Privacy policy

1.Information handled and why

a. Anonymous usage statistics

From Mac app 1.0.2, Windows app 0.9.0, Android app 1.0.0 and iPhone · iPad app 1.0.0, the items below are sent to the Company's server once a day on days you use the app. Development builds don't send them, and the Android app doesn't send them from the test devices Google Play uses to run apps automatically before release (the Firebase Test Lab devices of the pre-launch report).

Purpose: to know how many people use the app and on which devices · OS · versions · chips (compatibility). No name, email or planner content is included.

Turn off ‘Send anonymous usage statistics’ and nothing is sent from then on. It's in Settings → Data on Mac, Settings → Anonymous Usage Statistics on Windows, and Settings → Privacy on Android · iPhone · iPad. Turning it off also turns off detailed usage statistics below.

a-2. Detailed usage statistics (on by default · can be turned off)

These statistics are not anonymous. Numbers connect one person's records (pseudonymous data). We use them to learn which features people really love, to decide the product, and to report company usage metrics. From the next update of the Mac · Windows · Android · iPhone · iPad apps (versions released after November 3, 2026), the app tells you at first launch after the update what is collected, with an off switch right there. In Korea and other regions this is pseudonymised data for statistics (Korean PIPA Art. 28-2 — allowed without consent, but you can turn it off and delete it any time). In the EU · EEA · UK (decided from the App Store country, SIM or device region; unknown counts as EU) the app asks “Help make Spiralday better?” and only devices that agree send (GDPR consent). Nothing is sent before the notice or the question.

Information that could re-identify you (your sync group key, records on other servers) is kept apart and never joined. The Company does not try to identify people, and screens and exports never show the numbers. A processing record is kept as the law requires.

Never sent: anything written in tasks · notes · memo pads · diaries, character counts, photos, custom sticker images, file paths, people's names, sync group IDs or keys, planner names, link addresses, dates inside planners, device names, accounts · email, advertising IDs, location, stored IP addresses. Synced content is end-to-end encrypted, so even the Company cannot read it. The app can only produce names and values from a fixed list, and the server drops anything outside it.

Purpose: to see how inserts, memo pads, stickers, settings, backgrounds and widgets are used and where people get stuck, so we can fix errors and what isn't working and decide new inserts, packs and defaults. Inside the Company, only approved staff can see person-level data, and viewing is logged. Outside the Company (such as investors) only totals with cells under 20 people hidden are shared, never numbered data. It is never linked to spiralday.com ideas board or web market accounts or payments.

In the statistics pane (Settings → Data on Mac, Settings → Anonymous Usage Statistics on Windows, or Settings → Privacy on Android · iPhone · iPad) you can turn off ‘Send detailed usage statistics’ any time (what is kept on the device is deleted at once), ‘Make a new statistics number’ to cut the link to earlier records, and ‘Delete my usage records’ to delete your raw records on our server. ‘See what is sent’ shows exactly what would be sent.

b. Spiralday Sync (only when sync is on)

Spiralday Sync keeps your planners in step between your own devices. It starts off, and nothing is sent until you turn it on.

Planner content is end-to-end encrypted. Each device locks planner records and device names with the group key before sending them (XChaCha20-Poly1305), and the group key exists only in your devices' secure storage (e.g. the Keychain on iPhone · iPad, the Keystore on Android, DPAPI on Windows). So neither the Company nor Cloudflare, which runs the server, can read your tasks · notes · dates · planner names · device names. Memo pads · stickers (including the Always Shown · Today's Notes memo pads to the left of the planner) · inserts · bookmarks · planner arrangement (days off · day sets) · cover decoration and photos chosen for planner covers, photos stuck in the diary, and addresses written in link boxes with their fetched titles are planner records too, so they are locked on the device in the same way before they're sent.

The server holds only the following.

When another device in the same group is open at the same time, live typing keeps them in step. While you type, the changed parts are locked with the group key, just like planner records, and passed through the server straight to that device. The server only passes these pieces on without storing them (which is why they aren't in the table above), and they're locked, so it can't see their content. While passing them on, however, which device is typing and when (the time and interval of typing) and the rough size of each piece (in 256-byte steps) go through the server. These are not stored or logged either.

Purpose: to keep planners in step between your devices and to prevent abuse of the server. Server call logs that would record request addresses are turned off.

c. Contact (email · Threads DM)

If you email contact@leanagilehungry.com, we receive your email address and the message. If you send a DM to @owlu_app on Threads, we receive your Threads username · profile and the message. Both are used only to reply and to handle requests and bugs.

Threads is a service run by Meta Platforms, Inc. (USA), so DMs are stored and processed by Meta under Meta's privacy policy. If that concerns you, please email us instead. We'll help you just the same.

d. Planner records stay on your device

Records like tasks, the timetable, notes, highlighters, D-days, memo pads · stickers · inserts, planner arrangement · cover decoration, cover photos · diary photos and link boxes are saved on your device. They don't leave the device unless you turn on sync, and even then the Company can't see the content (b above).

Photos you put on a cover or in the diary are turned into small JPEGs on that device and placed in the planner record. Information attached to the photo, such as location · the camera used · the date taken (metadata), is removed, and the original photo file you picked is not kept separately in the app.

Preview pictures and site icons for link boxes are not put into planner records; they stay only in that device's cache folder (e.g. ~/Library/Caches/Spiralday/LinkPreviews on Mac). They aren't synced, so other devices fetch them on their own when needed (4 below).

If you've turned on device backup (Google account) on Android or iCloud Backup on iPhone · iPad, your planner files are included in those backups. These backups are kept by Google · Apple under their own policies, and the Company can't see them. Android backups include only the planners (shelf · book files) and leave out the install number and the app's own automatic backups.

e. Device permissions

The iPhone · iPad app uses the camera only when you scan a sync connection QR code or take a photo for the diary with ‘Take Photo’, and the photo library (add only) only when you save a planner page as an image. Camera views and images are not sent off the device (photos stuck in the diary become planner records, as in d above). Photos for planner covers · the cover editor · the diary come into the app only when you pick them yourself, through the device's photo picker (Mac · iPhone · iPad · Android) or file picker (Mac · Windows · iPhone · iPad), or by dragging · pasting, and the app never asks for permission to read your whole photo library. The Android app uses the internet · vibration · network state (to resume sync when the connection comes back), and asks for the camera only when you scan a sync connection QR code. The camera view is read right on the device (Google ML Kit, 4 below) and is not stored or sent. Even if you don't allow the camera, you can connect the same way with the 8-digit code.

When screen lock is on, unlocking uses the device's Face ID · Touch ID · fingerprint · face unlock · device passcode (Touch ID · the Mac login password on Mac, Windows Hello on Windows). The device does the checking, and the app only receives whether it matched. Neither the app nor the Company receives biometric data or passcodes. Screen lock starts off and applies only to the devices where you turn it on (it isn't synced). The Android app adds the biometric permissions for this (USE_BIOMETRIC · USE_FINGERPRINT, normal permissions that aren't asked for).

The quick memo pad shortcut on Mac · Windows (by default Mac ⌃⌥⌘N · Windows Win+Alt+N) registers only that one key combination with the system. It doesn't ask for permissions like Accessibility · Input Monitoring · Screen Recording, and it doesn't see any other keystrokes.

f. Ideas · upvotes (spiralday.com, email confirmation)

To send a feature idea or bug-fix idea, or to upvote an idea, you confirm your email address once. This keeps it to one upvote per person per idea, and stops spam.

Purpose: email confirmation, keeping one vote per person, reviewing ideas, preventing abuse.

Legal basis: it is needed to handle the ideas and upvotes you request (Article 15(1)(iv) of Korea's Personal Information Protection Act). What's used to prevent abuse, such as rate limits · domain values · blocked emails, is for the Company's legitimate interests (Article 15(1)(vi) of the same Act).

It can't be used by children under 14.

g. The sign-in cookie and what's left on your device

On a device where you've confirmed your email, one cookie (__Host-sd) is set so you aren't asked again. It's a random value, and the server keeps only a hash of it. It lasts one year from the last day you used it.

There are no advertising or tracking cookies. Nothing is shared with other sites.

This device's browser storage keeps only the masked address (e.g. jo•••@gm•••.com) and idea text you haven't sent yet (up to 24 hours). They're deleted too when you sign out on this device or delete.

To remove it, press ‘Sign out on this device’ at the bottom of the ideas board, or clear spiralday.com cookies · site data in your browser. Even after that, confirming your email again lets you carry on as before.

You can also block or delete spiralday.com cookies in your browser's cookie settings (e.g. on iPhone, Settings › Apps › Safari › Advanced › Block All Cookies. Menu names differ by browser). If you block them, you'll have to confirm your email every time.

2.How long it's kept

• Anonymous usage statistics: destroyed two years after the day they were collected.
• Detailed usage statistics: received reports (person-level raw data) are destroyed after 13 months, and their totals (counts per platform · version, no numbers) after 2 years. Unsent reports on the device are deleted after 14 days or when you turn it off; kept counts are deleted the moment you turn it off.
• Spiralday Sync: kept while you sync. Overwritten earlier versions are deleted after 30 days. ‘Delete Group’ in Settings → Sync deletes the copies on the server right away, and if no device in the group connects for 13 months (396 days), they're deleted automatically. Even after the last device turns sync off, they remain for those 13 months so that you can come back with your recovery code — if you don't want them kept, please use ‘Delete Group’.
• Live-typing pieces: not stored. They pass through the server's memory only while being passed to the other device.
• Information about a device removed from the group is deleted right away. Only the hash of its authentication token is kept for 30 days, to tell that device it's been removed from the group.
• HMAC values of IPs used for Spiralday Sync rate limits: 24 hours at most. (Rate limits for the ideas board are listed separately under ‘Ideas · upvotes’ below.)
• Access logs for the website · app files (no IP addresses, 5 below): deleted automatically after 13 months (396 days).
• Contact emails · Threads DMs: records the Company holds are deleted within one year after the matter is handled. Conversations inside Threads are deleted as far as the Company can delete them; the rest follows Meta's policy.
• Ideas · upvotes (1-f): pending confirmations (masked address · the intended action · idea text before confirmation) 30 minutes. Ideas decided not to be made public: 30 days after the decision. Ideas taken down before being made public (taken down during review because of a privacy or rights report, etc.): 30 days from the takedown, or 30 days from the end of any temporary-measure period. The link between an idea and the email hash: one year after it's closed as shipped or not planned, 30 days for ideas not made public, and in any case two years from when it was sent. Upvote records (times to the hour): until one year after the idea is closed or until the email hash is deleted, whichever comes first (the upvote counts remain). Hashes of confirmed emails: two years from the last use (confirming, or using a confirmed device). The sign-in cookie: one year from the last use. IP hashes used for rate limits: 25 hours. Block marks for blocked emails: one year from the date blocked. Addresses on the email-sending service's (Amazon SES) suppression list: until the Company deletes them.
• Copies in the Company's internal review tool (titles · descriptions edited for publishing): as soon as the receipt of applying that decision is attached in the review tool, and at most 30 days. Moderation records (publish · hide · delete actions, no personal information): 3 years; administrator access records: 2 years.
• When the periods above end, the information is no longer used and is deleted within a day. Information on the ideas board is deleted by an automatic cleanup every day before dawn.

3.Provision to third parties

The Company doesn't provide this information to third parties. Cloudflare, which runs the Spiralday Sync server, and Amazon Web Services (AWS), which handles the anonymous and detailed usage statistics server · this website · the app files, are processors the Company has entrusted (4 below).

However, when you scan a sync connection QR code in the Android app, Google ML Kit built into the app sends diagnostic information about its own operation (device · app information, a per-install identifier, language · country · time zone, carrier · network type, event codes, etc.) directly to Google LLC. The Company doesn't receive this information, and Google handles it under its own policies. Because it goes to the United States, every item sent is listed in cross-border transfer ② in 4 below. If you connect with the 8-digit code instead of the QR code, this diagnostic information isn't sent.

Also, on Android, each time a text field appears on screen, the Android system component that draws the app's screens (Android System WebView) asks Google about autofill. What it sends is the WebView version and a value (hash) representing the structure of that field. What you write is not included, and the Company doesn't receive this value. It's done by WebView, not the app, so the app has no setting to turn it off.

4.Where it's processed, and outside services

• Anonymous and detailed usage statistics are stored on a server run by the Company. The server is in the Amazon Web Services (AWS) Seoul Region (ap-northeast-2).
• The Spiralday Sync server (sync.spiralday.com) runs on Cloudflare, Inc.'s Workers · Durable Objects (cross-border transfer below).
• Where you get and update the apps: the Mac · Windows install and update files come from spiralday.com and GitHub Releases. spiralday.com is a server the Company runs on AWS (Amazon CloudFront · Amazon S3). The Mac app checks spiralday.com for a new version once a day, and the Windows app (from 1.0) when it starts and once a day (cross-border transfer ③ below). Files downloaded through old links and new-version checks by Windows app 0.9.x go through GitHub, and then the GitHub privacy statement applies. The Android app is downloaded and updated from Google Play, and the iPhone · iPad app from the App Store — Google's and Apple's privacy policies apply there.
• In-app ‘News’: the Mac app (from the version after 1.1.1) and the Windows app (from 1.0) read the news file on spiralday.com (https://spiralday.com/news/news.json) when the app starts, when you come back after more than 60 minutes away, and once a day while it's open (not again within 60 minutes of the last fetch). As when you open a web page, your IP address and the request time reach Amazon CloudFront, which delivers this file (cross-border transfer ③ below), but no install number · device information · planner content is attached (the User-Agent is just ‘Spiralday’). These requests also appear in the access logs without IP addresses (5 below). Which news you've seen stays only on your device and isn't sent to the Company. Turn off ‘Get news from spiralday.com’ in Settings → News and it isn't fetched.
• Link box previews: when you write or paste a web address in a link box (including address-like lines when old notes move into the link box), the app connects directly to that site when showing the page, fetches the beginning of the page (up to 1 MB), and gets the title · main picture (og:image) · site icon (favicon) written there. As when you open that page in a browser, the site (and wherever it keeps its pictures · icons) learns your device's IP address, the request time and the requested address, and that site's privacy policy applies. The app sends along only a User-Agent like an ordinary browser's (the Safari name on Mac · iPhone · iPad, the Chrome name on Windows · Android, with ‘Spiralday’ at the end) and the language (Korean · English). No cookies · sign-in information · install number · planner content are sent. It doesn't go through the Company's servers, so the Company can't know what address you wrote. Fetched pictures · icons stay only in that device's cache (1-d above), and the title is written in the link box and saved · synced like other planner records (1-b above). Other devices you sync with fetch them on their own in the same way when they show that page. To avoid fetching, write it as text instead of an address (a line with spaces is treated as text). Tapping the card opens the address in your default browser.
• When the Android app reads a QR code, it uses Google's ML Kit (barcode recognition that runs on the device). The camera view doesn't leave the device, but ML Kit sends diagnostic · usage statistics about its own operation (device · app information, a per-install identifier, language · country · time zone, carrier · network type, performance, API settings, event · error codes, etc.) to Google (HTTPS). The full list of items sent is in cross-border transfer ② below. The per-install identifier is a number newly set each time the app is installed, and it doesn't point to a device or a user. It's separate from the app's ‘Send anonymous usage statistics’, so it's sent when you scan a QR code even with statistics off. Google handles this information under the ML Kit data disclosure and the Google Privacy Policy, and the Company doesn't receive it.
• This website (spiralday.com) also opens from the same AWS servers (Amazon CloudFront · Amazon S3). The handwriting fonts load from these servers too, and no outside font service such as Google Fonts is used.
• Ratings, rank and installs on the home page: when you open the spiralday.com home page, your browser loads the App Store and Google Play ratings, the App Store rank and the total number of installs from the company server (leanagilehungry.com). The request carries no cookies or personal information, and the company uses it only to show these numbers. As described in section 5, the server's access log may briefly keep your IP address.

Processors

Cross-border transfer ① When you turn on Spiralday Sync

Cross-border transfer ② When you scan a QR code in the Android app (Google ML Kit)

Cross-border transfer ③ When you open the website or get app files · updates · news (Amazon CloudFront)

When you send an idea or upvote on spiralday.com, the content of that request (email address, idea text) also goes through CloudFront to the Seoul Region. It's stored only in the Seoul Region.

5.Access logs

Neither anonymous usage statistics nor detailed usage statistics store IP addresses. To stop excessive requests, the server that receives detailed statistics uses a hash of the IP address in memory for one minute, and keeps no access log for that path. On other paths, however, access logs (IP address, access time, etc.) may remain on a server temporarily for security and outage response while running servers.

The Spiralday Sync server doesn't store IP addresses, and call logs that would record request addresses are turned off (1-b).

Amazon CloudFront, which delivers this website and the app files · update information, handles IP addresses while answering requests. IP addresses are used only for delivery, and the Company doesn't store them.

The Company keeps CloudFront access logs, without IP addresses, for download · update statistics and outage response. Requests to the spiralday.com ideas board (viewing the list · email confirmation · upvoting · sending ideas · viewing and deleting your information) are kept in the same logs.

6.Your rights

• Turn off statistics — Turn off ‘Send anonymous usage statistics’ · ‘Send detailed usage statistics’ in Settings → Data on Mac, Settings → Anonymous Usage Statistics on Windows, or Settings → Privacy on Android · iPhone · iPad. Turning off the first turns off the second too.
• Detailed usage statistics — ‘Delete my usage records’ on the same screen deletes the person-level raw data at once (other devices with the same statistics user number too). Totals without numbers can't identify anyone and remain. After deleting the app, email the install number to contact@leanagilehungry.com.
• Delete statistics — Send the install number shown on the same screen to contact@leanagilehungry.com, and we'll delete the records collected under that number.
• Turn off · delete sync — In Settings → Sync, turn off sync on this device, or use ‘Delete Group’ to delete the encrypted copies on the server right away. The planners on your devices stay as they are.
• View · delete ideas and upvotes information — Confirm your email at spiralday.com/privacy/me (in Korean) to see what the Company holds and delete it right away. You can also ask by email (including when the confirmation email doesn't arrive). For email requests, we check that you own the address, then show or delete the same information.
• You can also request access to · correction · deletion · suspension of processing of your information the Company holds, including contact emails, at the same address.

7.Privacy officer

위관우 (Gwanu Wee, CEO) · contact@leanagilehungry.com

If you're not satisfied with the Company's answer, you can ask for help from Korea's Personal Information Infringement Report Center (privacy.kisa.or.kr, call 118 in Korea).

8.Children under 14

The apps have no accounts, so they don't ask your age. Ideas · upvotes on spiralday.com collect an email address, so only people aged 14 or over can use them. If we learn that information was entered by a child under 14, we delete it right away.

9.Security measures

• Email addresses aren't stored; only hashes made with a key only the Company holds (AWS KMS — the key never leaves it) are kept.
• Publishing ideas and handling deletion requests is done by the CEO through a role protected by two-factor authentication (MFA).
• The ideas-board database and keys are locked so that only specified server functions and the CEO can use them.
• All connections are encrypted (HTTPS). Server logs don't keep users' email addresses · IP addresses · cookie values.
• Moderation records (publish · hide · delete actions, viewing the original) are kept for 3 years (without personal information), and administrator access records for 2 years.

10.How it's destroyed

• Procedure: when the retention period ends, the information is no longer used and is deleted within a day. If you ask for deletion, it's deleted right away.
• Method: information in the database is deleted so it can't be recovered (AWS DynamoDB item deletion). Nothing is printed on paper.
• Backups: deleted information remains for 35 days in the database backups kept for incidents, then disappears automatically. If a restore from backup happens during that time, deletion requests from that period are applied again after the restore. For this, only the email hash and date of those who deleted are kept for 36 days.

11.Automatic collection (cookies)

The sign-in cookie and browser storage used by the spiralday.com ideas board are described in 1-g above.

12.Changes

If this policy changes, we'll let you know on this page and in the app release notes · store update descriptions. The previous policy is kept as the October 28, 2026 version, and earlier ones as the October 24, 2026 · October 14, 2026 · October 12, 2026 · October 10, 2026 versions (in Korean). If you need an even earlier version, please ask at contact@leanagilehungry.com.