervision of the processor, and liability for damages, and supervises whether the processor handles personal information securely. If the content of the outsourced tasks or the processor changes, the Company will disclose such changes through this Privacy Policy without delay.
| Processor | Outsourced Tasks |
|---|---|
| RevenueCat, Inc. | In-app subscription payment processing and subscription status management |
| Google LLC (Firebase Cloud Messaging) | Push notification message delivery |
| Google LLC | Google sign-in authentication and account linking |
| Apple Inc. | Apple sign-in authentication and account linking |
| Amazon Web Services, Inc. | Data server and infrastructure operation |
The Company may transfer personal information abroad as follows to provide the Service.
The Company’s primary service data (member information, habit records, photos, etc.) is stored and processed in the AWS Seoul Region (ap-northeast-2) in the Republic of Korea
| Category | Legal Basis for Transfer | Recipient / Country | Personal Information Items Transferred | Purpose of Transfer | Timing and Method of Transfer | Retention and Use Period | How to Refuse and Effect of Refusal |
|---|---|---|---|---|---|---|---|
| AI coaching service | Article 28-8(1)1 of the Personal Information Protection Act (separate consent) | OpenAI, Inc. / United States / privacy@openai.com | Habit title, identity statement, streak count, note content, achievement statistics, recent record information. Directly identifying information such as email and name is not transmitted. | Generation of AI coaching comments and reports | Transmitted via API when an AI comment or report is requested | Processed within the retention period under OpenAI’s policies and contractual terms | You may disable or choose not to use AI features in the app. In that case, use of AI coaching and report features will be restricted. |
| Subscription payment processing | Article 28-8(1)3 of the Personal Information Protection Act (processing outsourcing necessary for the execution and performance of a contract) | RevenueCat, Inc. / United States / support@revenuecat.com | RevenueCat customer ID, subscription status, subscription product, subscription period | In-app payment processing and subscription status management | Transmitted via App Store or Google Play integration upon subscription payment, renewal, or cancellation | Until the end of the subscription relationship or as required under related contracts and laws | If you do not use the Premium subscription, this transfer does not occur. Refusal will restrict use of Premium services. |
| Push notification delivery | Article 28-8(1)1 of the Personal Information Protection Act (separate consent) | Google LLC / United States (global infrastructure) / https://support.google.com/policies/troubleshooter/7575787 | FCM push token, notification content (habit titles, notification messages, app update and event announcements, etc.) | Delivery of service notifications and, where separately consented, marketing communications | Transmitted via the FCM API when push notifications are sent | Processed to the extent necessary for notification delivery | You may revoke notification permissions in your device settings or disable notifications in the app settings. Refusal means you will not receive the related notifications. |
| Social login (Apple) | Article 28-8(1)3 of the Personal Information Protection Act (processing outsourcing necessary for the execution and performance of a contract) | Apple Inc. / United States / https://www.apple.com/privacy/contact/ | Apple ID unique identifier, email address, name or nickname | Apple sign-in authentication and account linking | Transmitted via API when the user taps the Apple sign-in button | Until membership withdrawal or unlinking | You may register with a standard email account instead. Refusal will restrict use of the Apple sign-in feature. |
| Social login (Google) | Article 28-8(1)3 of the Personal Information Protection Act (processing outsourcing necessary for the execution and performance of a contract) | Google LLC / United States / https://support.google.com/policies/troubleshooter/7575787 | Google ID unique identifier, email address, name or nickname | Google sign-in authentication and account linking | Transmitted via API when the user taps the Google sign-in button | Until membership withdrawal or unlinking | You may register with a standard email account instead. Refusal will restrict use of the Google sign-in feature. |
The Company takes the following measures to ensure the security of personal information.
1. Administrative Measures
Establishment and implementation of the privacy policy, minimization of access rights to personal information, management of personal information handlers, internal inspections, and access control.
2. Technical Measures
One-way encryption (hashing) of passwords
Secure storage and management of authentication tokens
Access rights management and per-user data ownership verification
Retention and monitoring of access records to personal information processing systems
HTTPS (TLS) encrypted communications
Prevention of brute-force attacks through login attempt limits
Expiration policy of 15 minutes for access tokens and 30 days for refresh tokens, with token rotation
Automatic invalidation and deletion of expired data
3. Physical Measures
Server infrastructure is operated in secure data centers with physical access controls in place.
The Company uses artificial intelligence (AI) technology within the Service to perform the following automated processing.
1. AI Habit Coaching Comments
When a user saves a habit record, the AI may automatically generate a personalized coaching comment of one to two sentences. The information used includes the habit title, identity statement, streak count, and note content; directly identifying information such as email or name is not transmitted. Users may disable this feature in the settings of each individual habit within the app.
2. AI Habit Reports
Upon the user’s request, the AI may analyze the user’s habit performance and generate a report. The information used includes the habit title, identity statement, total achievement days, success rate, longest streak, current streak, and recent note content. This processing does not occur unless requested by the user.
The AI features above are auxiliary functions that generate habit coaching content and do not make decisions that significantly affect the rights or obligations of data subjects. Nevertheless, data subjects may object to automated processing or request an explanation, and such requests may be directed to the Personal Information Protection Officer described in Article 13.
The Company transmits marketing communications in compliance with the Act on Promotion of Information and Communications Network Utilization and Information Protection and other applicable laws.
Marketing communications may include app update announcements, events, benefits, promotions, and new service announcements, and such information is sent via app push notifications only to users who have given separate, optional consent.
The Company provides a separate [Optional] Consent to marketing/event notifications option during sign-up or in the settings screen, and users may withdraw their consent at any time through the app settings or device notification settings. The Company processes requests to refuse or withdraw consent to marketing communications without delay.
Habit reminders, security alerts, and notices essential to the use of the Service may be operated separately from marketing communications. Where required by applicable laws, the Company may periodically verify users’ consent to receive marketing communications.
Data subjects may exercise the following rights regarding personal information protection against the Company at any time:
1.Request to access personal information
2.Request to correct errors
3.Request to delete
4.Request to suspend processing
5.Withdrawal of consent and membership withdrawal
Rights may be exercised via email or through in-app functions, and the Company will take action without delay in accordance with applicable laws.
If a data subject requests the correction or deletion of errors in their personal information, the Company will not use or provide the relevant personal information until the correction or deletion is completed.
| Right | Method |
|---|---|
| Request to access, correct, or delete personal information | Request via email (moavohabits@gmail.com) |
| Membership withdrawal (withdrawal of consent) | In-app [Settings] > [Delete Account] |
| Deletion of habit records | Use the in-app deletion function for individual habits or records |
| Change of profile information | Use the in-app [Settings] or [Edit Profile] function |
| Withdrawal of marketing consent | Use the in-app notification settings or device notification settings |
The Service is intended for users aged 14 or older. The Company does not allow children under the age of 14 to register as members and verifies the age requirement through the [Required] ‘I am 14 years of age or older’ item during the sign-up process.
The Company does not intentionally collect personal information of children under 14. If the Company becomes aware that personal information of a child under 14 has been collected, the relevant account may be restricted or withdrawn, and the related personal information will be destroyed without delay.
The Company designates the following Personal Information Protection Officer to take overall responsibility for personal information processing and to handle complaints and provide remedies for data subjects in relation to personal information processing.
Name: Jae-Young Dokgo (MOAVO)
Position: CEO
Email: moavohabits@gmail.com
As a sole proprietorship, the Company does not maintain a separate dedicated privacy department, and the Personal Information Protection Officer directly performs the related duties. Data subjects may direct all inquiries, complaints, and requests for remedies regarding personal information protection arising from the use of the Service to the Personal Information Protection Officer, and the Company will respond to and process them without delay.
Data subjects may apply for dispute resolution or consultation with the following Korean organizations to seek remedies for personal information infringement.
1. Personal Information Dispute Mediation Committee, 1833-6972 (Korea), https://www.kopico.go.kr
2. Personal Information Infringement Report Center (KISA), 118 (Korea), https://privacy.kisa.or.kr
3. National Police Agency, 182 (Korea), https://ecrm.police.go.kr
This Privacy Policy takes effect on July 1, 2026.
If there are additions, deletions, or modifications to this Privacy Policy, the Company will provide notice at least 7 days before the effective date through in-app announcements or pop-ups. However, for changes that significantly affect the rights of data subjects, notice will be provided at least 30 days in advance.
Privacy Policy Version: v1.0
Effective Date: July 1, 2026