CLOKIE Privacy Policy

Last updated: 2026.10

CLOKIE (the “Company”) protects users' personal information in compliance with the Personal Information Protection Act of Korea and other applicable laws. The CLOKIE app works without sign-up or sign-in: the records and photos users keep in the app are stored only on the user's device and are never sent to the Company's servers. This Privacy Policy explains the minimal personal information the Company processes and how it is handled.

1. Information Stored Only on Your Device

The following information is stored only on the user's device. The Company does not collect it and cannot see it.

All records and photos kept in the app, including inspiration images (MUSE), points, tries and schedules, STEP photos, detail photos, notes and reflections
The date, time and content of scheduled reminders (reminders are triggered on the device itself)

When the app saves a photo it redraws the image, so embedded metadata such as the shooting location is not kept.

Backup files created with “Create backup file” (백업 파일 만들기) in the app are saved wherever the user chooses (for example the Files app, iCloud Drive or Google Drive), and the Company has no access to them. If the device's own backup (for example iCloud device backup) is turned on, app records may be included in that backup, which is governed by that provider's policies.

When a look from CLK LOOKS is brought in as an inspiration image, only the look's number is sent to the Company's server to receive the public look image and points, which are then stored on the device.

2. Personal Information Processed and How It Is Collected

App and website usage statistics (collected automatically)

A random identifier created for each device or browser (a number generated by the app, or a visitor cookie on the website)
Screens and features used and how often, the referring page, and short values tied to a feature (for example a point category or STEP number)
Device and browser type, and a non-reversible transformation of the IP address

Usage statistics never include photos, text written by the user, or inspiration and point titles.

Website visit statistics (Google Analytics)

When the website is visited in a browser, Google Analytics cookies (such as _ga) and visit data are sent to Google. Google Analytics is not used in the CLOKIE app.

App notifications

To provide notifications, a device notification token is created and processed by Google (Firebase Cloud Messaging) and by the operating system's notification service (Apple or Google). It is not stored on the Company's servers.

Service access logs (collected automatically)

For operation and security, the IP address, browser information, access time and requested address are temporarily recorded in the systems of the hosting provider (Vercel).
Request rate limiting, used to prevent abuse, relies only on a non-reversible transformation of the IP address.

Inquiries

When you contact us by email: your email address and the content of the inquiry (including any information you write yourself, such as your name)

EDITION store orders (orders without an account)

Orderer's name, mobile phone number and email address
For physical goods: delivery address (postal code, address, detailed address)
When requesting a refund: refund account (bank, account number, account holder)
Order lookup: the email address entered when ordering (to confirm a verification code)

Payment details such as card numbers are processed by the payment service providers and are not stored by the Company.

Event entries

Instagram ID, and an email address or mobile phone number to confirm the entry
(Optional) age range and preferred styles — only if you answer the survey on the entry screen
A non-reversible transformation of the IP address and a device check value, to detect duplicate entries
If you win a prize: recipient name, contact number and delivery address (for physical prizes)
If you write a review: the review text and attached photos

Bot protection

Order lookup and event entry screens use bot protection (Cloudflare Turnstile), during which browser information and similar data are processed by Cloudflare.

3. Purposes of Processing

Improving service quality and analyzing usage
Providing app notifications
Operating the service, maintaining security and preventing abuse
Responding to inquiries
Processing store orders, payments, deliveries and refunds, and order lookups
Confirming event entries, selecting and notifying winners, and sending prizes
Retaining records as required by law

4. Retention and Destruction

The Company destroys personal information without delay once the purpose of processing has been achieved. The following information, however, is kept for the periods below before being destroyed.

App and website usage statistics: 2 years from collection
Service access logs: kept briefly under the hosting provider's retention policy, then deleted automatically
Inquiries: 3 years from the date the inquiry was answered (records of consumer complaints and disputes, E-Commerce Act)
Store records of contracts and withdrawals, payments and supply of goods: 5 years (E-Commerce Act)
Store records of consumer complaints and disputes: 3 years (E-Commerce Act)
Event entry information: 2 weeks from the date prize delivery is completed (or from the entry deadline if there is no winner)
Event reviews: while they are published (deleted without delay if the author requests)

Event survey answers are destroyed together with the entry information; before destruction, only aggregated distributions of age ranges and preferred styles (numbers that cannot identify anyone) are kept.

Information in the database is deleted every day by an automated process once its retention period ends. Electronic files are deleted in a way that cannot be recovered, and paper documents are shredded or incinerated. Information retained under the law is used only for that purpose.

5. Information Collected Under the Former Membership Service

From October 15, 2026, CLOKIE operates without sign-up or sign-in. Information of those who registered as members before then is handled as follows.

Member information (email address, nickname, encrypted password, Google or Apple sign-in identifiers), together with records, photos and notification device information saved in member accounts, will be destroyed all at once on November 15, 2026.
If you would like to view or delete it before then, please send a request to clokie@naver.com from the email address you registered with. We will handle it without delay after verifying your identity.
Store orders and payment records made as a member are kept for the statutory periods in Section 4 and then destroyed.

6. Provision to Third Parties

The Company does not provide users' personal information to third parties, except where the user has consented or where required by law.

7. Outsourcing of Processing

The Company entrusts the following work to outside providers to operate the service.

Vercel Inc.: running service servers (hosting), file storage, processing access logs
Supabase Inc.: database operation
Google LLC: website visit statistics (Google Analytics), app notification delivery (Firebase Cloud Messaging)
Upstash, Inc.: request rate limiting (abuse prevention)
Cloudflare, Inc.: bot protection (Turnstile)
Resend, Inc.: sending verification codes and order and shipping emails
SOLAPI: sending verification text messages for event entries
PortOne and its partner payment provider (Korea Payment Networks), PayPal: store payment processing
Courier companies (shown in each order's details): delivering physical goods and prizes

Through contracts and other means, the Company ensures that these providers process personal information securely.

8. Overseas Transfer of Personal Information

For the outsourcing above, the Company transfers personal information overseas as follows. Transfers take place over the network whenever the service is used, and data is kept until the outsourcing contract ends or according to each provider's retention policy.

Vercel Inc. (United States, vercel.com): access logs, store and event information and files — running service servers and file storage
Supabase Inc. (United States, supabase.com): information stored in the database — database operation (storage location: Seoul, Republic of Korea)
Google LLC (United States, google.com): website visit data and cookies, app notification tokens — website visit statistics, app notification delivery
Upstash, Inc. (United States, upstash.com): non-reversible transformation of IP addresses — request rate limiting
Cloudflare, Inc. (United States, cloudflare.com): bot-check information (such as browser information) — bot protection
Resend, Inc. (United States, resend.com): email addresses and email content — sending emails
PayPal (United States and other countries, paypal.com): order and payment information when overseas payment is chosen — payment processing

Users may refuse the overseas transfer. Because the service cannot be provided without these providers, however, refusing may make it difficult to use the website, place orders or enter events. To refuse, please contact clokie@naver.com.

9. Users' Rights and How to Exercise Them

Records and photos stored on the device can be deleted at any time with “Erase all records” (모든 기록 지우기) in the app or by deleting the app.
For personal information the Company processes (inquiries, store orders, event entries, former member information), you may request access, correction, deletion or suspension of processing. Send your request to clokie@naver.com and we will inform you of the result within 10 days after verifying your identity.
Usage statistics are stored only with random identifiers, so the Company cannot identify a specific person; requests to access or delete an individual's statistics may therefore be difficult to fulfill.
Rights may also be exercised through a legal representative or an authorized person, in which case a power of attorney must be submitted.
Information that must be retained by law cannot be deleted during the retention period.

10. Cookies and Other Automatic Collection

The website uses cookies to remember language settings and to produce visit statistics (a visitor identification cookie and Google Analytics cookies).
The app uses cookies and device storage to recognize app screens and remember settings such as the display mode.
You can refuse or delete cookies in your browser settings (for example the privacy settings of Chrome or Safari). Google Analytics collection can also be refused with Google's opt-out browser add-on (tools.google.com/dlpage/gaoptout).
If cookies are refused, some features may be limited; for example, language settings may not be kept.

11. Security Measures

A structure that stores records and photos on the device instead of on servers
Encryption of all data in transit (HTTPS)
Only non-reversible transformations of IP addresses are used for usage statistics and request rate limiting
Minimal access rights to personal information and two-step verification for administrators
Regular security updates and vulnerability checks

12. Personal Information of Children Under 14

The Company does not accept member registration, and only people aged 14 or older may place store orders or enter events. If we learn that personal information of a child under 14 has been collected, we will destroy it without delay.

13. Personal Information Protection Officer

Questions about the processing of personal information, requests for access and complaints can be directed to the Personal Information Protection Officer below.

Name: Hyeongsan
Email: clokie@naver.com
Phone: +82-10-8783-6065

14. Remedies for Infringement

For consultation or reports about personal information infringement, you may contact the following Korean institutions.

Personal Information Dispute Mediation Committee: 1833-6972 (in Korea), www.kopico.go.kr
Personal Information Infringement Report Center: 118 (in Korea), privacy.kisa.or.kr
Supreme Prosecutors' Office: 1301 (in Korea), www.spo.go.kr
Korean National Police Agency: 182 (in Korea), ecrm.police.go.kr

15. Changes to This Privacy Policy

If this policy changes, we will give notice in the app or on the website at least 7 days before the change takes effect. Previous versions are available on request at clokie@naver.com.

Addendum

This Privacy Policy takes effect on October 15, 2026. (Changes: collected items and purposes reorganized following the end of sign-up and sign-in, app records and photos stored on the device, notes on usage statistics, app notifications and access logs, updated list of outsourcing and overseas transfer providers, destruction schedule for former member information, and remedies for infringement added.)