This is a translation. If there is any difference, the Korean version prevails. Privacy Policy ======================================== Service: Danyeon Map · Effective date: October 15, 2026 Atomo Studio (the “Company”) complies with the Personal Information Protection Act (Republic of Korea) and other applicable laws, and handles users’ personal information with care. This Policy applies to the mobile application “Danyeon Map” (the “Service”) provided by the Company. 1. Personal Information Collected and Methods of Collection ------------------------------ - Category | Items | When collected - Account | Email address, nickname, password (stored encrypted), whether the user is aged 14 or older | At sign-up - Social login | Identifier, email and nickname provided by the linked service (Google, Apple, Kakao, Naver) | At social login - Profile (optional) | Profile photo and cover photo, bio, link | When the user sets up their profile - Record content | Photos and videos registered by the user, place name, location (latitude/longitude) and address, visit date, rating, memos and tags | When creating a record — ratings are shown to other users only as an anonymous average, and only for public places (shops chosen from search) (see Section 2 below) - Location information | Current location of the device (to set the place of a record, recommend and search nearby places, display the map, view “Near me” posts in Community, and set “Home”) | When using these features (if permission is granted) - “Home” (optional) | The location (center coordinates) the user sets as “Home” and the surrounding radius | If the user sets “Home” — used only to hide records around the home in share links, shared maps and Community - Health app records (optional) | Step count, distance traveled, workout records (time, distance and route of runs, walks and hikes), calories burned that are read together with workouts on Android | If the user allows the connection to Apple Health or Health Connect — read only on the device and never transmitted to or stored on the Company’s servers (see Section 10 below) - Badge summary | Number of neighborhood badges, area codes of recent badges (up to 4) | Calculated automatically by the app from the signed-in user’s own map records and stored — calculated only from photo records, excluding the user’s “Home” neighborhood and badges from the last 7 days - Payment | Subscription status, product and transaction identifiers (payment method information is processed by Apple/Google and is not stored by the Company) | At subscription payment - Gallery sync | Capture location (EXIF), capture time and file identifiers of photos and videos in the device gallery | When running “Bring memories” (if permission is granted) - Advertising | Android advertising ID (GAID), device and app information, ad impression and click information (collected automatically by the Google AdMob SDK). On iOS, the app does not ask for tracking permission, so the advertising identifier (IDFA) is not used | When ads are shown during free use - Reports and inquiries | The content of reports and inquiries sent by the user | When sending a report or inquiry - Automatically collected | Device and app version, access logs, error diagnostic information, app usage step records (with a random identifier the app creates at installation, app language, device region setting and installation date, linked to the account while signed in — no photos, location, place names or advertising identifiers) | When using the Service ※ Photo analysis for gallery sync (checking location and time, selecting representative photos) takes place only on the user’s device, and only the photos and videos the user chooses to “Keep” are uploaded to the Company’s storage (Cloudflare R2). Photos that are not chosen are not transmitted to the server. To find place names, the capture location coordinates may be looked up on the Company’s server; the coordinates used for this lookup are not stored. ※ If a subscription is purchased without signing up, an anonymous account for keeping the receipt (no email, password or personal information) is created after payment is completed. If an email is linked later, the same account continues. ※ Records, photos and videos left while using the app without signing up (as a guest) are stored only on the user’s device and are not transmitted to the Company’s servers. However, some features such as place search may process the information they need (search terms, location coordinates, and access information such as the IP address), and when ads are shown, the Google AdMob SDK may collect device and ad information (including the advertising ID on Android). Upon sign-up, guest records are moved to the user’s account. 2. Purposes of Using Personal Information ------------------------------ • Member identification and authentication, provision of membership services and account management • Storing, displaying and sharing records of places, photos and videos registered by the user (shared maps, Community) • Showing on shop cards the average of the ratings other users left (anonymously, one vote per person using their most recent rating, only when 3 or more people rated — before that, only the number of raters) and the photos and one-line text of posts made public in Community (to signed-in users, under the same rules as the feed) — public places only; unnamed places, places picked on the map and “Home” records are excluded • Using the current location to set the place of a record, recommend and search nearby places, display the map, view “Near me” posts in Community, and set “Home” and hide records around it • Displaying profiles — nickname, profile photo, bio, link and the badge summary (calculated only from photo records, excluding the “Home” neighborhood and badges from the last 7 days; “Show badges on my profile” is on by default, and when it is turned off, the summary is not shown to other users) • Processing subscription payments and providing features according to the plan • Showing ads to free users (no ads are shown with a subscription) • Providing AI assistance features (see entrustment of processing to third parties below) — menu name estimation for food photos, automatic labels for photo search (place and mood tags), safety checks of photos and Community posts that are made visible to other users (blocking inappropriate or harmful content) • Translating public posts (one-line text and place names) so they can be shown to users of other languages, and translating text at the user’s request • Using health app records to show, on the device, steps and runs in the Diary, the Run log and neighborhood badges • Handling reports and inquiries • Improving service quality (statistics on the steps where people stop using the app), diagnosing errors and preventing fraudulent use 3. Retention and Use Period of Personal Information ------------------------------ • Upon membership withdrawal, the login account, records, posts, shared map memberships and the like are deleted immediately, and photo and video files and profile photos are erased from storage within a few minutes. Shared maps the user created pass to the remaining member who joined first; records that former members left in a map that is deleted because no members remain are moved to that person’s “My map”. • Records and media deleted by the user are removed from storage when deletion is requested. • Among anonymous accounts created without sign-up, those that have had no subscription or records at all for 30 days are deleted automatically. • App usage step records are deleted automatically after 180 days (upon withdrawal, their link to the account is removed immediately). • Payment records: upon withdrawal, subscription information and receipts are deleted together with the account. However, as records of payment and supply of goods under the Act on the Consumer Protection in Electronic Commerce, etc. (Republic of Korea), only the purchase type (subscription, points, memory keeping), store, product ID, plan, store transaction (order) number, purchase date, expiry date and payment environment are kept separately for 5 years without being linked to the user’s account (no user ID and no receipt text) and are then deleted automatically. These records are handled only on the server and cannot be viewed by anyone in the app; in a dispute, they are looked up by the store order number the user provides. Subscriptions are separate from withdrawal and must be canceled directly in the App Store or Google Play. 4. Provision of Personal Information to Third Parties and Entrustment of Processing ------------------------------ To provide the Service, the Company entrusts the processing of personal information to, or links with, the companies below. - Entrusted / linked company | Processing details | Notes - Supabase (AWS, Seoul region) | Member authentication, database storage (account and record metadata) | Region in Korea - Cloudflare R2 | Storage of photo and video files registered by users | Media storage - Anthropic (Claude API) | AI assistance features: menu name estimation for food photos, automatic labels for photo search, safety checks of photos and Community posts made visible to other users (blocking inappropriate content). Photo thumbnails and text are used only temporarily for the relevant processing purpose and are not used for AI training | Processed overseas - Google (Cloud Translation) | Translation of the one-line text and place names of public posts into other languages (Korean, English, Japanese), and translation of text when the user taps translate. Translation results are kept so that the same sentence is not translated again | Processed overseas - Google AdMob | Showing in-app ads (using the Android advertising ID and device information; on iOS the app does not ask for tracking permission). Android users can limit the use of the advertising ID by opting out of Ads Personalization or deleting the advertising ID in the device settings | Processed overseas - Google (Maps/Places) | Map display and place search for areas outside Korea | Processed overseas - OpenStreetMap Foundation, FOSSGIS e.V. | Place search outside Korea when Google search is unavailable (Nominatim), finding nearby shops (Overpass), and map images on shared-link web pages | Processed overseas - Naver | Map display and place search in Korea, Naver login (if the user chooses it) | Processed in Korea - Kakao | Kakao login (if the user chooses it) | Processed in Korea - Apple, Google | Processing of in-app subscription payments, Apple and Google login (if the user chooses it) | Payment method information is held by each company The Company does not provide users’ personal information to third parties for purposes other than the above. Exceptions are made only where there is a legal basis or with the user’s consent. 5. Overseas Transfer of Personal Information ------------------------------ The Company transfers personal information to the overseas companies among those in Section 4 above as follows. Transfers are made by sending the data over encrypted communication (HTTPS) when the user uses the relevant feature. - Recipient (country) | Items transferred | When transferred | Purpose of use | Retention and use period - Cloudflare, Inc. (USA) | Photo and video files registered by the user (including thumbnails), profile and cover photos | When saving records or posts that contain photos or videos, keeping memories, or uploading a profile photo | Storage of media files | Until the user’s deletion request or membership withdrawal (Section 3 above) - Anthropic, PBC (USA) | Photo thumbnails, text of Community posts | When an AI assistance feature runs | The AI assistance features in Section 2 above | Used only temporarily for the relevant processing - Google LLC (USA) — Cloud Translation | One-line text and place names of public posts, text the user taps to translate | When a public post is published or the user taps translate | Translation | Until the purpose of processing is achieved - Google LLC (USA) — AdMob | Android advertising ID, device and app information, ad impression and click information | When ads are shown during free use | Showing ads | According to Google’s policies - Google LLC (USA) — Maps/Places | Map view request information, place search terms and the reference location of the search | When using maps or place search for areas outside Korea | Map display and place search | Until the purpose of processing is achieved - OpenStreetMap Foundation (UK) — Nominatim and map images | Place search terms, the reference location of the search (about 3 km around the centre of the visible map), the location used to find the city name for a travel card (the location of a photo taken outside Korea, coarsened to about 1 km), and map image requests from people who open a shared-link web page | When searching for places outside Korea while Google search is unavailable, when making a travel card from a photo taken outside Korea, and when a shared-link web page is opened | Place search and map display | According to each organisation’s policies - FOSSGIS e.V. (Germany) — Overpass API | The reference location of the search (the visible map area) | When finding nearby shops outside Korea while Google search is unavailable | Finding nearby shops | According to each organisation’s policies - Apple Inc. (USA), Google LLC (USA) | Subscription receipts and transaction identifiers | When paying for a subscription or checking its status | Payment processing and subscription verification | According to each company’s policies ※ The database that holds member information and records (Supabase Inc., USA) is stored in the Republic of Korea (AWS Seoul region). ※ Users who do not want their personal information transferred overseas may request this via the contact in Section 11 below or not use the relevant feature; in that case, the feature cannot be used. The use of the Android advertising ID can be limited as described in Section 4 above. 6. Device Permissions ------------------------------ All of the permissions below are optional; even without them, the Service can be used except for the features that need them. Permissions can be changed at any time in the device settings. - Permission | Used for | If not allowed - Location | Setting the place of a record, recommending nearby places, showing the current location on the map, Community “Near me”, setting “Home” — only while the app is in use (no background location tracking) | Records can still be created by searching or choosing on the map - Camera | Taking photos and videos in the app | Records can still be created by choosing from the gallery - Microphone | Recording sound when shooting videos | Sound cannot be recorded - Photos (gallery) | Choosing photos and videos for records, “Bring memories” (reading the capture location and time of photos), saving photos and videos taken in the app to the Photos app | Photos and videos cannot be chosen and memories cannot be brought in - Notifications | “On this day” morning notifications (scheduled on the device), backup progress display on Android | No notifications are received - Health (Apple Health / Health Connect) | Reading steps and workout records (see Section 10 below) | Steps and workouts are not shown in the Diary or on the Running screen 7. Users’ Rights and How to Exercise Them ------------------------------ • Users may view and modify their personal information at any time, and may request its deletion by withdrawing membership in the in-app settings. • Inquiries regarding personal information can be made to the contact below. 8. Measures to Ensure the Security of Personal Information ------------------------------ • Encrypted storage of authentication information such as passwords, and encryption in transit (HTTPS) • Minimization of access rights and access control 9. Personal Information of Children ------------------------------ The Service is intended for users aged 14 or older, and this is confirmed at sign-up. 10. Handling of Health App Records ------------------------------ • Connecting is optional. The app accesses step count, distance traveled and workout records (and, on Android, calories burned that are read together with workouts) in Apple Health (HealthKit) or Health Connect only if the user allows it, and it only reads them; it does not write any records to the health app. • The records read are used only on the user’s device to show the Diary, the Run log and neighborhood badges, and are never transmitted to or stored on the Company’s servers. They are not used for advertising or marketing purposes and are not provided to third parties. • Graphics that the user personally adds to a diary entry or a Run card (step count, workout route and distance) are stored as record content registered by the user. In doing so, the start and end of a route and the parts around the user’s “Home” are erased from the graphic. • If the user taps “Disconnect” in the settings of the app’s Running screen, the app stops reading the records and also deletes derived information kept on the device (neighborhoods run in, “New roads” calculation results). The permission itself can be turned off in iPhone Settings (Health → Data Access & Devices) or in the Health Connect app. 11. Personal Information Protection Officer and Contact ------------------------------ • Operator: Atomo Studio • Personal Information Protection Officer: Lee Kyung-ryul (Representative) • Phone: +82-507-1368-3633 • Contact email: atomo_studio@naver.com • Address: 202, 27-35, Baekjegobun-ro 19-gil, Songpa-gu, Seoul, Republic of Korea • In-app contact: Manage › Report / Contact 12. Changes to This Policy ------------------------------ This Policy may be revised in line with changes in laws or the Service, and any revision will be announced through an in-app notice or on this page. Addendum: This Policy takes effect on October 15, 2026 (items on health app records, badge summary, profile, “Home”, and reports and inquiries; shop rating averages; translation entrustment; overseas transfer; device permissions; guest use; and app usage step records added; the account deletion and advertising identifier wording corrected; the cleanup of long-term inactive accounts removed; and contact details changed). (Previous policy: revised September 6, 2026; effective July 18, 2026)