1. 수집하는 개인정보 항목

① 회원가입 시(필수): 이메일 주소, 비밀번호, 닉네임, 만 14세 이상 여부 확인 결과와 확인 일시

② 가입 후 첫 설정 시: 생년월일, 성별

③ 프로필·설문 입력(선택): 신체 계측 정보(체중, 신장, 체지방률, 골격근량), 불편·주의 부위, 한 줄 소개, 목표·다짐 등 회원이 직접 작성한 문장

④ 서비스 이용 과정에서 생성·수집: 운동 기록(운동 종목·부위, 세트 및 반복 수, 중량, 운동 일시, 운동 볼륨, 회원이 작성한 운동 메모), 프로그램 구독·진행 내역, 성장 지표 및 보상 정보(경험치, 스파크, 티어, 연속일, 칭호), 알림 수신 설정 및 알림 토큰, 가입 일시

⑤ 커뮤니티 이용 시: 게시글 본문과 해시태그, 게시글에 첨부한 사진(글 1건당 최대 4장), 댓글, 응원, 팔로우 및 차단 목록, 신고 접수 내역, 공개 프로필(닉네임·성별·티어)

⑥ AI 코치(루디) 이용 시: 대화 내용, 대화 요약문, 분석 결과. 대화 원문은 회원의 기기에만 보관되며(최근 12개 대화·24시간 후 자동 삭제) 서버에 저장하지 않습니다. 다만 대화를 마칠 때 만들어지는 요약문(3~6줄)과 심층 분석 결과는 서버에 저장됩니다.

⑦ 결제 시: 결제한 상품 코드, 지급 수량, 거래 식별자, 결제 일시. 카드번호 등 결제수단 정보는 애플·구글이 결제 당사자로서 직접 처리하며 회사는 보관하지 않습니다.

⑧ 서비스 이용 시 자동 수집: 앱 이용 행동 정보(화면 조회·기능 사용 등), 기기 모델·운영체제·앱 버전, 분석용 식별자, 접속 국가(IP 기반 추정), 오류(크래시) 정보

⑨ 건강 앱 연동 시(선택 — 회원이 직접 연동을 켠 경우에 한함): Apple 건강(HealthKit) 및 Google 헬스 커넥트(Health Connect) 연동 데이터 — 체중, 체지방률, 운동 기록(운동 종류·운동 거리·운동 시간·활동 시간·소모 칼로리), 심박수. 운동을 마치면 운동 시간과 소모 칼로리를 회원의 건강 앱에 기록하며, 건강 앱에서 읽어 온 체중·체지방률·심박수·운동 기록 중 서비스에 필요한 값(체중·체지방률 기록, 운동 거리·강도 요약 등)을 서버에 저장합니다.

2. 개인정보의 처리 목적

수집한 개인정보는 회원 식별 및 인증, 운동 기록·성장 지표 등 서비스 제공, 커뮤니티 운영과 신고·차단 처리, AI 코치 기능 제공, 인앱결제 처리 및 부정 이용 방지, 서비스 이용 통계 분석 및 서비스 개선·신규 기능 개발, 고객 문의 응대, 동의에 기반한 알림 발송의 목적으로만 이용됩니다.

3. 개인정보의 보유 및 이용 기간

회사는 회원 탈퇴 시까지 개인정보를 보유하며, 회원이 계정을 삭제(탈퇴)하는 경우 지체 없이 파기합니다. 다만 다음은 아래 근거와 기간에 따라 분리하여 보관한 뒤 파기합니다.

회사는 데이터베이스의 시점 복구(PITR)와 예약 백업을 사용하지 않으므로, 파기된 데이터가 백업본에 남지 않습니다.

4. 개인정보의 제3자 제공

회사는 정보주체의 개인정보를 제3자에게 제공하지 않습니다. 다만 법령에 근거가 있거나 수사기관의 적법한 요청이 있는 경우는 예외로 합니다.

커뮤니티 글의 공개 범위 — 커뮤니티에 올린 글은 기본적으로 공개이며, 회원이 그 글의 링크를 외부(메신저·SNS 등)로 공유하면 앱에 가입하지 않은 사람도 닉네임과 사진을 볼 수 있습니다. 이는 회원 본인의 게시·공유 행위에 따른 것이며 회사가 제3자에게 제공하는 것이 아닙니다. 글을 쓸 때 「나만 보기」를 선택하면 그 글은 다른 회원에게도, 외부에도 보이지 않습니다.

회원이 글을 삭제하거나 탈퇴하면 회사는 해당 사진을 지체 없이 파기하며 외부에서도 즉시 보이지 않게 됩니다. 다만 메신저·SNS가 이미 만들어 둔 미리보기 이미지는 해당 서비스의 저장분이라 회사가 삭제할 수 없습니다.

5. 개인정보 처리의 위탁 및 국외 이전

회사는 안정적인 서비스 제공을 위하여 아래와 같이 개인정보의 처리를 위탁하며, 위탁받는 자의 서버가 국외에 소재합니다. 아래 내용은 개인정보 보호법 제28조의8 제2항 각 호의 사항을 공개하는 것이며, 같은 조 제1항제3호가목에 따라 계약의 체결·이행에 필요한 처리위탁·보관에 해당하는 국외 이전은 본 방침의 공개로써 별도의 동의를 갈음합니다.

국외 이전을 거부하는 방법·절차와 거부의 효과 — 회원은 언제든지 국외 이전을 거부할 수 있습니다. ①은 서비스 제공의 기반이므로 거부하시면 서비스를 이용하실 수 없으며, 환경설정의 계정 삭제로 거부 의사를 실현하실 수 있습니다. ②는 AI 코치 기능이나 커뮤니티 「번역 보기」를 이용하지 않으시면 전송되지 않고, 거부하셔도 나머지 기능은 그대로 이용하실 수 있습니다. ③은 설문을 제출하지 않으시면 전송되지 않습니다. 그 밖의 거부 요청은 아래 연락처로 하실 수 있습니다.

6. 정보주체의 권리·의무 및 행사 방법

① 정보주체는 언제든지 자신의 개인정보에 대한 열람·정정·삭제·처리정지를 요구할 수 있습니다.

② 닉네임 수정 및 계정(개인정보) 삭제는 앱 내 “환경설정”에서 직접 수행할 수 있으며, 그 밖의 요청은 아래 연락처로 하실 수 있습니다.

7. 개인정보의 파기 절차 및 방법

① 회원 탈퇴 시 다음이 지체 없이 파기됩니다 — 계정 정보(이메일·닉네임), 운동 기록과 신체 계측 정보, 성장 지표와 보상 정보, 알림 수신 설정과 알림 토큰, AI 대화 요약문과 분석 결과, 커뮤니티 게시글과 첨부 사진(그 번역 결과문 포함), 회원이 다른 회원의 글에 남긴 댓글과 응원, 팔로우·차단 관계, 공개 프로필, 닉네임 예약.

② 다음은 파기하지 않고 제3항이 정한 근거와 기간에 따라 보관합니다 — 결제 기록, 신고 접수 기록, 주간 리그 정산 기록.

③ 전자적 파일 형태로 저장된 개인정보는 복구가 불가능한 방법으로 삭제하며, 회사는 시점 복구(PITR)와 예약 백업을 사용하지 않으므로 파기된 데이터가 백업본에 남지 않습니다.

8. 개인정보의 안전성 확보 조치

① 비밀번호는 일방향 암호화하여 저장되며, 회사도 이를 알 수 없습니다.

② 모든 통신 구간은 SSL/TLS로 암호화됩니다.

③ 데이터베이스 접근 권한을 최소화하고 보안 규칙으로 통제하며, 서비스 제공에 필요한 최소한의 정보만을 수집합니다.

④ 커뮤니티에 올리는 사진은 전송 전에 촬영 위치(EXIF GPS) 등 부가 정보를 제거합니다.

⑤ 계정 삭제는 현재 비밀번호를 다시 입력해 본인임을 확인한 뒤에만 수행됩니다.

9. 자동 수집 장치의 설치·운영

① 본 서비스는 서비스 개선과 이용 통계 분석을 위하여 Firebase Analytics 및 Firebase Crashlytics(Google LLC)를 통해 앱 이용 행동 정보(화면 조회·기능 사용 등), 기기·앱 정보, 오류 정보와 분석용 식별자를 자동으로 수집합니다. 회원번호와 성별·연속일·티어가 분석 정보에 함께 담깁니다.

② 수집된 분석 정보는 통계 산출 및 서비스 개선 목적으로만 이용됩니다.

③ 회사는 광고 목적의 추적이나 제3자 광고 네트워크는 사용하지 않으며, 광고 추적용 식별자(IDFA)를 수집하지 않습니다.

④ 애플 검색 광고(Apple Ads)를 통해 앱을 설치한 경우, 애플이 제공하는 광고 귀속 정보(광고를 통해 설치했는지 여부와 그 광고의 캠페인·광고그룹·키워드 번호)를 광고 효과 측정 목적으로 받아 분석 정보에 함께 담습니다. 이 정보는 애플이 회원 개인이나 기기를 식별할 수 없는 형태로 제공하며, 광고 추적용 식별자(IDFA)는 사용하지 않습니다.

10. 만 14세 미만 아동의 개인정보

회사는 만 14세 미만 아동의 회원가입을 받지 않으며, 만 14세 미만 아동의 개인정보가 수집된 사실을 확인하는 경우 지체 없이 파기합니다.

11. 개인정보 보호책임자 및 사업자 정보

회사는 개인정보 처리에 관한 업무를 총괄하는 개인정보 보호책임자를 지정하고 있습니다. 개인정보 처리에 관한 문의·불만·피해 구제는 아래로 연락하시면 지체 없이 답변·처리하겠습니다.

· 개인정보 보호책임자: 김민형 (대표자)
· 연락처: support@wonnow.io
· 상호: 주식회사 원나우 (WONNOW Inc.)
· 대표자: 김민형
· 사업자등록번호: 523-87-04209
· 주소: 경기도 과천시 과천대로 112, 제1동 13층 오에프2-1311호 (갈현동, 디센트로 2차)
· 전화: 070-8691-2266

12. 권익침해 구제 방법

개인정보 침해로 인한 구제를 받기 위하여 아래 기관에 분쟁 해결이나 상담을 신청할 수 있습니다.

· 개인정보분쟁조정위원회 (1833-6972, www.kopico.go.kr)
· 개인정보침해신고센터 (국번없이 118, privacy.kisa.or.kr)
· 대검찰청 사이버수사과 (국번없이 1301, www.spo.go.kr)
· 경찰청 사이버수사국 (국번없이 182, ecrm.cyber.go.kr)

13. 개인정보처리방침의 변경

본 방침은 법령 및 서비스의 변경에 따라 개정될 수 있으며, 개정 시 앱 내 공지를 통하여 고지합니다.

1. Personal Information We Collect

① At sign-up (required): email address, password, nickname, and the result and time of the age 14+ confirmation

② At first setup after sign-up: date of birth, gender

③ Profile and survey input (optional): body measurements (weight, height, body fat percentage, skeletal muscle mass), areas of discomfort or caution, one-line bio, and sentences you write yourself such as goals and pledges

④ Created or collected while using the Service: workout logs (exercise and body part, sets and reps, weight, workout date and time, workout volume, workout notes you write), program subscription and progress history, growth metrics and reward information (experience points, Sparks, tier, streak, titles), notification settings and notification token, sign-up date and time

⑤ When using the community: post text and hashtags, photos attached to posts (up to 4 per post), comments, cheers, follow and block lists, report history, public profile (nickname, gender, tier)

⑥ When using the AI coach (Rudi): conversation content, conversation summaries, analysis results. Original conversations are kept only on your device (the latest 12 conversations, automatically deleted after 24 hours) and are not stored on our servers. However, the summary (3–6 lines) created when a conversation ends and in-depth analysis results are stored on our servers.

⑦ At payment: product code purchased, quantity credited, transaction identifier, payment date and time. Payment method information such as card numbers is handled directly by Apple and Google as the parties to the payment, and the Company does not keep it.

⑧ Collected automatically while using the Service: app usage behavior (screen views, feature use, etc.), device model, operating system, app version, analytics identifier, country of access (estimated from IP), error (crash) information

⑨ When connecting a health app (optional — only if you turn on the connection yourself): data from Apple Health (HealthKit) and Google Health Connect — weight, body fat percentage, workouts (workout type, workout distance, workout time, active time, calories burned), heart rate. When you finish a workout, we write the workout time and calories burned to your health app, and we store on our servers the values the Service needs (weight and body fat records, workout distance and intensity summaries, etc.) from the weight, body fat, heart rate, and workout data read from your health app.

Limited Use of health app data: this health data is used only for calculating workout volume and intensity, weight records, exporting to your health app, and coaching. It is not used for advertising or marketing targeting, not sold or transferred to third parties such as data brokers, and not provided for third-party AI training without your explicit consent. You can turn off the connection in the app's Settings or revoke ROUTE's access in your health app's permission settings at any time.

What we do not collect: device location (GPS), contacts or address book, advertising tracking identifier (IDFA). The Company does not request location permission. If you type a place name into a post, hashtag, or nickname yourself, that text is handled as part of the post you wrote.

Photo location: before uploading photos to the community, the app removes the shooting location (EXIF GPS) and other metadata.

2. Purposes of Processing

Collected personal information is used only for member identification and authentication, providing the Service such as workout logs and growth metrics, operating the community and handling reports and blocks, providing AI coach features, processing in-app payments and preventing abuse, analyzing usage statistics and improving the Service and developing new features, responding to customer inquiries, and sending notifications based on consent.

3. Retention Period

The Company keeps personal information until you leave the Service, and destroys it without delay when you delete your account. However, the following are stored separately for the periods and on the grounds below, then destroyed.

· Records of payment and supply of goods: 5 years

· Records of contracts or withdrawal of purchase: 5 years

· Records of consumer complaints or dispute handling: 3 years

(Grounds: Article 6 of the Korean Act on the Consumer Protection in Electronic Commerce and Article 6 of its Enforcement Decree)

· Report records (member numbers of the reporter and the reported, reason, date and time): 5 years

(Grounds: Company policy — to prevent a reported account from erasing its record by leaving and re-joining, and to respond to disputes)

· Weekly league settlement records (member number, rank, weekly experience points): kept to verify settlement results; after account deletion they are not linked to any other personal information.

The Company does not use point-in-time recovery (PITR) or scheduled backups for its database, so destroyed data does not remain in backups.

4. Provision to Third Parties

The Company does not provide personal information to third parties, except where required by law or at the lawful request of investigative authorities.

Posts in the community are public by default, and if you share a post's link outside the app (messengers, social media, etc.), people who have not joined the app can also see your nickname and photos. This results from your own posting and sharing, not from the Company providing data to a third party. If you choose "Only me" when writing a post, it is not visible to other members or outside the app.

When you delete a post or leave the Service, the Company destroys the related photos without delay and they immediately stop being visible outside the app. However, preview images already created by messengers or social media are stored by those services, and the Company cannot delete them.

5. Outsourcing and Overseas Transfer

To provide the Service reliably, the Company outsources the processing of personal information as follows, and the servers of the outsourcees are located outside Korea. The information below discloses the items required by Article 28-8(2) of the Personal Information Protection Act. Under Article 28-8(1)3(a) of the same Act, overseas transfers that are outsourcing or storage necessary for concluding and performing the contract are covered by this disclosure in place of separate consent.

① Google LLC (Firebase)

· Recipient and contact: Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA / privacy inquiries via support.google.com/policies)

· Destination countries: the United States and other countries where Google data centers are located

· Timing and method: continuously during sign-up, sign-in, and use of the Service, transmitted over information networks

· Items transferred: email address, encrypted password, member number, app usage behavior, device model, operating system, app version, analytics identifier, country of access (estimated from IP), gender, streak, tier, notification token, error (crash) information

· Purposes: member authentication, app usage analytics, error diagnosis, sending notifications

· Retention period: until you leave the Service or the outsourcing contract ends

· Original workout logs, body information, and community posts and photos are stored in the Republic of Korea (Seoul) region and are not transferred abroad.

② Anthropic PBC

· Recipient and contact: Anthropic PBC (548 Market Street, San Francisco, CA 94104, USA / privacy@anthropic.com)

· Destination country: United States

· Timing and method: each time you (a) receive coach comments during or after a workout, (b) open an in-depth analysis, (c) chat with Rudi, (d) finish a chat and a summary is created, or (e) tap "See translation" in the community, transmitted over information networks

· Items transferred: nickname, sentences you write such as goals and pledges, workout logs (exercise, weight, reps, sets, date), workout notes, trends and ranges of change in body metrics (weight, skeletal muscle mass, body fat percentage), streak, condition you report yourself, your conversations with Rudi (latest 12), summaries of previous conversations, the body of community posts and comments for which you tap "See translation"

· Purpose: generating coach comments, analyses, and chat responses, and translating community posts and comments

· Retention period: as long as needed to process the request. The Company does not store the original requests or responses on its servers, and the recipient's retention follows Anthropic's Commercial Terms of Service. However, community translation results are kept on the Company's servers for up to 30 days to avoid sending the same post again, and are destroyed together with the original post or comment when it is deleted (translations of "Only me" posts are not stored).

③ Google LLC (Google Forms)

· Recipient and contact: same as ① above

· Destination countries: the United States and other countries where Google data centers are located

· Timing and method: when you open and submit a feedback survey in the app, transmitted over information networks

· Items transferred: what you enter in the survey yourself

· Purpose: collecting beta feedback

· Retention period: until the survey ends or the outsourcing contract ends

How to refuse overseas transfer and its effect: you may refuse overseas transfer at any time. ① is the foundation of the Service, so if you refuse it you cannot use the Service, and you can exercise your refusal by deleting your account in Settings. ② is not transmitted if you do not use AI coach features or "See translation" in the community, and you can keep using all other features even if you refuse it. ③ is not transmitted if you do not submit a survey. Other refusal requests can be made to the contact below.

6. Rights and Obligations of Data Subjects and How to Exercise Them

① You may request access to, correction, deletion, or suspension of processing of your personal information at any time.

② You can change your nickname and delete your account (personal information) yourself in the app's "Settings"; other requests can be made to the contact below.

7. Destruction Procedure and Method

① When you leave the Service, the following are destroyed without delay — account information (email, nickname), workout logs and body measurements, growth metrics and reward information, notification settings and notification token, AI conversation summaries and analysis results, community posts and attached photos (including their translation results), comments and cheers you left on other members' posts, follow and block relationships, public profile, and nickname reservation.

② The following are not destroyed but kept on the grounds and for the periods set out in section 3 — payment records, report records, and weekly league settlement records.

③ Personal information stored as electronic files is deleted in a way that cannot be recovered, and because the Company does not use point-in-time recovery (PITR) or scheduled backups, destroyed data does not remain in backups.

8. Security Measures

① Passwords are stored with one-way encryption, and even the Company cannot know them.

② All communication is encrypted with SSL/TLS.

③ Database access is minimized and controlled by security rules, and we collect only the minimum information needed to provide the Service.

④ Photos uploaded to the community have their shooting location (EXIF GPS) and other metadata removed before transmission.

⑤ Account deletion is performed only after you re-enter your current password to confirm your identity.

9. Automatic Collection Tools

① To improve the Service and analyze usage statistics, the Service automatically collects app usage behavior (screen views, feature use, etc.), device and app information, error information, and an analytics identifier through Firebase Analytics and Firebase Crashlytics (Google LLC). Your member number, gender, streak, and tier are included in the analytics information.

② Collected analytics information is used only to produce statistics and improve the Service.

③ The Company does not use tracking for advertising or third-party ad networks, and does not collect the advertising tracking identifier (IDFA).

④ If you installed the app through Apple Search Ads (Apple Ads), we receive ad attribution information provided by Apple (whether the install came from an ad, and that ad's campaign, ad group, and keyword numbers) to measure ad effectiveness, and include it in the analytics information. Apple provides this in a form that does not identify you or your device, and the advertising tracking identifier (IDFA) is not used.

10. Personal Information of Children Under 14

The Company does not accept sign-ups from children under 14, and if it finds that personal information of a child under 14 has been collected, it destroys it without delay.

11. Privacy Officer and Business Information

The Company has designated a privacy officer who oversees the processing of personal information. For inquiries, complaints, or remedies regarding the processing of personal information, contact us below and we will respond and handle it without delay.

· Privacy officer: 김민형 (Representative)

· Contact: support@wonnow.io

· Company name: WONNOW Inc. (주식회사 원나우)

· Representative: 김민형

· Business registration number: 523-87-04209

· Address: 경기도 과천시 과천대로 112, 제1동 13층 오에프2-1311호 (갈현동, 디센트로 2차)

· Phone: 070-8691-2266

12. Remedies for Infringement

To seek remedies for infringement of personal information, you may apply for dispute resolution or counseling to the organizations below (Republic of Korea).

· Personal Information Dispute Mediation Committee (1833-6972, www.kopico.go.kr)

· Personal Information Infringement Report Center (118 without area code, privacy.kisa.or.kr)

· Supreme Prosecutors' Office Cyber Investigation Division (1301 without area code, www.spo.go.kr)

· Korean National Police Agency Cyber Investigation Bureau (182 without area code, ecrm.cyber.go.kr)

13. Changes to This Privacy Policy

This Policy may be amended in line with changes in law or the Service, and any amendment is announced through an in-app notice.

Addendum

This Policy takes effect on 2026.11.11.

Changes from the previous Policy (effective 2026.11.10): the automatic collection section (Article 9 ④) now states that, if you installed the app through Apple Search Ads, we use ad attribution information provided by Apple (campaign, ad group, and keyword numbers — information that does not identify you or your device) to measure ad effectiveness.

Changes from the Policy before that (effective 2026.11.06): the optional items collected when you connect a health app now specifically name body fat percentage from smart scales and workout distance from cardio workouts (the scope of data did not change — items we already processed are now stated precisely).

Changes from an earlier Policy (effective 2026.11.05): "See translation" was added to the community, so the overseas transfer section now states that the body of posts and comments you ask to translate is sent to Anthropic PBC (USA) for translation, and that translation results are kept for up to 30 days and destroyed together with the original when it is deleted.

Changes from an even earlier Policy (effective 2026.09.11): health app connections (Apple Health and Google Health Connect) were added, so weight, workouts, and heart rate are listed as optional collected items only when you turn on the connection yourself, and their scope of use (Limited Use) is stated. The previous Policy stated that Apple Health (HealthKit) data was not collected.

Changes from a still earlier Policy (effective 2026.09.03): we began collecting date of birth at first setup after sign-up. That Policy stated that date of birth and age were not collected. The purpose is recommending workout programs suited to your age group, and it is kept until you leave the Service.

In the Policy before that (effective 2026.06.08), the collected items (photos, community, AI summaries, payment records), overseas transfer notice, retention periods, and scope of destruction were corrected to match actual processing.