Privacy Policy

1. Purpose of Processing

JOLIMITALK is a messenger service that provides conversations with the AI character Jolimi, messaging between users, an image and sticker studio, and the Tea House game. We process personal information for the following purposes.

• To register members, sign users in, and verify identity.
• To provide messaging features such as conversations, group chats, attachment sending, and location sharing.
• To generate Jolimi's AI responses, images, and stickers (see the appendix in Section 13).
• To operate charging, deduction, and refunds of Marron and in-game currency.
• To send communications necessary for operation, such as push notifications and email.
• To link a JOLDISK account and display organization information, where the user chooses to do so.
• To block illegal content, respond to security incidents, and improve the service.

2. Personal Information We Collect

• At sign-up, we collect your email address, password, and name (Korean and English) as required items. Passwords are stored only in a form that cannot be restored.
• When you sign in with a social account, we collect the unique account identifier and the verified email address provided by the provider (Apple, Google).
• While you use the service, the following are automatically generated and collected: sign-up and sign-in times, IP address, country code derived from the IP address, device and browser information, trusted-device registration information, and service usage records.
• Messages you enter, attachments (photos, videos, documents), images and stickers you create or upload, game progress data, and affinity records are stored as you use the service. Contacts you share are delivered as part of a message and are not stored separately.
• Location information is processed only if you consent. When you share a location in a chat, the coordinates you choose to send are stored as a message. For weather and nearby recommendations, we use only an approximate, neighborhood-level location and do not store precise coordinates. Details follow the Location-Based Services Terms.
• When you make a payment, we collect the store payment receipt, transaction identifier, purchased item, and amount. Payment method information such as card numbers is processed by Apple or Google, and we do not collect it.
• If you allow push notifications, we collect your device's push token.
• If you link JOLDISK, we receive your JOLDISK account, organization, and member display information within the scope you consented to.

3. Processing and Retention Period

As a rule, we retain personal information until you withdraw your membership. When you withdraw, your account information (email, name, password) is anonymized immediately. However, the following are stored separately for the period required by law and then destroyed.

• Original records such as conversations and images are retained for 1 year under Article 15-2 of the Protection of Communications Secrets Act and Article 83 of the Telecommunications Business Act.
• Payment and transaction records are retained for 5 years under the Act on the Consumer Protection in Electronic Commerce.
• Records of consumer complaints and dispute resolution are retained for 3 years under the same Act.
• Access logs are retained for at least 3 months under the Protection of Communications Secrets Act.
• Closed-tester application records are retained for 1 year from the date of application.
• Push tokens are deleted when you turn off notifications or withdraw.

4. Provision to Third Parties

As a rule, we do not provide your personal information to third parties. We provide it only in the following cases.

• JOLDISK linking (where you have consented directly): we provide JOLDISK with an account identifier to confirm the link, and we receive organization and member display information from JOLDISK. This stops when you unlink.
• When an investigative agency or other authority requests it through a procedure set out by law.

5. Entrustment of Processing

• We entrust the sending of operational email (notifications, replies to inquiries) to ForwardMX.
• We entrust the delivery of mobile app push notifications to Expo (Expo Push Service).

We operate our servers and databases ourselves, and there is no separate hosting contractor.

6. Transfer Outside Korea

In the course of generating AI responses and images and verifying payments, personal information is transferred outside Korea as described below (Article 28-8(1)(3) of the Personal Information Protection Act: where necessary to perform a contract and notified through this Policy). If you do not want this transfer, you may choose not to use the relevant features (AI conversations, image generation, in-app purchases); in that case, use of the service's core features will be limited.

• Anthropic (United States): Your messages with AI characters and the conversation context are transferred to generate AI responses, translations and conversation summaries. Under Anthropic's commercial terms, this information is not used to train models and is deleted by Anthropic within 30 days.
• Google (United States): Inputs for image and sticker generation (descriptions, reference images), proper-noun detection in messages and real-time search context, push notification delivery, and Google Play payment receipt verification information are transferred. Under Google's paid API terms, AI processing data is not used to improve Google's products and is kept for 55 days for abuse monitoring before deletion.
• OpenAI (United States): Image generation inputs (descriptions, reference images) and uploaded and generated images are transferred to generate images and check for harmful content. This information is not used to train models and is kept for up to 30 days for abuse monitoring before deletion.
• Apple (United States): App Store payment receipt verification and push notification delivery information are transferred.

Transfers take place over encrypted connections at the time you use the relevant feature, and the information is retained and used only until each purpose is achieved. You can contact each company through its own privacy inquiry channel.

7. Destruction Procedure and Method

We destroy personal information without delay once its retention period has passed. Electronic files are deleted in a way that cannot be recovered, and information that must be stored separately by law is kept in access-controlled storage and destroyed in the same way when the period ends.

8. Your Rights

You may at any time request access to, correction of, deletion of, or suspension of processing of your personal information, and you may withdraw your consent. You can do this yourself in the account settings in the app, or by contacting us at the address in Section 14; we will notify you of the result within 10 days. The legal guardian of a child under 14 may exercise the same rights with respect to the child's personal information.

9. Automatic Collection Tools

We do not use advertising or behavioral tracking cookies. We store an authentication token to keep you signed in and your display settings (such as theme) on your device (localStorage), and you can delete them through your browser settings. Our servers keep access logs for security and quality management.

10. Security Measures

• Passwords are stored with a one-way hash, and linking tokens are stored encrypted.
• All communications are encrypted in transit.
• Access rights are kept to a minimum, and administrator actions are recorded in audit logs.
• We operate monitoring and alerting to prepare for security incidents.

11. Children Under 14

The service is available to users aged 13 and over (Article 3 of the Terms of Service). A child under 14 (aged 13) needs the consent of a legal guardian to sign up, and we may request the minimum information needed to confirm that consent (the guardian's name and contact details). If we find that information was collected without a legal guardian's consent, we destroy it without delay.

12. Operator Review of Content

To prevent the distribution of illegal information (Article 44-7 of the Act on Promotion of Information and Communications Network Utilization and Information Protection, and Article 22-5 of the Telecommunications Business Act) and to diagnose service defects, the operator may review stored content to the minimum extent necessary. Such reviews are logged and are not used for any other purpose.

13. Generative AI Services Appendix

This section follows the generative AI appendix format of the Guidelines for Preparing Privacy Policies (April 2026).

• Generative AI is used for conversations with Jolimi (including group chats), image and sticker generation, and Jolimi's lines in the game. The screen indicates that these are the character's responses.
• Your messages and uploaded images are sent to external AI models (Section 6) only to generate responses, translations, summaries and images. Under each provider's API terms, these inputs are not used to train models.
• AI responses and images may be inaccurate or differ from the facts, so please verify them separately before making important decisions.
• Please take care not to enter other people's personal information or sensitive information in conversations or generation requests.

14. Privacy Officer and Contact

Privacy Officer: Operator (JOLIVERSE) · Contact: joliverse@joliverse.net. You can also report or seek advice on privacy violations from the Personal Information Infringement Report Center (privacy.kisa.or.kr · 118) and the Personal Information Dispute Mediation Committee (kopico.go.kr · 1833-6972).

15. Changes to This Policy

We may revise this Policy to reflect changes in law or in the service. Changes that are important to your rights, such as the items collected, purposes, or retention periods, will be announced in the app from 7 days before they take effect; minor changes will be posted on this page when they take effect.

Effective date: 2026-10-09 (AI items in Sections 6 and 13 revised) · Previous effective date 2026-08-31 · Terms of Service · Location-Based Services Terms

Revision history

• Version 2 · 2026-10-09 (Current)
• Version 1 · 2026-08-31