Privacy Policy
This is a translation. If it differs from the Korean version, the Korean version applies.
In providing the Paperly service, Paperfly Labs (페이퍼플라이랩스, the "Company") complies with the Personal Information Protection Act (개인정보 보호법) and other applicable laws, and processes members' personal information as follows.
1. Personal Information We Process
The Company does not collect real names, addresses, precise location (GPS) or contact lists.
| Category | Items | When |
|---|---|---|
| Account | Email address; Google or Apple account identifier (if you sign in with them) | When you join or sign in |
| Profile | Nickname, date of birth, gender, gender you want to meet, purpose (exchange or dating), country, city (chosen from a list), time zone, app language, languages you use and your level, interest tags | When you join |
| Profile (optional) | Profile photo, self-introduction | When you enter them |
| Identity verification (Korea) | Date of birth, gender, hash of the Connecting Information (CI) — name and mobile number are not stored | When you verify your identity |
| Text message verification (outside Korea, planned) | Hash of your mobile number, country | When you verify |
| Conversations | Messages, chat photos, translations, read times | When you chat |
| Paper planes | Photos taken with the in-app camera, date | When you post one |
| Safety | Report details and evidence (recent messages), block list, automated check results | When you report, block, or a check runs |
| Device and usage records | Push notification token, device type (OS), app version, usage records (dates of access, feature use), IP address (sign-in records) | When you use the app |
| Error records | Error details, device information, anonymous account number — email and IP are not sent | When an app error occurs |
2. Purposes of Processing
- Registration, identity confirmation, confirming you are 19 or older (by full age), and preventing duplicate accounts and evasion of sanctions
- Providing the Service, including recommendations, matching, one-to-one chat, translation and notifications
- Member safety, including handling reports and protecting against fraud, sexual offenses and harm to minors
- Storing conversations as required by law and responding to disputes
- Statistics to improve the Service (analyzed in a form that cannot identify individuals)
- Sending news about new features and events, if you have agreed
3. Retention Periods and Destruction
When a member deletes their account, their information is destroyed after the periods below. Information that is deleted immediately on account deletion is erased right away.
| Information | Retention period |
|---|---|
| Profile, profile photo, paper plane photos, self-introduction, sign-in connection information, notification tokens | Deleted immediately on account deletion |
| Conversations (messages, translations, chat photos) | Kept for 6 months after the sender is made unidentifiable, then destroyed |
| Report evidence | 1 year from the date the report is closed |
| Identity verification hash | 30 days after account deletion; 3 years if the account was deleted while suspended, to prevent rejoining |
| Access records | 3 months (Protection of Communications Secrets Act (통신비밀보호법)) |
| Payment records (after paid services start) | 5 years (Act on the Consumer Protection in Electronic Commerce (전자상거래 등에서의 소비자보호에 관한 법률)) |
- Paper plane photos are deleted 48 hours after there is no longer anyone who can view them.
- Destruction runs as an automated job every day, and electronic files are erased in a way that cannot be recovered.
4. Outsourcing of Personal Information Processing
To provide the Service, the Company entrusts the processing of personal information to the following companies.
| Recipient | Task entrusted |
|---|---|
| Supabase Inc. | Operating the database, file storage and sign-in servers (server location: Seoul, Republic of Korea) |
| Anthropic PBC | Translating conversations and self-introductions; automated photo checks |
| Functional Software Inc. (Sentry) | App error records |
| Resend Inc. | Sending sign-in verification emails |
| Google LLC (Firebase Cloud Messaging) | Delivering push notifications |
| Korea PortOne Co., Ltd. (주식회사 코리아포트원), KG Inicis Co., Ltd. (주식회사 케이지이니시스) | Mobile phone identity verification in Korea |
| Twilio Inc. (planned) | Text message (SMS) verification outside Korea |
5. Transfer of Personal Information Abroad
For translation, error records, and sending email and notifications, personal information is transferred abroad as shown below. Transfers happen as needed while you use the Service, sent over an encrypted network.
| Recipient | Country | Items | Purpose | Retention period |
|---|---|---|---|---|
| Anthropic PBC (anthropic.com) | United States | The message to translate and up to 10 preceding messages, a profile summary of both people (nickname, gender, age, country, languages used), self-introductions, photos to check | Translation, photo checks | Deleted after processing according to Anthropic's API data retention policy; not used for AI training |
| Functional Software Inc. (sentry.io) | United States | Error details, device information, anonymous account number | Error analysis | According to Sentry's data retention policy |
| Resend Inc. (resend.com) | US company (sending servers in Japan) | Email address, verification code | Sending sign-in emails | Retention period for sending records |
| Google LLC (firebase.google.com) | United States | Notification token, notification content (name and part of the message if previews are on) | Push notifications | Deleted after delivery |
| Twilio Inc. (twilio.com, planned) | United States | Mobile phone number | Text message verification | Retention period for verification records |
If you do not want your information transferred abroad, you can decline to consent or delete your account. However, translation and sign-in emails are core features of the Service, so if you refuse the transfer you cannot use the Service. Notifications can be turned off in the app's settings.
6. Provision to Third Parties
The Company does not provide members' personal information to third parties. The exception is when investigative agencies or similar authorities request it through the procedures set by law.
7. Members' Rights
- Members can view and edit their profile in the app at any time, export their conversations to a file, and delete their account.
- For any other request to access, correct, delete or stop processing your personal information, contact support@paperflylabs.com. The Company will reply within 10 days.
- Optional consent (benefits and news notifications) can be withdrawn at any time in settings.
8. Security Measures
- All communication is encrypted (HTTPS), and the database uses row-level access control
- The server checks that conversations and photos can be seen only by the people in the conversation
- Identity verification Connecting Information is stored only as a hash that cannot be turned back into the original value
- Operators' access to report evidence is logged
- Secrets such as the AI key used for translation are kept only on the server
9. Automatic Collection Tools
The app does not use cookies. Your sign-in state is kept in storage on your device and is erased when you sign out.
10. Chief Privacy Officer
- Officer: Han Sanghun (Representative)
- Contact: support@paperflylabs.com
11. Remedies for Infringement of Rights
You can seek advice about, or report, an infringement of your personal information to the following organizations.
- Personal Information Dispute Mediation Committee (개인정보분쟁조정위원회): 1833-6972 (kopico.go.kr)
- Personal Information Infringement Report Center (개인정보침해신고센터): 118 (privacy.kisa.or.kr)
- Supreme Prosecutors' Office Cyber Investigation Division (대검찰청 사이버수사과): 1301 (spo.go.kr)
- Korean National Police Agency Cyber Investigation Bureau (경찰청 사이버수사국): 182 (ecrm.police.go.kr)
12. Changes
If this Policy changes, we will announce it in the app and on the website at least 7 days before the change takes effect.
- Effective date: November 14, 2026