Hamoney Privacy Policy

Effective Date: February 17, 2026

Data Protection Officer: Sang-Min Seo (belloo.planet@gmail.com)

1. Purpose of Processing Personal Information

Hamoney (hereinafter "the App") processes personal information for the following purposes:

Member Management: User registration, login, member information management, account deletion
Service Provision: Account book creation, expense management, budget setting, sharing features
Service Improvement: Error tracking, performance monitoring, user feedback collection
Security: Fraud prevention, account security maintenance
Legal Obligations: Compliance with applicable laws and regulations

2. Personal Information Collected

The App collects the following personal information:

Category	Items Collected	Collection Method
Identity Information	Email, nickname	Social login (Kakao/Google/Apple) + registration input
Profile	Profile picture	Upload from gallery/camera → stored in AWS S3
Authentication Information	OAuth tokens (access/refresh)	Auto-generated during social login
Account Book Data	Expense amount, date, description, memo, category, payment method, receipt image	User direct input + receipt photo capture
Budget Data	Category-specific budget amounts	User direct input
Account Book Information	Account book name, profile image, currency, start date, member list, invitation code	User direct input/settings
Device Information	Device model, OS name, OS version, app version	Auto-collected via device_info_plus/package_info_plus
Social Login Information	Social provider key, email, registration timestamp	Auto-collected during social login

        Notice: The App does not request sensitive permissions such as location, contacts, calendar, or camera access. Receipt photos are collected only when users explicitly capture or upload them.
      

3. Retention and Use Period

Personal information is retained and used for the following periods:

Item	Retention Period	Basis
Member information (email, nickname, profile)	Service usage period + 30 days after account deletion	Dispute resolution, legal obligations
Account book data (expenses, budget)	Service usage period + 30 days after account deletion	Data recovery possibility upon user request
OAuth tokens	Service usage period	Authentication maintenance
Error logs (SigNoz)	Maximum 30 days	Performance monitoring
S3 stored images	Service usage period + 30 days after account deletion	Data recovery possibility

After the retention period expires, personal information is destroyed without delay. However, if retention is required by law, the information is retained for the applicable period.

4. Provision to Third Parties

The App does not provide personal information to third parties except in the following cases:

Service	Purpose	Data Shared
Kakao SDK	Social login	Email, authentication token
Google OAuth	Social login	Email, authentication token
Apple Sign In	Social login	Email, identity token
Google Gemini API	Receipt OCR/parsing	Receipt image (may include store name, amount, etc.)
AWS S3 (ap-northeast-2)	Image storage	Profile picture, receipt image, account book icon
SigNoz	Error tracking/monitoring	User ID, email, nickname, device model, OS, app version, error information
Firebase Core	App basic infrastructure	Minimal initialization data (no analytics/crash reporting)

Personal information is not provided to third parties for purposes other than those listed above without explicit user consent.

5. Entrustment of Processing

The App entrusts personal information processing to the following vendors for service provision:

Processor	Entrusted Task	Entrusted Information
Amazon Web Services (AWS)	Image storage and management	Profile picture, receipt image, account book icon
Google Cloud (Gemini API)	Receipt OCR processing	Receipt image
SigNoz	Error log collection and analysis	User ID, email, nickname, device information, error information

Processors manage personal information securely in accordance with the Personal Information Protection Act and do not use personal information for purposes other than those entrusted.

6. Rights and Obligations of Data Subjects

6.1 Rights of Data Subjects

Users may exercise the following rights:

Right to Access: You may request access to your personal information.
Right to Correction: You may request correction of inaccurate personal information.
Right to Deletion: You may request deletion of your personal information.
Right to Restrict Processing: You may request restriction of personal information processing.
Right to Data Portability: You may request transfer of your personal information.

6.2 How to Exercise Rights

To exercise the above rights, please contact the following:

Data Protection Officer: Sang-Min Seo

Email: belloo.planet@gmail.com

When making a request, you must submit identification documents or other proof of identity.

6.3 Obligations of Data Subjects

Users must provide accurate personal information and immediately notify us of any changes. Users are responsible for any damages resulting from providing false information.

7. Safety Measures

The App implements the following measures to ensure the safety of personal information:

7.1 Technical Measures

Transmission Encryption: All communications are encrypted using HTTPS protocol.
Token Storage: OAuth tokens are encrypted and stored in Flutter Secure Storage.
Server Data Encryption: Personal information on the server is encrypted and stored in PostgreSQL.
Access Control: Only authenticated users can access their own data.

7.2 Administrative Measures

Minimization of personal information processing staff
Personal information protection training
Access rights management

7.3 Important Notice

Profile information (email, nickname) is stored locally in SharedPreferences on the app, which relies on device encryption. Security may be compromised if the device is rooted or jailbroken.

8. Data Protection Officer

If you have any inquiries regarding personal information protection, please contact the following Data Protection Officer:

Name: Sang-Min Seo

Email: belloo.planet@gmail.com

The Data Protection Officer will promptly address complaints related to personal information processing.

9. Remedies for Infringement of Rights

If you suffer damages due to personal information infringement, you may file a complaint with the following organizations:

Personal Information Protection Commission (PIPC)
- Website: https://www.pipc.go.kr
- Phone: 1833-6958
Supreme Prosecutors' Office Cyber Crime Investigation Division
- Website: https://www.spo.go.kr
National Police Agency Cyber Safety Bureau
- Website: https://www.police.go.kr

10. Effective Date

This Privacy Policy is effective as of February 17, 2026.

If this Privacy Policy is modified, changes will be announced through the app's notice section.

11. Overseas Transfer of Personal Information

The App transfers personal information overseas as follows:

Service	Transfer Country	Information Transferred	Legal Basis
Google Gemini API	United States	Receipt image	User consent
AWS S3	South Korea (ap-northeast-2)	Profile picture, receipt image, account book icon	User consent
Google OAuth / Apple Sign In	United States	Email, authentication token	User consent

When transferring personal information overseas, the information is protected in accordance with the personal information protection laws of the respective countries.

12. Destruction Procedures and Methods

12.1 Destruction Procedures

Personal information is destroyed as follows upon expiration of the retention period or upon user request:

Account Deletion: When a user requests account deletion, the user status is changed to INACTIVE.
Data Retention: Personal information is retained for 30 days after deletion (for dispute resolution and legal obligations).
Automatic Destruction: After 30 days, personal information is automatically destroyed.
Shared Data: Shared account book data may continue to be used by other members and is not immediately deleted.

12.2 Destruction Methods

Database: Logical deletion (soft delete) or physical deletion from PostgreSQL
Image Files: Object deletion from AWS S3
Log Data: Auto-expiration from SigNoz (maximum 30 days)

12.3 Important Notice

During the 30-day retention period after account deletion, users cannot cancel the deletion. Additionally, data included in shared account books is not immediately deleted unless requested by other members.