Retic Privacy Policy
Retic (“we”, “us”, or “our”) operates the Retic web app (app.retic.io), the Retic Android app, and the website (retic.io) (together, the “Service”). We comply with the Personal Information Protection Act of Korea and other applicable laws. This policy explains what personal information we collect and why, how long we keep it, who processes it on our behalf, and how you can exercise your rights.
1. Information We Collect
We only collect what the Service needs. We never receive or store your password or card number ourselves.
| Category | Information | How and when | Required? |
|---|---|---|---|
| Account | Name, email address, profile photo URL, and Google account identifier from your Google account | Received from Google when you sign up or sign in with Google | Required (if you sign in) |
| Profile | Nickname | Entered by you when you finish signing up | Required (if you sign in) |
| App data | Goals, habits, tasks and their sub-items (titles, notes, categories), habit completion history, per-item reminder times, and other content you create | Entered by you while using the Service. When signed in, stored on our servers to sync across devices; as a guest, stored only on your device | Required (to provide the Service) |
| Public posts | Trails (goal trees) you publish (title, description, items), your agreement to the posting rules, and reports you file | When you publish a trail or file a report | Optional |
| Feedback | Feedback you send and its category, plus the screen, app version, and language at the time | When you send feedback in the app | Optional |
| Consent records | Whether you agreed to the Terms and this Privacy Policy, the document version, and the time | When you finish signing up | Required (if you sign in) |
| Notification settings | Whether notifications are on, delivery time and days, time zone, whether you also get them as device notifications (browser, Android app), and the date the last daily briefing was sent | When you set up notifications | Optional |
| Notification history | Title and content of notifications collected in the in-app notification center (for example, your daily briefing summary), when you got them, and whether you’ve read them | Recorded automatically each time a daily briefing is sent, if you’ve turned it on | Optional |
| Device push data | Browser push subscription (push service endpoint and encryption keys), Android app push token (Firebase Cloud Messaging), a device label (e.g., “Chrome · Windows”), and the number of recent device registration attempts (to prevent abuse) | When you turn on push notifications in a browser or the app | Optional |
| App access records | That you used the Android app, the app version, and the times you first and last opened the app | Recorded automatically when you open the Android app while signed in (updated about once a day). Not recorded in the web app | Automatic (if you sign in to the app) |
| Payment information | Subscription status, plan, billing period, payment processor customer and subscription IDs (Paddle), and Google Play purchase token and order ID | Received from the payment processor when you subscribe, renew, or cancel | Required for paid plans |
| Error diagnostics | Error details and location, app version, runtime (web or Android app), browser and OS type | Collected automatically when an error occurs. Email addresses, IP addresses, and app data contents are not sent | Automatic |
| Usage analytics | Page/screen views and feature usage, browser and device type, approximate location, cookie identifiers, Android app identifier (Firebase app instance ID) | Collected only if you accept analytics in the cookie consent banner (in the Android app, the first-launch prompt or Settings) (Google Analytics; Firebase Analytics in the Android app) | Optional (with consent) |
| Advertising data | Advertising ID (Android advertising ID), your ad consent choices, ad impressions and clicks, device information, and approximate location | Collected by Google AdMob when we show ads to free users of the Android app (see Section 8) | Automatic for free app users |
| Access logs | IP address, access time, browser and device information | Recorded automatically by our server and network providers when you access the Service | Automatic |
2. How We Use Information
- Accounts and core Service: Sign-in, identity verification, syncing data across devices, and account recovery and deletion.
- Public features: Publishing and copying (adopting) trails, and handling reports of posting-rule violations.
- Notifications: Delivering the daily briefing and habit reminders you turn on, through the in-app notification center, browser push, or Android app push. We don’t send the daily briefing by email.
- Paid plans: Processing subscription payments, renewals, cancellations, and refunds, providing Pro features, and handling payment disputes.
- Stability and improvement: Finding and fixing errors, improving features based on usage analytics, and preventing abuse.
- Advertising: Showing ads to free users of the Android app, measuring ad performance, and preventing ad fraud.
- Tailoring app install prompts: When the web app suggests installing the Android app, we hide the suggestion from users who opened the app within the last 30 days. The app version helps us decide when to stop supporting old versions.
- Support: Answering inquiries and feedback, and announcing changes to the Service.
3. Retention and Deletion
We delete personal information without delay when you delete your account or when the purpose of collection has been fulfilled, except where the law requires us to keep it.
| Information | Retention |
|---|---|
| Account information, nickname, app data, consent records, notification settings, device push data, app access records, feedback, published trails, reports | Until you delete your account; deleted immediately on account deletion |
| Device push data | Also deleted when you turn off notifications or unsubscribe the device from push |
| Date of the last daily briefing sent, number of device registration attempts | Used only to prevent duplicate sends and abuse; deleted automatically after about two days |
| Notification history | Deleted automatically, oldest first, after 30 days or once you have more than 100; deleted immediately on account deletion |
| Contract and payment records (subscription status, billing periods, etc.) | 5 years under the Korean Act on Consumer Protection in Electronic Commerce. On account deletion, the records are unlinked from your account so they can no longer identify you, kept separately, and destroyed when the period ends |
| Consumer complaint and dispute records | 3 years under the same Act |
| Error diagnostics | Deleted automatically when Sentry’s retention period ends |
| Usage analytics | Up to 14 months, per our Google Analytics data retention setting |
| Advertising data | We do not store your advertising ID. Google retains advertising data under its own privacy policy |
- How we delete: Electronic files are erased so they cannot be recovered; paper documents are shredded.
- Copies of feedback that our team receives in an internal notification channel (Discord) carry only a masked identifier that does not reveal your account. We will delete these copies on request.
- Trails that other users have already copied are their data and are not deleted with your account.
- See Account Deletion for how to delete your account and what is deleted or retained.
4. Processors and Third Parties
We engage the providers below to process personal information for us. They use it only for the tasks we give them, and we check through contracts and their safeguards that it is handled securely.
| Recipient | Task | Information processed |
|---|---|---|
| Supabase, Inc. | Database, sign-in, and server functions (data storage) | Account information, nickname, app data, public posts, feedback, consent records, notification settings, notification history, device push data, app access records, payment information, access logs |
| Cloudflare, Inc. | Hosting and delivery (CDN) for the web app and website | Access logs |
| Paddle.com Market Limited | Web payment processing (Merchant of Record) | Email address, payment information, payment processor customer ID |
| Google LLC (Google Play Billing) | Android app subscription payments | Google Play purchase token and order ID, subscription status |
| Google LLC (Google Sign-In) | Sign-in authentication | Google account information |
| Google LLC (Firebase Cloud Messaging) | Android app push delivery | App push token, notification content |
| Browser push services (Google, Mozilla, Apple, etc.) | Browser push delivery | Browser push subscription, notification content |
| Resend, Inc. | Sign-up verification and password reset emails | Email address, verification email content |
| Functional Software, Inc. (Sentry) | Error diagnostics | Error diagnostics |
| Discord Inc. | Internal team notifications (new feedback alerts) | Feedback content, masked account identifier |
| Google LLC (Google Analytics, Firebase Analytics) | Usage analytics (only with consent) | Usage analytics |
| Google LLC (Google AdMob) | Ads for free users of the Android app | Advertising data |
- Paddle, as the seller (Merchant of Record) for web payments, and Google Play, as the seller for Android app payments, collect payment details directly and process them under their own privacy policies. We only receive payment results and subscription status.
- Google AdMob collects advertising data such as the advertising ID directly to serve and measure ads, and Google may also use it for its own purposes (such as improving ads), so this is a disclosure to a third party. See How Google uses information from sites or apps that use its services.
- Apart from the cases above and requests required by law, we do not share your personal information with third parties without your consent.
5. International Transfers
The providers above operate servers outside Korea, so your personal information is transferred abroad. Transfers happen over the network as you use the Service, and retention periods follow Section 3.
| Recipient | Country | Information | Purpose |
|---|---|---|---|
| Supabase, Inc. | Singapore (database region) | Information Supabase processes (Section 4) | Data storage, sign-in |
| Cloudflare, Inc. | United States and global edge locations | Access logs | Hosting, delivery |
| Paddle.com Market Limited | United Kingdom and others | Email address, payment information | Web payments |
| Google LLC | United States and others | Google account information, Play payment information, app push token, usage analytics, advertising data | Sign-in, payments, push, analytics, ads |
| Resend, Inc. | United States | Email address, verification email content | Verification emails |
| Functional Software, Inc. (Sentry) | United States | Error diagnostics | Error diagnostics |
| Discord Inc. | United States | Feedback content, masked account identifier | Team notifications |
- If you do not want your information transferred abroad, you can use Retic as a guest without an account (your data stays on your device), but features that rely on these providers — sign-in, sync, and payments — will not be available. You can refuse usage analytics through the cookie consent banner (in the Android app, the first-launch prompt or “Share usage statistics” in Settings), and refuse or limit advertising data as described in Section 8.
6. Cookies and Usage Analytics
We use cookies and similar storage technologies (such as local storage) on the website, web app, and Android app to analyze usage and to measure ad performance (Google Ads conversions) on the website.
- Only with consent: Non-essential tracking, such as usage analytics (Google Analytics) and ad conversion measurement, is turned on only if you accept it in the cookie consent banner. In the Android app, usage analytics (Firebase Analytics) is turned on only if you allow it in the first-launch prompt, at sign-up, or in Settings.
- Withdrawing consent: You can withdraw or change your consent at any time using the “Cookie Settings” button on screen, or delete stored data through your browser’s cookie and site data settings. In the Android app, turning off Settings > Share usage statistics stops collection right away.
- Storage that the Service needs to work — keeping you signed in, language and display settings, and guest data — is used regardless of consent.
7. Information That Is Public
- Your nickname is the display name other users see. We never show the real name from your Google account.
- If you publish a trail, anyone can view it and other users can copy (adopt) it into their own tree. It disappears from public listings when you unpublish it or delete your account.
8. Advertising and How to Opt Out of Personalized Ads
- Where ads appear: Ads are shown only to free users of the Android app, as a banner at the bottom of the screen. There are no ads for Pro users or in the web app and website. We do not use full-screen ads right after you check off a habit or complete a task.
- Advertising ID: The app uses the Android advertising ID to serve and measure ads; it is collected and processed by Google AdMob. We do not store the advertising ID ourselves.
- Consent (EEA, UK, and similar regions): Where the law requires consent, we ask for consent to personalized ads through Google’s consent message (User Messaging Platform, UMP) before requesting any ads. If you do not consent, only non-personalized ads are shown. You can change your choice at any time in the app under Settings > Support > Ad privacy settings.
- Turning off personalized ads (all regions): Delete or reset your advertising ID in your device’s Settings > Google > Ads (on some devices, Settings > Privacy > Ads) to stop receiving personalized ads. To see no ads at all, you can upgrade to Pro.
- We do not give advertising providers your email address, nickname, or app data.
9. Children Under 14
The Service is intended for users aged 14 and older, and children under 14 may not create an account. If we learn that a child under 14 has signed up, we will delete the account and its personal information without delay.
10. Your Rights
- You may access, correct, or delete your personal information, ask us to stop processing it, or withdraw your consent at any time.
- Account deletion: You can delete your account yourself under Settings > Account in the app. If you cannot access the app, email [email protected] from the address you signed up with. See Account Deletion for details.
- For any other request, email [email protected]. We will handle it without delay after verifying your identity.
11. Security Measures
- All traffic is encrypted (HTTPS/TLS), and row-level access control in our database lets each user reach only their own data.
- Server functions run with database accounts that have only the permissions they need, and administrative keys are never shipped to browsers or the app.
- Error diagnostics never include email addresses, IP addresses, or the contents of your app data.
12. Your Rights Under the GDPR (EEA / UK Users)
If you are in the European Economic Area (EEA) or the United Kingdom, the General Data Protection Regulation (GDPR) gives you the following rights:
- Legal bases: Performance of our contract with you (providing the Service), your consent (usage analytics, personalized ads, and optional features), and our legitimate interests in securing and improving the Service.
- Your rights: Access, rectification, erasure, restriction, objection, data portability, and withdrawal of consent.
- International transfers: When data leaves the EEA/UK, we rely on appropriate safeguards such as Standard Contractual Clauses.
- Complaints: You may lodge a complaint with your local data protection supervisory authority.
13. Privacy Officer and Contact
We have designated a privacy officer to handle privacy questions and complaints.
- Privacy officer: 최윤혁 (Representative)
- Email: [email protected]
Addendum
- This policy takes effect on October 20, 2026.
- Reason for revision (announced October 12, 2026): We corrected the list of information we actually collect (Google sign-in data, nickname, public trails, feedback, notification and push data, Android app access records, Google Play payments, error diagnostics, and usage analytics), and added ads for free users of the Android app (Google AdMob), collection of the advertising ID, how to opt out of personalized ads, the list of processors and international transfers, and the restriction on sign-ups by children under 14. We also now deliver the daily briefing through the in-app notification center instead of email, so we added how we collect and keep notification history, and corrected Resend’s role to sending verification emails. We also added that the Android app collects usage analytics through Firebase Analytics only with your consent, and the app identifier it uses.