Privacy Policy

Scope and standards

This policy applies to every screen and public API this web service provides. The Korean and English pages carry the same content. What it discloses covers the items required by Article 30 of Korea's Personal Information Protection Act and Article 31 of its Enforcement Decree, and the items the California Online Privacy Protection Act (Cal. Bus. & Prof. Code § 22575 et seq.) requires for users in California. There are places, however, where we have not fully supplied what is required, and we do not simply write "covered" and move on. The list of parties consigned to in turn by the company that runs and delivers these pages sits behind a page that requires approval to view, so we did not receive the whole of it, and among the five items that must be given for a transfer abroad, some are left blank as "not confirmed". Which places are blank, why, and how many in which transfer is set out where they occur, in the "Third-party provision and processing consignment" clause below. This service does not meet the business-size thresholds set by the California Consumer Privacy Act (CCPA/CPRA), but it discloses that law's items voluntarily as well — the "Notice for California users" clause below is where they live.

Categories of personal information processed

What is processed falls into four groups. (1) What you post yourself — comment text, nickname, profile picture, and the note you add when filing a report. The first three appear on public pages as given; a report note is never published and is visible only on the operator's review page — but because it is something one user writes about another, it is listed here as well. These four are stored in this service's database, and that database is held by another company in the United States. They used to live only on the operator's machine, and the copy as it stood then has been removed from that machine. Who holds the database now in use, and where, is set out in the clause on third-party provision and processing consignment below. (2) What the service records automatically — the cookie values stored in the browser, and a request record, one line per request. That line holds the address requested (including any search term you typed, if it is part of that address), the time, the response code, the browser type (User-Agent), and the region that handled the request; the connecting IP address is visible at that point too. It is kept for every request, not only when an error occurs, and it is kept whether or not you have agreed to advertising or usage measurement. This service's code is not what writes that line — Vercel, which runs and delivers these pages, writes it; and that does not make it someone else's record either: it is our project's record and we can open it. How long it is kept, however, is not ours to decide, and how long that company keeps it on its own systems is stated only as "the minimum necessary period", so we have not been able to confirm it. We set this out separately in the clauses on automatically kept access records and on third-party provision and processing consignment below. (3) What is received from outside when you sign in — the Google account identifier (sub) and nothing else, converted into an irreversible value the moment it arrives and used only as a marker. (4) What Google receives directly from the browser if you agree to usage measurement — unlike the first three, this is not something we receive and store: the browser sends it straight to Google. It is the address of the page you are viewing, the address of the page you were on before it, values the browser states about itself such as browser type, language, and screen size, the connecting IP address, and the marker stored in the browser for usage measurement. As for the connecting IP address, Google states that it uses it only to determine location and discards it before the data is logged — that statement and its limits are set out in the clause on access records left automatically below. The page address is sent with any search term you typed removed. Here, though, we separate what we do from what we cannot guarantee: supplying the address with the search term removed is what this service's code does, while making Google's side use that value is a setting outside this service, in Google's console, so the code cannot enforce it. What actually goes out also depends on that setting, so we cannot assert that the list here is exhaustive. If you do not agree, none of these items is sent.

The four above are what the features of these pages handle. There is one further place, and it is set out separately. No feature on these pages asks for a name, email, phone number, address, date of birth, or gender, and signing in receives only the account identifier. That does not mean there is no path by which they reach us. If you write to the email address in the "Privacy officer and contact" clause below, your email address and the body of your message remain in that mailbox, and a rights-infringement report under the Terms of Service requires the reporting person's name and contact details. "The pages do not ask" and "there is no way for them to reach us" are different things, and we write this so as not to blur them. That mailbox is Google's email service, and whether it should be treated as a fourth consignment we have not settled (see the "Third-party provision and processing consignment" clause below). Government-issued identification numbers and sensitive information such as health, beliefs, or political opinions are neither asked for by any feature nor stored.

Personal information collected

There is no sign-up, and there is no contact form on these pages. You can sign in with a Google account, but that is not registration either; what is received and what is kept are set out in the "Signing in" clause below. No feature on these pages asks you for a name or contact details — there is a contact address, however, and what a message sent there leaves behind is set out in the "Categories of personal information processed" clause above. And four things you write yourself on these pages are stored as given: comment text, the nickname and profile picture you choose once signed in, and the note you add when filing a report. We did not collect the first three; you posted them, and all three appear on public pages. The fourth, a report note, is never published and is visible only on the operator's review page, but it is counted here because it is something one user writes about another. So please consider how far something will be visible before writing or uploading anything that could identify you or someone else. Search terms on the list screen travel only in the address bar's query string and are not stored separately in this service's database — the cookie that remembers your filters does not hold them either. What that sentence covers, however, must be set out separately — a search term is part of the address, so the whole address goes into the record the party that runs and delivers these pages keeps for every request. How long that record is kept is not ours to decide, and how long that company keeps it is stated only as "the minimum necessary period", so we have not been able to confirm it (see the "Access records left automatically" clause below). "Not stored separately" is a statement about our database and our cookies; it does not reach beyond them. If you have agreed to usage measurement, one thing is set out separately — the address of the page you are viewing is also handed to Google, so the search term is stripped from that address before it is handed over. Stripping it and handing over the stripped address is what this service's code does, while the setting that makes the handed-over value the one actually used sits in Google's console, so the code cannot enforce it (the same limit is recorded in the "Categories of personal information processed" clause above and the "Cookies" clause below).

Children under 14

This service is not directed to children. Because the threshold age differs by country, both are stated: under 14 in Korea, under 13 in the United States.

The basis for saying it is not directed to children is recorded here. What this service publishes are records of unsolved social problems in various countries, and there is nothing aimed at children in its subject matter, imagery, characters, tone, or advertising. It uses no child celebrities and hosts no child-oriented activities. These are the factors that actually decide whether a service is directed to children, and we will not change in that direction.

One thing must be said plainly, though: this service does not ask for or verify age. Signing in requests only the Google account identifier, so no date of birth is received. What this clause can therefore claim is not "we do not process children's personal information" but "we are not directed to children, and we do not knowingly process their information." We will not blur that difference.

If we learn that something was posted by a child below the ages above — whether they tell us, a guardian or another user tells us, or it is apparent from the post — we remove it after checking. Nicknames, profile pictures, and comments are within that scope. How far that removal reaches must be set out separately, however — it is deleted from the database now in use, but there are several places where we have no means of picking out that one person's records, and the "Destruction procedure and method" clause below sets out each of them. Most of them go only once their own period elapses. Nor can we undo what someone who already saw the page, or a search or AI crawler, has taken. These limits are the same when we are told that something belongs to a child, so rather than write as though it were otherwise, we record it as it is. A legal guardian may request verification or deletion at the email address in the "Privacy officer and contact" clause below, and may use the same address simply to tell us that a child has been using the service.

Access records left automatically

This service's code writes no access log. Our code creates no per-visitor line, and it puts the connecting IP address and browser type (User-Agent) nowhere in this service's database. The line is written all the same. Vercel, which runs and delivers these pages, keeps one line per request, holding the address requested (including any search term you typed, if it is part of that address), the time, the response code, the browser type, and the region that handled the request; the connecting IP address is visible at that point too. It is kept for every request, not only when an error occurs, and whether or not you have agreed to advertising or usage measurement. Our purpose in looking at those values is fault response and abuse checks only, and they are not combined with other information to identify an individual.

We do not write this off as "someone else's record" — it is our project's record and we can open it. There is very little in it we get to decide, though. On the free plan this service uses, what we can see on screen reaches back one hour, and that is the limit of what is shown to us, not a statement that it is deleted afterwards. Vercel's own policy says only that it keeps such records for the minimum period necessary to meet its legal and contractual obligations and to develop its services, and states no number of days, so we have not been able to confirm it. Vercel also states in its terms of service that records of this kind, generated in the course of using the service, may be used for any business purpose at its sole discretion, and we cannot narrow that — this is recorded together in the clause on third-party provision and processing consignment below. We have put in place no procedure guaranteeing "deletion after N days". This clause used to describe a size cap rotating on the operator's machine; that mechanism no longer exists — the reason for the absence has changed from "a limit of the method we chose" to "the retention is not ours to decide".

There is one more party that sees it. If you agree to usage measurement and the measurement code is loaded, the browser sends requests to Google directly, so your connecting IP address reaches Google as well (see the clause on third-party provision and processing consignment below). Google states that it uses that address at collection time to determine location and discards it before the data is logged — which differs from the party that writes the request records above. But that is Google's own statement, and we have no means of verifying it. So rather than "it is not kept", we write "Google states that it does not keep it". If you do not agree, the request does not happen at all, and this situation does not arise.

Cookies

This service sets ten cookies. (1) NEXT_LOCALE — remembers your language choice. Its value is ko or en, it disappears when the browser closes, and the page's scripts can read it. (2) u1_visit — a marker so the same browser is not counted twice in the visitor total; it is a random value carrying no meaning and expires after a year. (3) u1_filters — remembers the last filters you chose on the list screen (country, document language, cause type, sort) and returns you to that view on your next visit. Its value is those choices, it expires after a year, and it does not hold search terms. (4) u1_actor — the marker used for votes and comments; it carries no meaning, is not issued when you only read pages, and is attached only at the moment you sign in. (5) u1_oauth — exists only for the ten minutes the sign-in exchange runs, then is deleted. (6) u1_auth — marks that this browser is signed in. (7) u1_consent — remembers whether you agreed to advertising cookies. Its value is either agreed or declined, it expires after a year, and the page's scripts can read it too — the page reads it to decide whether to show the consent banner. (8) u1_ads — this service's judgement of whether advertising can be served to this browser at all. Its value is either "not served" or "can be served, plus the advertising publisher number"; it expires after an hour, and the page's scripts can read it too — the page reads it to decide whether to ask for consent and whether to load advertising code. It is a judgement about the request, not about the person. That judgement reads the country code that arrives with the request (derived from your connecting IP address by Vercel, which runs and delivers these pages), and where that is absent, the regional subtag of the language setting your browser sends. That judgement is made on every request, including before you have consented — it is what decides whether to ask you at all, so country-level location is determined regardless of consent. It judges at country level only; precise location such as GPS is neither used nor stored. (9) u1_analytics — remembers whether you agreed to usage measurement. Its value is either agreed or declined, it expires after a year, and the page's scripts can read it too — the page reads it to decide whether to show the consent banner and how to show which way it currently stands. It is a separate value from your advertising consent — agreeing to one is not agreeing to the other. (10) u1_gtm — this service's judgement of whether usage measurement can be loaded in this browser at all. Its value is either "not loaded" or "can be loaded, plus the number of the measurement tag set"; it expires after an hour, and the page's scripts can read it too — the page reads it to decide whether to ask for consent and whether to load the measurement code. As with (8) it is a judgement about the request, not about the person, and it is judged from the same material set out in (8). All but (1), (7), (8), (9) and (10) are unreadable by scripts (httpOnly). All ten are set by this service itself and are not handed to any other company. They do travel with every request, however, and so pass through Vercel, which runs and delivers these pages — and they do not merely pass through: this service's code runs there, reading and setting them. The "Third-party provision and processing consignment" clause below sets that out. And what this service sets is not all of it — if you agree to usage measurement, Google's script sets two further cookies on this site. Those two are set out separately in the usage measurement paragraph below.

Advertising is described separately. This service intends to fund its running costs through advertising, and to show advertisements Google, as the advertising provider, needs to store and read cookies or equivalent identifiers in this browser. Those cookies are used to choose which advertisements to show, based on your earlier visits to this site and to other sites on the internet. Cookies are not the only mechanism — once advertising is served, Google and its advertising partners may also collect information using invisible images (web beacons, or tracking pixels) and your connecting IP address. Neither those cookies nor the information collected that way is handled by us: Google sets and receives them, and we do not read their values. If you do not agree, they are not stored — before consent the code that loads advertising is not executed at all, and a content security policy prevents the browser from even making requests to those addresses. Consent is asked at the bottom of the screen on your first visit. How Google uses information for advertising is set out at business.safety.google/privacy, and personalized advertising can be turned off at myadcenter.google.com. (One note: at the time of writing, no advertisement is yet shown on these pages. The consent flow and the blocking mechanism were built first; this parenthesis is removed once advertising begins.)

Usage measurement is described separately too. To count how much each page is read, this service has settled on Google's tag management tool (Google Tag Manager): one tag set is placed there, and Google Analytics is loaded through it. If you agree, that script sets two cookies on this site — one named _ga and one beginning with _ga_ — both with a default lifetime of two years, both markers for counting visits from the same browser together. These two differ in kind from the ten above — the address is this site's, but what sets them is Google's script rather than us, and their values go to Google. We do not read them. The two-year lifetime is Google's default, not a ceiling — browsers cut it shorter (Chrome to 400 days, Safari to 7). The two recorded here are what the Google Analytics tag placed in that tag set writes. The number after _ga_ is a measurement number issued by Google — a different value from the tag set number in (10) — and it lives in Google's console rather than in this service's code. What is loaded at all is decided in that console too — other tags would set other cookies, and if that happens this clause is amended with it. What is placed in that set is Google Analytics and nothing else; no advertising tag and no other company's tag is added. The search term you type is stripped before the address is handed over — what goes up is the address with the search term (q) removed. One thing to state honestly, however: whether that handed-over value is the one actually used is also settled in the console described above, so this service's code alone cannot assert that no search term goes out. What we do extends as far as handing over an address with the search term removed. Cookies are not the only thing that travels — the measurement request also carries your connecting IP address. Google states that it uses that value at collection time only to determine approximate location and discards it before the data is logged; we have no way to verify this, so we record only that Google states it. If you do not agree, those cookies are not stored — before consent the script that loads the measurement is not placed on the page at all, and a content security policy prevents the browser from making requests to those addresses. Advertising and usage measurement are asked separately and remembered separately, so you may agree to one only. Consent is asked together with advertising at the bottom of the screen on your first visit, where the two can be chosen item by item, and it can be changed later at "Where to change your advertising and usage measurement consent" below on this page. This measurement does not replace the view count on each problem or the cumulative visitor count — those two are still counted by this service itself, and they count crawlers too, regardless of consent or of whether JavaScript runs. Of the two, only the view count is shown on the page; the visitor count is not (see the "Visitor and view counts" clause below). Because they count different things, the two sets of numbers do not match. (One note: at the time of writing, usage measurement is not yet loaded — the tag set's number is not configured for this service, so no container is loaded and consent for it is not asked. What this paragraph describes is what happens once that number is configured; this parenthesis is removed once it begins.)

To refuse cookies, block cookie storage in your browser settings or delete the stored cookies (Chrome/Edge: Settings → Privacy and security → Cookies; Safari: Settings → Privacy). Blocking them does not affect reading the problem list, the detail pages, search, or filters. It does mean the same browser may be counted more than once in the visitor total, your filters will not be remembered, and signing in, commenting, and voting will not work. If you block cookies altogether, consent itself cannot be stored, so neither advertising nor usage measurement is loaded. If you want only to stop the filters being remembered, press "Clear all" on the list screen and that cookie is deleted on the spot; if you want only to turn off advertising or usage measurement, you can withdraw them item by item at "Where to change your advertising and usage measurement consent" below on this page.

Two more things. For users in the European Economic Area, the United Kingdom, and Switzerland, this service loads neither advertising nor usage measurement — but the reasons differ. For advertising, serving personalized advertising there requires a consent management platform certified by Google, which this service does not have; loading the advertising code first without one would conflict with the prior consent those regions' rules require. Usage measurement is not covered by that certification requirement — it is nonetheless not loaded, because this service is not yet equipped for the prior-consent regime those regions require and has closed it of its own accord. We record that this is our own choice rather than something imposed on us. So in those regions we ask for consent for neither, and neither is loaded. And if you withdraw consent, that code stops loading from then on, but the cookies already stored remain. For advertising, we cannot delete Google's cookies that are already stored — they are Google's, not ours, and there is no way for us to remove them. For usage measurement, for the two cookies beginning with _ga, this service has put in place no procedure that deletes them when you withdraw consent. To remove either, please delete cookies in your browser settings.

Visitor and view counts

The view count on each problem and the cumulative visitor count are both counted by this service itself. The view count is shown on the problem page; the visitor count is counted but is not shown anywhere on this site — most of that number is currently visits from search and AI crawlers rather than from people, so we judged it not worth putting on the page (2026-09-12). We keep counting it, so if the number comes to mean something later it can be shown again together with its history. All that is stored in this service's database is a number and an update time; no list of who visited is created there — who holds that database and where is set out in the clause on third-party provision and processing consignment below. The visitor count is not a count of people but of browsers that arrived without a visit-marker cookie. It is counted on three kinds of page — the problem list, a problem page, and this policy page — so a visit that only reaches the About, Editorial policy or Terms page is not counted. The view count is the number of times that problem page was opened. People and crawlers are not distinguished, so both numbers include visits from search and AI crawlers.

A usage measurement layer has been added alongside these two numbers. For browsers whose users have agreed to usage measurement, Google's measurement tool is loaded, and which page was opened and when goes to Google visit by visit — that record is held on Google's side rather than in this service's database, and it is not rolled up into a single number the way the two counts above are. What is sent and what is not is set out in the "Cookies" clause above and the "Purpose of use and retention" clause below. So this service's own numbers and the number on Google's side do not agree. The count this service keeps itself includes crawlers and does not depend on consent or on JavaScript running, while the number on Google's side covers only those who agreed and whose browsers run JavaScript — so Google's number is structurally the smaller one, and there is no adjustment that makes either match the other. Rather than pick one as the true figure or reconcile the two, we record that they count different things.

Comments and votes

Each problem page has a place to add comments and to cast up/down votes. Writing a comment or casting a vote requires signing in; reading does not. Comment text is stored and displayed as plain text only — links and formatting are not rendered. Comments from users who have not set a nickname show a six-character marker: it is computed from the marker cookie together with that problem's identifier, so it links the same person only within one problem and becomes a different value on another, which means the marker alone cannot follow a person across problems. This does not apply to users who have set a nickname — their name and picture are shown, and the "Nickname and profile picture" clause below records what that means. Who a marker-only user is, we do not know either.

Signing in

You can sign in with a Google account. There is no registration. The only scope requested from Google is the account identifier (sub); name, email, and profile picture are not requested. The identifier received is not stored as-is — it is converted into an irreversible value used solely as a vote and comment marker, so the Google account cannot be recovered from what is stored. We also record where the secret used to make that irreversible value now lives — it sits in the deployment environment settings of the company where this service's code runs (Vercel). We have no basis for writing that the company reads it, but that it sits in a place someone else administers is recorded rather than hidden (see the "Security measures" and "Third-party provision and processing consignment" clauses below). The nickname and picture shown on pages do not come from Google; you set them here. Signing in does two things: it carries your comments and votes across devices, and it lets you write comments and vote. Reading requires no sign-in at all. Signing out clears this browser's markers; there is not yet a way to end sessions left on other devices. Comments and votes made anonymously before signing in do not follow you and stay with that browser.

Nickname and profile picture

Signed-in users may set a nickname and upload a profile picture. Both are optional; every feature works without them. Once a nickname is set, that user's comments show the name and picture instead of the six-character marker, and this applies to comments already written. As a result, comments scattered across many problems can be read as one person's.

There are two places where that link cannot later be undone. One is what someone who already saw the page, or a search or AI crawler, has taken — deleting the nickname does not undo it there. The other is something this policy records here for the first time — the nickname and picture are also held in the places set out in the "Destruction procedure and method" clause below, namely the places where we have no means of picking out and deleting or correcting one person's records. The copies on the operator's machine, the change history and own backups at the database holder, and the already-rendered pages held by the party that runs and delivers these pages are among them. What each holds and when it goes away is set out one by one in that clause.

Uploaded pictures are not kept in their original form; they are re-encoded as a 512px square image, and in that step the attached metadata such as capture location and device information is stripped. Nicknames must be unique across this site.

Purpose of use and retention

Purpose and period differ by item. Access records are not created by this service's code: the party that runs and delivers these pages keeps one per request, and our purpose in looking at them is fault response and abuse checks only. Their retention is not ours to decide, and because that company states only "the minimum necessary period" and gives no number of days, we have not been able to confirm it (see the "Access records left automatically" clause above). Visitor and view counts are kept only as cumulative numbers not linked to any individual and are not subject to destruction — the rows hold nothing but a number and a time. Votes remain until the user withdraws them; comments remain until the user deletes them — except that a reported comment stops showing its text, and while it is hidden the author cannot delete it either (something must remain in order to be appealed). A report record holds the target, the reason, the time, the reporter's marker, and the note added, and once judged, the decision and its time are added.

How long a report record remains depends on what was reported, so it is set out separately. A report about a comment follows the lifetime of that comment's row — if the author takes down a comment that has no replies, the row is deleted outright and the reports attached to it are deleted with it; where replies mean the place is kept, the report keeps only who, why and when, and the reporter's own note is erased. That is to say, we do not keep a record even in the case where the thing the report points at has ceased to exist. A report about display information (nickname, picture) is different — even when an operator judges it and deletes that name and picture, the report record remains, because a record that the procedure was followed must remain for an appeal to be possible. Reports about display information hold the same items as above. Once three different people report them, that nickname and picture become hidden from other users, and even then they are not deleted — the values remain and only the display stops (so they can be restored if no problem is found, and so nobody else can take the name during review). While hidden the owner cannot change them either; if an operator finds a problem, they are deleted at that point.

Nicknames and profile pictures are kept until the user changes or deletes them. The records kept per person are these two and the report records — no name, email, or contact details are included in either. The marker attached to them (u1_actor) is not linked to any identity, and all that can be found through that value is the votes it cast and the comments it wrote. Cookie retention is stated per cookie in the "Cookies" clause above. The periods stated here are ones this service sets, and the place those values actually sit is this service's database — who holds that database and where, and how long a deleted item can still be restored there and elsewhere, are set out in the "Third-party provision and processing consignment" and "Destruction procedure and method" clauses. No item this service itself stores is used for advertising, profiling, or automated assessment of individuals — advertising is something Google does with its own cookies, and we neither hand over nor use our comments, nicknames, votes, or counts for it.

Usage measurement is set out separately. If you have agreed to usage measurement, records of what you view go from your browser to Google's measurement tool (Google Analytics). The purpose is one thing: to see which pages are read and how much, by what route people arrive and what they read, and to decide from that what to fix. It is not used to identify individuals or to assess users one by one, nor is it used to choose advertisements — the settings that would put it to advertising use (Google signals, a link to a Google advertising account, advertising features) are not turned on, and were they ever turned on this clause would be amended along with them. The three named here are the ones we know of — that this service has no means of confirming whether other settings do the same thing is recorded in the "Third-party provision and processing consignment" clause below. What is sent concerns the visit — the page viewed and the time, the device and browser type — and the comments, nicknames, votes, and counts this service stores are not sent to that tool. The page address that is sent has the search term removed, although the setting that makes the removed value the one actually used sits on Google's side, so this service's code cannot enforce it end to end. The retention period is a value chosen in Google's settings screen and the default is two months — this service does not extend that default. That screen sits outside this service's code, however, so this page cannot itself prove what it is currently set to. Were it to be extended, this clause would be amended along with it and, as recorded in the "Third-party provision and processing consignment" clause below, you would be told again and asked for your consent again. How the records are handled once sent is governed by Google's policy, and the transfer itself is set out in the "Third-party provision and processing consignment" clause below. If you do not agree, the measurement does not happen at all.

Destruction procedure and method

When personal information has served its purpose or a user asks for deletion, it is destroyed without delay. No item is retained under any other statute. Destruction happens as the user's action is applied directly to the database; no paper records exist. Because what actually happens differs by item, it is stated as it is. Taking down a comment does one of two things, depending on whether it has replies. With no replies the row is deleted outright, together with the votes and reports attached to it — nothing is left on the page. With replies the place is kept (so those replies do not lose their parent); in that case not only the text but the link to its author is severed, so it can no longer be told who wrote it, and the comment also disappears from My activity. Any report filed against it keeps only who, why and when — the reporter's own note is erased. Only reports about display information (nickname, picture) survive the deletion of their target — a record that the procedure was followed must remain for an appeal to be possible, and the comment side differs because once the row is gone entirely there is no longer anything for the report to point at (see the "Purpose of use and retention" clause above). When a vote is withdrawn, that row is genuinely deleted. When a nickname is deleted, the value is removed and comments show the six-character marker again. Profile pictures have one exception: pressing "Remove picture" severs the link between you and the image immediately, but the image bytes already produced remain in storage. The picture's address is already baked into the HTML of problem detail pages, so deleting the bytes at once would leave those pages showing a broken image. These residual bytes are now collected — an image that nothing has pointed to for seven days is deleted. We cannot assert that seven days is ample, however — the party that runs and delivers these pages keeps already-rendered pages for up to 31 days (see (d) below). Until then, the only way to reach such an image is to already know the long address computed from its contents. When an operator takes down display information, the link to the nickname and picture is deleted and that user returns to the six-character marker; the picture bytes are collected in the same way.

That is the extent of what this service can carry out itself. Beyond it there are several places that share one property — places where, even if you ask us to delete or correct something, we have no means of picking out and deleting or correcting that one person's records there. What follows are the ones among them we have confirmed, each with what it holds, whether what you delete reaches it, and when it goes away. We do not assert that this is all of them — where we could not confirm something, we say so at that place.

Two things on the operator's machine. (a) Deploy copies — each time this service is put up as a new build, the database as it stood a moment earlier is written to a single file kept on the operator's machine, so that a failed deploy can be undone. Only what cannot be recreated goes into it — the problem definitions themselves are left out, because they can be rebuilt from the repository. That file contains the comments, nicknames and pictures as they were at that moment; only the 20 most recent are kept, and older ones are removed as new copies are made — they are pushed out by the number of deploys, not by elapsed time. What a user deletes is absent from copies made after the deletion, but remains in copies made before it, until those fall outside the 20 and are removed with them. (b) A copy taken once a day — when the job that automatically authors problem definitions runs each day, the database is written the same way and holds the same things, whether or not that day is one on which authoring actually happens. For this one a single file is kept and replaced on every run — so what a user deletes is gone from this copy at the next run. These two are files: they are not published, do not leave the operator's machine, and are served nowhere — not from any page and not from any API. They are also not encrypted — file permissions restricting them to their owner are the whole of it, and they contain the comments, nicknames and pictures as they stood, in the clear (see the "Security measures" clause below).

Five kept by the companies we consign to — these differ in kind. They are not on the operator's machine but are held by someone else, so we cannot pick one person's records out of them. (c) The change history at the database holder — it keeps a record of recent changes so the database can be rolled back to a point inside that window. A comment a user deletes therefore remains restorable on that side for as long as that window lasts. On this plan the ceiling is six hours, and there is a setting that shortens it or turns it off entirely at zero — the length of that window is ours to choose (picking out one person's records inside it is beyond us here as well). We have left it at the default of six hours. Setting it to zero would, as that company's documentation states, also switch off instant restore and point-in-time queries, which means our own means of recovering from an accident would go with it. We record that this is our own choice rather than something imposed on us. After six hours it falls out of that history without any action from us. (d) That holder's own backups — it states separately that it retains its own backups for 30 days, and when something a user deleted disappears from those backups, and which country they are in, are not published: we have not been able to confirm either. (e) Already-rendered pages — so that they need not be rendered again, the party that runs and delivers these pages keeps them on its own side for up to 31 days, and a problem detail page contains the comment text, nicknames and profile picture addresses as they stood. Such a page is re-rendered and replaced when someone opens it, but if nobody opens it, it remains for that period; the place it is kept is where this service's code runs (the United States). Whether the build artifacts of earlier releases are a separate place that lasts longer than this, we could not confirm — we record what we do not know as unknown. (f) The cache nearest the visitor — separately from (e) there is a cache that keeps responses close to visitors. Which countries it sits in, and how long it keeps them, we have not been able to confirm — two of that company's own documents describe the location differently (20 compute locations versus 126 locations in 51 countries), and we found no place where the duration is stated. (g) Request records — where (a) through (f) hold what users wrote, this is a record kept one line per request (see the "Access records left automatically" clause above). It holds the address requested and any search term, the time, the response code, the browser type and the region that handled it, and the connecting IP address is visible at that point; its retention is not ours to decide and that company states no number of days, so when it goes away we could not confirm. Nor have we any means of deleting one person's lines from it.

Records sent to Google by the usage measurement share the same property — they sit on Google's side rather than in our storage, and this service has put in place no means of recalling and deleting what has already been sent. Those records are deleted on Google's side once the period set in Google's console elapses (the default of two months for event-level records; see the "Purpose of use and retention" clause above), and we neither perform nor verify that deletion. Nor have we put in place any means of deleting one person's measurement records selectively — if you ask for deletion there is no way for us to carry it out for what has already been sent, and what can be done is to withdraw usage measurement consent so that nothing further goes out. The two cookies beginning with _ga left in your browser are not deleted by this service either, so please delete them in your browser settings. The "destroyed without delay" in the first sentence of this clause therefore concerns what this service can carry out itself — the places set out above fall outside it, and we record that rather than hide it.

Security measures

What this service actually does is recorded here. The Google account identifier received at sign-in is combined with a secret known only to this service and converted into an irreversible form before storage, so the original identifier cannot be recovered from what is stored. We record where that secret now lives — it sits in the deployment environment settings of the company that runs the pages (Vercel), because that is where this service's code runs. We have no basis for writing that the company reads it, but that it sits in a place someone else administers is recorded rather than hidden. The cookies used for sign-in, votes, and comments are set so page scripts cannot read them (httpOnly). A content security policy restricts which addresses the browser may contact, and that policy depends on your advertising and usage measurement consent — while you have agreed to neither, nothing but this service's own origin is permitted, so no external script, external font, or external analytics tool is loaded at all. After you agree to advertising the addresses advertising needs are opened, and after you agree to usage measurement the addresses the measurement needs are opened. For the addresses that load scripts and the addresses that data is sent to, only those of the item you agreed to are opened, and agreeing to one leaves the other's scripts blocked. Images are the one exception: advertising creatives are uploaded by each advertiser and their addresses cannot be pinned down, so agreeing to advertising opens every address beginning with https for images alone — and the measurement side's image addresses fall within that. Agreeing to usage measurement only does not widen it that way; just the two addresses it needs are added. External fonts are opened by neither. The point of this measure is that it is enforced by the browser rather than by a document. Profile pictures are re-encoded rather than kept as uploaded, removing attached metadata such as capture location and device information.

There is no place where the operator himself runs the server the public address points to — Vercel runs and delivers the pages, and Neon holds the database. So what this clause can record is not "what we have closed off" but "who holds what". Where personal information is concerned, the operator's machine does two things: it puts up new builds and it takes backups. The database now in use does have an address reachable from the internet — what guards it is not network topology but credentials and an encrypted connection, and this service pins that connection to a mode that verifies the server's certificate (without that, traffic is encrypted but the other end is never checked). That pinning lives in a deployment environment setting rather than in the code, however, so this page cannot itself prove that it currently stands that way.

Traffic between you and the pages is encrypted with HTTPS. The place that encryption is unwrapped, however, is not us. Measured from Korea, the first place it is unwrapped was that company's location in Seoul, and the code that actually renders the pages runs in the United States (Virginia) — two places rather than one, and both are that company's. So it cannot be said that traffic is encrypted end to end such that only we can read it. What is exposed at those points is set out in the "Third-party provision and processing consignment" clause below.

What is not done is also recorded: with a single operator there are no separate staff holding partitioned access, and there is no regular vulnerability review procedure. There is no periodic access-log review either — we neither create nor hold those records, what we can see on screen reaches back one hour, and their retention is not ours to decide (see the "Access records left automatically" clause above). We record both the absence of the procedure and the reason for it. Storage encryption must be split in two: the contents stored in the database are, the holder states, encrypted with AES-256 (that is the company's statement, and we have no means of verifying it). What sits on the operator's machine differs: the deploy copies and the daily copy are files, and they are not encrypted (file permissions restricting them to their owner are the whole of it, and they contain the comments, nicknames and pictures as they stood, in the clear). Rather than write this as though it were otherwise, we record it as it is.

Third-party provision and processing consignment

This service does not sell users' personal information. And we have opened no path out to anywhere we did not bring in ourselves. The places outside this service that personal information reaches are set out below one by one — three of them are processors, and beyond those there is one place we could not decide whether to count among the three. What we cannot write, however, is that those three use it only for the purpose we consigned — two of the three state in their own documents that they may use what arises beyond that purpose, and we cannot narrow it. Rather than hide that, the relevant passages are set out below. The first is the very path by which these pages are run and delivered over the internet, the second is the party that holds this service's database, and the third is the usage measurement that counts how much each page is read. The third happens only if you agree. The second is an axis that did not exist before — the comment text, nicknames and profile pictures users write are stored there, and there is also where they are deleted from. With the third, the data only passes through. The first sits between the two — requests and responses pass through it, and it also keeps already-rendered pages on its own side for up to 31 days. Those pages contain the comment text, nicknames and profile picture addresses as they stood. What actually happens is set out separately below.

There is one place we could not decide whether to count among the three. The email address in the "Privacy officer and contact" clause below is Google's email service, and a message sent there remains in that mailbox (see the "Categories of personal information processed" clause above). Whether a personal mailbox used by one individual should be treated as a processing consignment in the legal sense is arguable, and we have not settled it — recording that we have not settled it is all we can do at present.

Cloudflare is not among the three above — but we do not write that it does nothing, either. That company now does one thing — announcing this service's domain name to the internet (DNS); requests and responses do not pass through it and it does not see their contents.

Among decisions made about what a user has written, exactly one is made by an automated system — when three different people report the same comment or the same profile information, it is hidden automatically (see "About the problem records published here" below). No other such decision is made automatically, and anything hidden is judged again by the operator as a person. (Separately from that, there is a judgement made on every request as to whether advertising or usage measurement may be loaded in this browser — a judgement about the request rather than about a person, recorded in items (8) and (10) of the "Cookies" clause above.)

Processor one — running and delivering the pages. The processor is Vercel Inc., and the work consigned to it is running this service's code, delivering the result, and terminating the encrypted connection (HTTPS). Your browser never reaches the operator's machine; it reaches Vercel, and that is also where this service's code runs. Because the encryption is unwrapped at Vercel rather than at us, Vercel is in a position to see not only the originating IP address, browser type, request time, and requested address but the contents of the requests and responses themselves — including the comments you write, the nickname you choose and the picture you upload, the note you add to a report, and the values exchanged during sign-in. We have no basis for writing "they do not look", so we write "they are in a position to see". Vercel also states in its own documentation that its firewall inspects every request before it reaches the application.

Three things about this consignment we could not confirm. The first is the consignment document. Article 26(1) of Korea's Personal Information Protection Act requires a consignment to rest on a document, and Vercel publishes data processing terms. Those terms, however, state that they apply to customers on paid plans (Enterprise and Pro), and the plan this service uses is the free one; meanwhile the same company's terms of service state, without distinguishing plans, that those terms are incorporated into the contract. The two documents say different things, so whether those terms apply to this plan cannot be settled from the published text alone. The second is the consequence of the first: Vercel's own policy says that only processing governed by those terms falls outside its policy, and that for everything else it acts as a controller. So if those terms do not reach this plan, the very frame of calling this relationship a "processing consignment" is unsettled — we cannot decide that question, so below we record what we actually direct it to do (running the code and delivering it) as a consignment, while recording alongside it that the characterisation is unsettled. The third is the list of parties it consigns to in turn. Article 26(2) of the same Act treats third parties receiving a sub-consignment as subject to disclosure as well, and the company states that the list is at security.vercel.com — but that page requires approval to view, and we never received the whole of it. The names visible without approval are Amazon Web Services, Google, Microsoft, Datadog and Honeycomb, together with SpaceXAI LLC (formerly xAI), Baseten Labs, Cerebras Systems, Fireworks AI, Groq and Invisible Tools (Raindrop.ai), which appear in recent addition notices. We do not record this as the complete list — it is only the part we could read, and what each does and which country it is in is not shown in that public area, so we could not confirm it. This means we are not fully performing on our own pages the disclosure the law requires, and we record that as it is.

Transfer abroad — running and delivering the pages. Because that engagement also moves personal information out of the country, the items Korea's Personal Information Protection Act (Article 28-8) requires to be disclosed are recorded here as they are. The basis we rely on for this transfer is Article 28-8(1)3 of the same Act — we take it to be a consignment of processing and storage necessary to deliver to you the pages you requested, disclosed in this policy in the manner that provision prescribes. Two things, however, we do not assert. One is that, as recorded above, the characterisation of this relationship (consignment or not) is unsettled. The other is that the provision requires the items in paragraph 2 to be disclosed in the policy, and three of the five below are blank. We therefore cannot assert that the requirement is fully satisfied — between writing "blank" and writing "filled", we choose the former. And as recorded in (4) below, Vercel states that it may also use for its own purposes the records generated in the course of using the service; that part is not processing we consigned, so Article 28-8(1)3 does not cover it — for that part we can state no basis at all. (1) Items transferred — the originating IP address, browser type (User-Agent), request time, the requested address (including any search term you typed, if it is part of that address), the response code, the region that handled the request, and the contents of the requests and responses in transit (comment text, nicknames, profile pictures, report notes, and the values exchanged during sign-in). (2) Country, timing, and method — the United States and the other countries where Vercel keeps locations, and the place this service's code actually runs is, at present, the United States (Virginia). That, however, is not a value we have pinned in our repository but the default that company sets, and if it is changed in a settings screen or that company moves its default, this page will not know of it by itself — which is why we write "it is so at present" rather than "we have fixed it". Where requests first arrive is spread more widely, across many countries; measured from Korea, that place was Seoul. The data passes over the network each time you open a page. There is no separate procedure that gathers it and sends it as a file. It does not only pass through, however — so that already-rendered pages need not be rendered again, Vercel keeps them on its own side, in the same place the code runs (the United States). A problem detail page contains the comment text, nicknames and profile picture addresses as they stood. Separately there is a cache that keeps responses close to visitors, and which countries that sits in we could not confirm — two of that company's own documents describe it differently (20 compute locations versus 126 locations in 51 countries). (3) Recipient and contact — Vercel Inc. (440 N Barranca Avenue #4133, Covina, CA 91723, USA), privacy enquiries privacy@vercel.com. As to the parties it consigns to in turn, we could not confirm the whole list, as recorded in the paragraph above. (4) The recipient's purpose and retention period — the purpose we consigned is limited to the running and delivery described above, but it does not end there. Vercel states in its terms of service that records generated in the course of using the service (request records, telemetry and the like) may be used for any business purpose at its sole discretion, and we cannot narrow that. The retention period is not ours to set either: Vercel's own policy governs it, and that policy says only that it keeps such records for the minimum period necessary to meet its legal and contractual obligations and to develop its services, stating no number of days, so we could not confirm it. What we can see of them on screen reaches back one hour, and that is the limit of what is shown to us, not a statement that they are deleted afterwards. One figure is published in days — the rendered pages described in (2) above are kept there for up to 31 days, as Vercel states in its own documentation. So even after a user deletes a comment or removes a picture, a page rendered before that may remain in the United States for that period. (5) How to refuse the transfer, the procedure, and the effect — there is no place to refuse. The transfer happens on the very path that runs and delivers these pages, so there is no way to use this service while leaving that path out. That means there is no option other than not visiting, and rather than write as though one existed, we record that there is none. If any of the five items above changes, we amend this policy at once — because without that, the basis for this transfer itself falls away. We have put in place no means of telling you individually — there is no place in these pages from which a notice can be sent to a user, so rather than promise a notice we cannot deliver, we keep this page current.

Processor two — holding the database. This is the thing the previous policy did not mention at all, and it is the heaviest fact in this revision. The comment text, nicknames, profile pictures and report notes users wrote used to live only on the operator's machine. They are now stored in another company's database in the United States — they do not pass through it; they stay there. The processor, by the service's name, is Neon; the legal entity its terms and privacy policy name as the contracting party is Databricks, Inc. (the parent company of Neon, LLC). The work consigned to it is holding and operating this service's database. The document for this consignment applies without a signature — merely accessing that service constitutes agreement to its platform terms, those terms are subject to the parent company's master agreement, and that agreement incorporates the data processing addendum by reference. That addendum states, conditionally, that it applies "when Customer Personal Data is processed", and contains no wording limiting it by plan, so being on a free plan does not put us outside it — this is where it parts from the Vercel side above, and it is why we do not use the same sentence for the two consignments. That company states in its own documentation that a subset of its employees can reach customer data through controlled procedures, listing customer support, product development and research, troubleshooting, and security as the purposes, and that access requests are logged. Here too we have no basis for writing "they do not look", so we write "they are in a position to see".

Transfer abroad — holding the database. This engagement also moves personal information out of the country, so the same items are recorded. The basis we rely on is Article 28-8(1)3 of the Personal Information Protection Act. Here the consignment document is incorporated automatically, so unlike the transfer above the characterisation does not wobble. Two things, however, we do not assert here either — of the paragraph 2 items the provision requires, two of the five below are blank, so we cannot assert that the requirement is fully satisfied; and as recorded in (4) below, that company lists product development and research among the purposes for which its employees may access customer data, and that part is not processing we consigned, so Article 28-8(1)3 does not cover it. Several of the five items are the opposite of the transfer above, so they are set out separately. (1) Items transferred — everything this service stores: comment text, nicknames, profile pictures, report notes and report records, the votes cast, the visitor and view counts, and the marker created at sign-in. No feature on these pages asks for a name, email or contact details, so they are not here either. (2) Country, timing, and method — the database itself is in one place, the United States (Virginia). It was chosen when the database was created and cannot be changed afterwards. Unlike the transfer above, the data does not pass through; it stays — it is moved at the moment you write a comment, set a nickname or picture, or cast a vote, and remains stored there until you delete it. There is no separate procedure that gathers it and sends it as a file. Even when you only read, one number in the visitor and view counts is incremented there. Two things, however, are not covered by "one place in the United States" — which country that holder keeps its own backups in is not published, so we could not confirm it, and among the sub-processors recorded in (3) below the customer-support group is not tied to the region we chose, one of them (Atlassian Pty Ltd.) being an Australian entity. (3) Recipient and contact — Databricks, Inc. (160 Spear Street, Suite 1300, San Francisco, CA 94105, USA), privacy enquiries privacy@databricks.com. The entity operating the service is named Neon, LLC, but its policy and terms hand over to the entity above, so Neon, LLC's own registered address we could not confirm. The list of parties it consigns to in turn is published, and we record those on our path: what actually holds this service's data is Amazon Web Services in the United States (Virginia), and separately Grafana Labs (United States, infrastructure) is named as a sub-processor of that platform. For customer support and communications the list names Twilio, Atlassian Pty Ltd. (Australia), Microsoft, salesforce.com, Slack and SupportLogic, and their processing locations are not tied to the region we chose. That company's affiliates — some twenty of them, including the Korean entity Databricks Korea LLC — are also stated as entities that "may function as" sub-processors for technical and operational support; which of them actually reaches this service's data is not stated in that document, so we could not confirm it. Sub-processors attached to AI features (Anthropic, OpenAI) are on the list as well, but this service does not use those features. (4) The recipient's purpose and retention period — the purpose we consigned is the holding and operation described above, but here too it does not end there. As recorded above, that company's own documents list product development and research among the purposes for which its employees may access customer data, and we cannot narrow that. The retention period, on the other hand, is ours to set — unlike the transfer above. It is as stated item by item in the "Purpose of use and retention" clause above, and what a user deletes is deleted. There are two places, however, where it does not disappear at once — that holder keeps a record of recent changes so the database can be rolled back to a point inside that window (the ceiling on this plan is six hours, and the setting that shortens that window or turns it off at zero is ours to choose; we have left it at the default of six hours, and we record that this is our own choice rather than something imposed on us), and separately it states that it retains its own backups for 30 days, while when something a user deleted disappears from those backups is not published: we could not confirm it (see the "Destruction procedure and method" clause above). (5) How to refuse the transfer, the procedure, and the effect — there is a place to refuse. This transfer happens at the moment you write, so not writing is a refusal that genuinely works — if you only read, no comment, nickname, picture or vote is stored. Refusing does not affect reading the problem list, the detail pages, search, or filters. What is already stored you can delete at the places set out in the "Your rights" clause below. But the one number in the visitor and view counts that goes up even when you only read cannot be refused — that row holds nothing but a number and a time, and no record of who visited (see the "Visitor and view counts" clause above). If any of the five items above changes, we amend this policy at once — for the same reason as the transfer above, and for the same reason we promise no individual notice.

Usage measurement is a processing consignment too. The processor is Google, and the work consigned to it is counting how much each page is read — it is loaded as a Google Tag Manager container, and Google Analytics does the counting inside it. If usage measurement is loaded after you agree, those values do not pass through this service: the browser sends them to Google directly — the same mechanism as advertising. The character differs, though: advertising is something Google receives for its own purposes, whereas usage measurement is Google counting on our behalf something we want to know, which makes it a processing consignment. That is why it is set out apart from advertising, on the consignment side of this clause. The document for this consignment is the data processing terms accepted in Google's console — Article 26(1) of the Personal Information Protection Act requires a consignment to rest on a document, and if the same material went out without those terms accepted it would be a third-party provision rather than a consignment, which would require a different procedure. This service has therefore settled on accepting them before the measurement is turned on; that console likewise sits outside this service's code, so this page cannot itself prove that it currently stands that way. The settings that would also let Google use this material for its own advertising purposes (Google signals, Google Ads linking, advertising features) are not turned on. Those settings live in Google's console rather than in this service's code, however, so the code cannot enforce them — meaning this page cannot itself prove that they are off. Nor can we assert that this page has counted every such setting in that console — the three named here are the ones we know of, and this service has no means of confirming whether others do the same thing. We record that limit alongside the statement.

Transfer abroad for usage measurement. This engagement also moves personal information out of the country, so the same items are recorded. The basis for this transfer is Article 28-8(1)1 of the Personal Information Protection Act — the data subject's separate consent. So if you do not agree to usage measurement the transfer does not happen, and if you withdraw consent it does not happen from then on. Because the five items below must be told to you before that consent is asked, they are recorded here in advance, and if any of the five changes we do not simply amend this clause: we tell you again and ask for your consent again (Article 28-8(3)). (1) Items transferred — the address of the page you are viewing (with any search term you typed removed), the address of the page you were on before it, values the browser states about itself such as browser type, language, and screen size, the connecting IP address, and the marker stored in the browser for usage measurement. The connecting IP address does not fall under the retention period in (4) below — Google states that it uses it only to determine location and discards it before the data is logged, and that statement and its limits are set out in the "Access records left automatically" clause above. What we do and what we cannot guarantee about removing search terms is set out in the "Categories of personal information processed" clause above. (2) Country, timing, and method — the United States and the other countries where Google keeps servers; that set is not ours to choose but is determined by the data centre locations Google publishes on its own pages. Once you have agreed, the browser sends it directly each time you open a page. There is no procedure on our side that gathers it and sends it as a file. (3) Recipient and contact — Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA), the legal entity named as the contracting party in the Google Analytics Terms of Service this service accepts in order to use usage measurement. The channel for privacy enquiries is the one Google publishes in its own privacy policy (policies.google.com/privacy), and this service has been given no dedicated contact of its own. (4) The recipient's purpose and retention period — the purpose is limited to the counting described above. Here the retention period for event-level records is ours to set, unlike the running-and-delivery side's: it is a value chosen in Google's console, the default is two months, and this service does not extend that default. That console sits outside this service's code, however, so this page cannot itself prove what it is currently set to; it can be checked only in that console. If it is ever increased, we do not simply amend this clause: we tell you again and ask for your consent again. And that setting does not reach everything — how long the aggregated report figures that remain after individual records are deleted are kept is neither ours to set nor known to us, so no period for them is recorded here. (5) How to refuse the transfer, the procedure, and the effect — there is a place to refuse. If you do not agree in the first place, nothing is sent at all; and after agreeing you may withdraw usage measurement consent at "Where to change your advertising and usage measurement consent" below, after which the measurement code is not loaded and the transfer does not happen. Refusing does not affect reading the problem list, the detail pages, search, filters, or comments. But we have put in place no procedure to recall and delete what has already been sent.

Advertising is different in kind, so it is set out separately. If advertising is shown after you agree, Google as the advertising provider receives connection information (IP address, browser type, the address of the page you are viewing) directly from your browser. This is not something we receive and pass on; the browser sends it to Google directly, and the value neither passes through this service nor remains in this service's database. That processing is governed by Google's policy. If you do not agree, the request does not happen at all. There is something to record honestly here — the three above carry the five transfer-abroad items, and advertising does not. That is because we have not settled whether material going straight out from the browser, without passing through us, is a "transfer" that we make, and writing the five items without settling it would be inventing a basis. No advertisement has ever been shown on this service, so no such material has gone out — we will settle this before advertising is actually turned on, and if it is to be treated as a transfer, the five items will be recorded here at that point and consent will be asked again. Pressing sign-in, which takes you to Google's sign-in screen, is likewise the browser going there directly: this service sends Google no user information, and what it receives in return is one account identifier.

Notice for California users

For users in California, the items that state's law requires are set out separately here. The categories of personal information this service collects by observation are three of those enumerated by the California Consumer Privacy Act: "identifiers" (the marker computed from the sign-in account identifier, and the originating IP address), "internet or other electronic network activity information" (the addresses requested, the filters chosen on the list screen, the device and browser type (User-Agent), the response code, and the region that handled the request), and "geolocation data" (a country code derived from the originating IP address). The latter two are collected on every request, whether or not you have agreed to usage measurement — the party that runs and delivers these pages keeps one record line per request, and the country-level location is determined at that same point, before you are asked for consent at all (see the "Categories of personal information processed", "Access records left automatically", and "Cookies" clauses above). What is added if you have agreed to usage measurement is two things — the pages viewed and the times are recorded once more on Google's side, and a city-level location derived from the originating IP address is added to the geolocation category. Precise location such as GPS is neither used nor stored in either case. As to the originating IP address that city-level location is derived from, Google states that it uses that address at collection time to determine location and does not keep it in its records — that is not something we can verify, so we record it as what Google states.

Separately from those three, there are two things users send us themselves. One is comments, nicknames, and pictures, which we did not observe: you posted them for publication. The other is a message sent to the contact email address — it carries the sender's email address and the body, and, for a rights-infringement report under the Terms of Service, a name and contact details; that email address and name fall within the "identifiers" category above (see the "Categories of personal information processed" clause above). The source is you and your browser, and the purposes are set out in the "Purpose of use and retention" clause above. Where each of these sits is recorded separately — the comments, nicknames and pictures users post are stored in another company's database in the United States; a message sent to the contact address stays in the mailbox held by Google's email service; and among the three above, the per-request records sit with the company that runs and delivers these pages (see the "Third-party provision and processing consignment" clause above).

This service does not sell personal information. However, if you have agreed to advertising, Google as the advertising provider receives information directly from your browser, and that may amount to "sharing" as California law uses the term (disclosure for cross-context behavioural advertising). If you do not agree, no such disclosure occurs — this service does not execute advertising code before consent, and a content security policy prevents the browser from making requests to those addresses. So what amounts to opting out of sale and sharing on this service is declining advertising consent, or withdrawing it later. Usage measurement is a separate axis and so is set out separately — what goes to Google there is a record of what was viewed, and the settings that would put it to cross-context behavioural advertising use (Google signals, a link to a Google advertising account, advertising features) are not turned on, so it does not amount to the "sharing" described above. That assessment rests, however, on those three being off — the three named here are the ones we know of, and that this service has no means of confirming whether other settings do the same thing is recorded in the "Third-party provision and processing consignment" clause above. Were those settings turned on, that assessment would change, and this clause would be amended along with them. If you do not want usage measurement either, you can decline it separately from advertising in the "Where to change your advertising and usage measurement consent" clause below. Browser opt-out preference signals such as Do Not Track or Global Privacy Control are not separately read as yet — what those signals address is sale and sharing, and the only thing that falls there on this service is advertising, which does not happen at all unless you agree, so consent itself occupies that place here. Usage measurement, however, is not what those signals address and would not be turned off by them, so it has to be declined separately in that clause, and the fact that the signals are not read is stated rather than hidden.

The California Consumer Privacy Act grants rights to know, delete, correct, and not be discriminated against. This service does not meet that law's business-size thresholds and so bears no obligation under it, but the equivalent actions are available on the pages themselves: you can delete your own comments where they stand, change or remove your nickname and picture at any time on the account page, and clear remembered filters with "Clear all" on the list. There are several places deletion does not reach, and that list is set out in the "Destruction procedure and method" clause above and the "Your rights" clause below. Other access or correction requests are received at the email address in the "Privacy officer and contact" clause below — but there are places where such a request cannot be carried out, and that too is recorded in the "Your rights" clause below. If this policy changes, the change is posted on this page, and the date it was last revised is the recorded-on date in the heading above.

About the problem records published here

The problem records this service publishes are derived from public reporting and public data, and the sentences are ours. As a rule they carry no information identifying a specific individual, and if we judge that identifying content has been published we take it down after checking. Comments are written by users and are not our views. Nobody reads a comment before it appears. However, once three different users report the same comment it is hidden automatically and its text stops being shown. A report can be withdrawn by the person who filed it until a decision is made, and a withdrawn report no longer counts. If we find a comment that identifies an individual or infringes rights, we take it down after checking. Nicknames and profile pictures work the same way — once three different people report them they are hidden automatically from other users, and an operator then restores them if there is no problem or deletes them if there is. Either way the person is notified of the outcome. This service's robots.txt permits collection by search engines and AI crawlers, except for pages that gather one person's activity in one place, such as the account, My activity, and Notifications pages — comments, nicknames, and pictures shown on pages are within that scope, and this is why the clauses above say that what has already been taken cannot be undone.

Your rights

You may request access to, correction of, deletion of, or suspension of processing of your personal information. Three of these can be done directly on the pages: your own comments can be deleted with "Delete my comment" while you hold the same marker (not while the comment is hidden by reports); your nickname and profile picture can be changed or removed on the account page; and remembered filters are cleared with "Clear all" on the list screen. There is one more — advertising and usage measurement consent can be withdrawn item by item at "Where to change your advertising and usage measurement consent" below, and once withdrawn that processing does not happen again. What is actually erased and what remains is set out in the "Destruction procedure and method" clause above. Even after deletion, we cannot undo what someone who already saw the page — or a search or AI crawler — has taken. Note that deleting the marker cookie severs the link to your existing comments, after which you can no longer delete them directly — though for comments written while signed in, that link returns when you sign in again with the same Google account. For requests that cannot be made on the pages (access, correction, and suspension of processing beyond what is described above), write to the email address in the "Privacy officer and contact" clause below.

There are places, however, where such a request cannot be carried out, and we record them in advance. What this service can actually act on is the database now in use. Beyond it there are several places where we have no means of picking out one person's records to show, correct, or delete, and the "Destruction procedure and method" clause above sets out, one by one, the ones among them we have confirmed — the deploy copies and the daily copy on the operator's machine, the change history kept by the database holder and that company's own backups, the already-rendered pages and the cache nearest the visitor held by the party that runs and delivers these pages, the records kept one line per request, and the records that have gone to Google through usage measurement. What each holds and when it goes away is set out in that clause, and we did not assert that those are all such places, either. How they go away also differs — some disappear of their own accord once a period elapses (six hours of change history, 30 days of backups, 31 days of rendered pages), some are pushed out by the number of deploys rather than by time (the 20 deploy copies), for some we could not confirm when they go (the cache nearest the visitor, the request records). For usage measurement there is one thing that corresponds to suspension of processing — withdrawing usage measurement consent, and that place is below on this page. But because this service has no means of picking out a particular user either within those records or in the other places above, we record in advance that requests for access, correction, or deletion cannot be carried out even if we receive them. What we can do is stop anything further from accumulating and wait out each period, and rather than write as though more existed, we record that it does not. A legal guardian may make the same requests through the same route.

Remedies for infringement

If you need help with a personal information infringement, you may seek counselling and dispute mediation from the following bodies in Korea. Personal Information Dispute Mediation Committee — 1833-6972 (www.kopico.go.kr). Privacy Infringement Report Centre — 118 (privacy.kisa.or.kr). Supreme Prosecutors' Office Cybercrime Investigation Division — 1301 (www.spo.go.kr). National Police Agency Cyber Bureau — 182 (ecrm.police.go.kr). If your rights or interests are infringed by a disposition or omission by this service in response to a request under Articles 35 (access), 36 (correction and deletion), or 37 (suspension of processing) of the Personal Information Protection Act, you may file an administrative appeal as provided by the Administrative Appeals Act (Central Administrative Appeals Commission, 110, www.simpan.go.kr).

Privacy officer and contact

The function handling privacy matters and related complaints is "Privacy Desk", reachable by email at ponderloft@gmail.com. Send requests to access, correct, delete, or suspend processing — and any other enquiry — to that address. A legal guardian may make the same requests there. Requests are handled after verification, and the outcome is sent back to the same address. Not every request received can be carried out, however — where it cannot be, and why, is set out in the "Your rights" clause above, and for such requests what is sent back to the same address is the fact that it cannot be carried out, and the reason, in place of the action. And a message sent to this address itself remains: your email address and the body of the message stay in that mailbox, and what kind of place that mailbox is, is set out in the "Categories of personal information processed" and "Third-party provision and processing consignment" clauses above.

The operator’s representative name, address, telephone number, and business name are stated in the “Designated agent under US copyright law” clause of the Terms of Service. This is because 17 U.S.C. §512(c)(2) requires that publication as a condition of the safe harbour, not because Korean law requires it. What the Personal Information Protection Act requires in a privacy policy is the name of the privacy officer or the name of the department and contact details, which is filled in above.

The business registration number is not stated. This service sells no goods or services to visitors, so it is not subject to the disclosure required by Korea’s Act on Consumer Protection in Electronic Commerce. If this service begins taking payment from visitors (paid subscriptions, paid features, donations with something in return), Article 10 of that Act requires the business name, representative’s name, business address, telephone number, email address, and business registration number all at once. This field would be filled then. There is no such plan at present. You can reach us at the email address above at any time.

Where to change your advertising and usage measurement consent

Changes to this policy

If this policy changes, the change is posted on this page. The date it was last revised is the recorded-on date in the heading above. There is currently no place that shows the before and after side by side — the revision history lives only in the repository's change log, and the page carries only the latest version.