KALIBREKalibre Privacy Policy
opus89, a sole proprietorship (the "Operator"), protects the personal information of users of the mobile application "Kalibre" and the website kalibre.cc (together, the "Service") in accordance with the Personal Information Protection Act of the Republic of Korea and other applicable law, and publishes this policy under Article 30 of that Act.
At a glance
| Data collected | Social account details such as email and name; content you create such as AI chats, bookmarks and watchlist; access logs and device information (Section 1) |
|---|---|
| Purposes | Identifying members, providing the Service, generating AI answers, settling credits and payments, preventing abuse, statistics (Section 2) |
| Sharing with third parties | None (Section 4) |
| Processors and cross-border transfer | Eight U.S. companies: Supabase, OpenAI, Perplexity, Google, Apple, Expo, RevenueCat, Cloudflare (Section 5) |
| Your rights | Access, correction, deletion, suspension and withdrawal of consent — in the app or by email, handled within 10 days (Section 7) |
| Contact | Privacy officer, [email protected] (Section 12) |
Section 1. Personal information collected and how
The Operator collects only the minimum information needed to provide the Service, and only the items listed below.
A. At sign-up (social login)
Kalibre has no sign-up form of its own; you sign up with a social account only. At sign-up the following is received from the account provider.
| Type | Items | Required |
|---|---|---|
| Google sign-in | Email address, name and profile picture (to the extent the account provides them), Google account identifier | Required |
| Apple sign-in | Email address (or the private relay address issued by Apple), name, Apple account identifier | Required |
| Consent record | Time of consent to the Terms and this Policy, document version consented to, language at the time of consent | Required (recorded automatically) |
B. Generated or collected while using the Service
| Type | Items |
|---|---|
| Content you create | AI chat content (questions and answers), news bookmarks, watchlist, keyword alert settings, calendar reminders, report bookmarks and reactions, tickers for which you requested a deep-dive report, and the request, viewpoint, plan, results and check records of research you delegate |
| Settings and status | App language, notification mute settings, referral code and referral count, tier and subscription status |
| Usage records | Credit grants and deductions, promo and referral code usage, AI usage records (model used, token count, cost), login times, app launch records (for daily usage aggregates) |
| Access logs | IP address, access time |
| Device information | Install identifier generated by the app, device identifier provided by the operating system (Android SSAID, iOS vendor identifier), device model, OS version, app version |
| Login session information | Per-session IP address and app/browser information recorded by the authentication service (Supabase Auth) to maintain the session |
| Notifications (if allowed) | Push notification token, notification delivery records |
| Payments (for paid use) | Transaction identifier issued by the app store, product purchased, payment, renewal and cancellation results (payment-method details such as card numbers are held by the store and are never received by the Operator) |
C. Guests who are not signed in
Guests who are not signed in are automatically given an anonymous session identifier so they can read content. An anonymous session is not linked to identity information such as an email address; however, to prevent abuse and keep access logs, the access logs, device information and app launch records in the table above are also collected for anonymous sessions. Anonymous sessions unused for 90 days are deleted automatically.
D. How it is collected
- Received from the account provider (Google or Apple) at social sign-in
- Entered or saved by you in the app (AI questions, bookmarks, alert settings, etc.)
- Generated automatically while using the Service (access logs, device information, usage records)
- Received from the app store and the payment verification service (payment results)
- Sent by you when contacting us by email ([email protected])
E. Not collected
The Operator does not collect advertising identifiers (IDFA/AAID), location, contacts or address book, photos or other on-device files, resident registration numbers or other unique identifiers, or sensitive information, and does not use third-party advertising or analytics SDKs. The feature that adds calendar reminders to your device calendar works only on the device when you allow it; the Operator does not read or transmit the contents of your device calendar.
Section 2. Purposes of processing
The Operator processes personal information only for the purposes below. If a purpose changes, the Operator will obtain separate consent or take other required measures under Article 18 of the Act.
| Purpose | Items used |
|---|---|
| Identifying members, keeping you signed in, verifying identity | Social account details, login session information, consent record |
| Providing the Service (syncing bookmarks, watchlist, alerts, reminders, reports) | Content you create, settings and status, push notification token |
| Generating AI answers, reports and research results | Questions and chats you enter, the request, viewpoint and plan of delegated research |
| Granting and deducting credits, managing paid subscription status, handling payment disputes | Credit records, AI usage records, payment information, tier and subscription status |
| Preventing abuse (multiple accounts, code abuse, repeated deletion and re-registration, etc.) | Access logs, device information, code usage records, deleted-account records |
| Sending push notifications (if allowed) | Push notification token, keyword alert settings, app language |
| Service usage statistics (in aggregate form, such as daily active users) and improvement | App launch records, AI usage records |
| Responding to inquiries and complaints | Contents of your email, information needed to identify your account |
| Complying with legal obligations and handling disputes | Records the law requires us to keep (Section 3) |
Section 3. Retention and use period
As a rule, personal information is destroyed without delay when you delete your account. Even before deletion, records older than the periods below are destroyed automatically, and records the law requires us to keep are stored separately after deletion for the periods below.
| Item | Period | Basis |
|---|---|---|
| Social account details, content you create, settings and status, consent record | Until account deletion | Providing the member service (performance of contract) |
| AI chat content | Destroyed automatically 180 days after last use | Internal policy (clearing long-unused chats) |
| Request, plan, results and check records of delegated research | Destroyed automatically 180 days after the research ends (unconfirmed plans: 180 days from creation) | Internal policy (clearing finished research) |
| App launch records | 180 days | Internal policy (once the statistical purpose is met) |
| AI usage records (model, tokens, cost) | 12 months | Internal policy (cost settlement, abuse response) |
| Access logs (IP address, access time, device information) | 3 months (records flagged for abuse: 1 year) | Protection of Communications Secrets Act / internal policy (preventing recurrence) |
| Login session information | Destroyed at sign-out or session expiry | Operation of the authentication service |
| Push notification token / delivery records | Token: 180 days after last use / delivery records: 30 days (keyword alert delivery records: 7 days) | Internal policy (preventing duplicate delivery) |
| Anonymous (guest) sessions | Deleted automatically after 90 days without use | Internal policy |
| Deleted-account record (hash of email, sign-in provider, hash of the provider account identifier, total credits granted and used, tier, sign-up date) | 1 year after deletion | Internal policy (preventing duplicate free credits through repeated deletion and re-registration; identity verification for inquiries) |
| Operator action records (admin actions such as credit adjustments and tier changes) | 3 years | Internal policy (operational audit, dispute handling) |
| Payment and subscription records (transaction identifier, product, payment, renewal and cancellation results) | 5 years | Article 6 of the Act on Consumer Protection in Electronic Commerce (records of contracts, withdrawal and payment) |
| Consumer complaint and dispute records | 3 years | Article 6 of the same Act |
Section 4. Provision to third parties
The Operator does not sell or provide personal information to third parties. The only exceptions are lawful requests based on statute and the cases set out in Articles 17 and 18 of the Act, in which event the Operator will inform you where possible. Entrusting work to external vendors (processing on our behalf) is described separately in Section 5.
Section 5. Processors and cross-border transfer
The Operator entrusts the processing of personal information to the vendors below in order to provide the Service. All processors are U.S. companies, so personal information is transferred to and processed outside Korea. Transfers take place over encrypted network connections at the time you use the Service.
| Processor (country) | Entrusted work | Items transferred | When | Retention |
|---|---|---|---|---|
| Supabase, Inc. (U.S.) | Database, authentication and server function hosting (data stored in the AWS Seoul region, Republic of Korea; API traffic routed via Cloudflare) | All items in Section 1 | Continuously while using the Service | Until the processing agreement ends |
| OpenAI, L.L.C. (U.S.) | Generating AI answers, reports and research plans | Questions and chat content you enter, the request and viewpoint of delegated research (for planning and evaluation) | When using AI features | Until processing completes (requests are sent with response storage turned off) |
| Perplexity AI, Inc. (U.S.) | Search and answer generation for AI answers and deep research | Questions you enter, the topic of delegated research | When using AI features | Until processing completes |
| Google LLC (U.S.) | Google sign-in authentication, backup storage (Google Drive), receiving inquiry email (Google Workspace) | Account identification details / encrypted database backups / inquiry contents | At sign-in / daily / when you contact us | Until the processing agreement ends (backups: 180 days) |
| Apple Inc. (U.S.) | Apple sign-in authentication | Account identification details | At sign-in | Until the processing agreement ends |
| 650 Industries, Inc. (Expo) (U.S.) | Push notification delivery | Push notification token, notification content | When a notification is sent | Until processing completes |
| RevenueCat, Inc. (U.S.) | In-app purchase verification and subscription status management | In-app account identifier, store transaction identifier, product, payment result | At purchase or renewal | Until the processing agreement ends |
| Cloudflare, Inc. (U.S.) | Hosting and delivery of the website (kalibre.cc) | Website visitors' IP address, access time, requested URL | When visiting the website | Cloudflare's server log retention period |
- The AI processors (OpenAI, Perplexity) state that data sent through their APIs is not used to train their models, and the Operator sends OpenAI requests with response storage turned off.
- Contact details and privacy policies of each processor: Supabase · OpenAI · Perplexity · Google · Apple · Expo · RevenueCat · Cloudflare
- The Operator's agreements with processors prohibit processing beyond the entrusted purpose, require protective measures, restrict sub-processing and provide for liability, and the Operator supervises whether processors handle personal information safely.
- Refusing cross-border transfer: you may refuse the transfer of your personal information abroad by contacting us as set out in Section 12. Because the entire Service is delivered through the processors above, refusal will restrict sign-up and use of the Service.
Section 6. Destruction procedure and method
- Personal information whose retention period has passed or whose purpose has been achieved (for example, account deletion) is destroyed without delay. On account deletion, information linked to the account is deleted immediately with no grace period.
- Records that Section 3 says are kept after deletion are not destroyed but stored separately from other personal information, access for any purpose other than retention is blocked, and they are destroyed without delay once the period ends.
- Electronic files are deleted in a way that prevents recovery. No paper records are kept.
- Personal information contained in backups is destroyed in turn according to the backup retention cycle and is removed from backups within 180 days at most of destruction. Backups are used only for recovery.
- When a user who signed in with Apple deletes their account, the sign-in token issued by Apple is revoked at the same time.
Section 7. Rights of users and legal representatives and how to exercise them
- You may at any time request access to, correction, deletion or suspension of processing of your personal information and withdraw consent (delete your account).
- How to exercise your rights
- In the app: delete your account (full deletion) under Settings › Account; edit or delete chats, bookmarks, watchlist, alert settings and the like directly on each screen
- By email: [email protected] (sending from the email address of the social account you signed up with serves as identity verification)
- The Operator acts on a request and informs you of the result within 10 days of receiving it. Where a request cannot be fulfilled because the law requires retention or because it would infringe another person's rights, the Operator will explain the reason.
- On an access request, all information linked to your account is provided as an electronic file.
- Because the Operator does not collect personal information of children under 14, there is no separate procedure for legal representatives. If a user under 14 is found to have signed up, the account is handled under Section 11.
- You are responsible for keeping your personal information accurate and must not use another person's account or information.
Section 8. Automatic collection devices and how to refuse them
A. App
The Kalibre app uses no cookies or advertising identifiers. The install identifier generated by the app and the device identifier provided by the operating system are used only to prevent abuse and are not linked to advertising or other services. Deleting the app removes the install identifier, and the device identifier can be reset in each operating system's settings.
B. Website (kalibre.cc)
- The website uses no visitor analytics or advertising tracking tools.
- The language and theme you choose on the website are stored only in your browser (sessionStorage) and are not sent to the Operator's servers. They are cleared when the browser tab is closed.
- The website is delivered through Cloudflare, so visitors' IP address, access time and requested URL may be recorded in Cloudflare's server logs (Section 5).
- The Terms and Privacy Policy pages load fonts from Google Fonts (Google LLC) and jsDelivr (Prospect One), which sends the visitor's IP address to those servers. External font requests can be blocked with your browser's tracking-prevention settings or an ad-blocking extension.
Section 9. Automated decisions and data portability
- AI answers, reports and research results provided by Kalibre are reference information; Kalibre makes no automated decisions that have a significant effect on your rights or obligations (Article 37-2 of the Act). Tiers and credit grants are processed under published rules set by the Operator and do not evaluate individuals.
- The Operator is not a business subject to the data portability obligation (Article 35-2 of the Act). You may nevertheless receive your information as an electronic file through an access request under Section 7.
Section 10. Security measures
- Encryption in transit: all communication between the app or website and the server, and between the server and processors, is encrypted with TLS.
- Encryption at rest: database storage is protected by the cloud provider's managed encryption, and backup files are stored encrypted.
- Access control: the database enforces row-level security (RLS) so that you can access only your own data, and server functions can be called only with signed authentication tokens.
- On-device protection: login session information is stored encrypted in the device's secure storage (iOS Keychain / Android Keystore).
- Minimised and logged administrator access: the Operator's access to user data is limited to the minimum needed for customer support and security response, and viewing private chats and taking account actions are recorded in an audit log.
- Access log retention and review: access logs are kept for at least 3 months and abnormal access is reviewed.
- Minimum collection and automatic destruction: only the minimum information needed for the Service is collected, and records older than the periods in Section 3 are destroyed automatically.
- Internal management: the Operator maintains an internal management plan for personal information protection and periodically reviews processors' protective measures.
Section 11. Children under 14
The Operator does not collect personal information of children under 14. Users confirm that they are 14 or older during sign-up, and any account found to belong to a child under 14 is destroyed without delay.
Section 12. Privacy officer and department for complaints and access requests
The Operator designates the following privacy officer, who oversees the processing of personal information and handles user complaints and remedies. As the Operator is a one-person business, the privacy officer also personally receives access, correction and deletion requests and handles complaints.
- Organisation and title: Owner, opus89
- Name and phone number: to be finalised and announced before the effective date
- Email: [email protected]
- How to reach us: by email (also linked from Settings › Send feedback in the app)
Section 13. Remedies for infringement
You may report or seek advice on personal information infringement from the bodies below, including if you are not satisfied with how the Operator handled your request.
- Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
- Personal Information Infringement Report Center (KISA): 118 (privacy.kisa.or.kr)
- Supreme Prosecutors' Office: 1301 (www.spo.go.kr)
- Korean National Police Agency: 182 (ecrm.police.go.kr)
Section 14. Changes to this Policy
If this Policy is added to, deleted from or amended, the change will be announced in the Service or on this website at least 7 days before it takes effect (30 days for changes that are significant or unfavourable to users). Previous versions will remain available on this page as history.
Revision history
- 2026-10-14 — Draft 2: aligned with what is actually collected (added consent records, AI usage records, login session information and payment records; removed the discontinued "agent memories"), itemised purposes, expanded the retention table, added transfer timing, processor contacts and the right to refuse in the cross-border section, and added the website section, automated decisions, remedy bodies and revision history
- 2026-07 — Draft 1
Addendum: this Policy takes effect on the official effective date (to be announced).
← KALIBRE Home