Privacy policy

This English text is a translation of the Korean privacy policy for readers. If the two differ, the Korean text applies.

KTimeCapsule (the "company") sets out this privacy policy under Article 30 of the Personal Information Protection Act, to protect personal information and to handle related complaints. It applies to "KTimeCapsule K's Promise" (https://time-capsule-mocha-five.vercel.app, the "service").

Article 1 (Purposes)

The company processes personal information for the following purposes and does not use it for other purposes. If a purpose changes, the company takes the steps required by Article 18 of the Act.

1. 1.Providing the service: writing and sealing a message, managing the open time, sending the open-notice email when that time arrives, and showing the message through the open link
2. 2.Payment and performing the contract: charging the fee, confirming payment, and handling refunds
3. 3.Handling complaints: receiving inquiries and complaints, telling you the result, responding to disputes, and using the name you enter at seal time (a real name or a pseudonym) to confirm identity and to handle inquiries and refunds
4. 4.Legal duties: keeping records required for electronic commerce
5. 5.Keeping the service stable: checking errors, preventing misuse, and maintaining security

Article 2 (Items processed)

1. 1.The company provides the service without membership signup and processes the following.

1. 2.Card numbers and the payer's email are collected by the payment provider on its own checkout page. The company does not store them, and does not send the email you typed on the write screen to the payment provider as the payer's email.
2. 3.Please avoid putting sensitive information in the message, such as a resident registration number, account number, or health information, and avoid putting someone else's personal information there.
3. 4.The sender must enter only a recipient's name and email that they are allowed to share. An open-notice email is sent to the recipient, and that email shows the recipient's name and the sender's name. The write screen says this as well. If KakaoTalk is chosen, a mobile number is entered too.
4. 5.The name is what you type yourself. The company does not run a paid identity check through a mobile carrier or a card. There is no login. You can use the service without your real name. You are responsible for problems that arise because your identity cannot be confirmed.
5. 6.The recipient's name, the recipient's email, the sender's name, the sender's email, and the mobile number (optional, when receiving by KakaoTalk) are stored encrypted the same way as the message body (AES-256-GCM). The open-notice email includes the sender's name and the recipient's name. The seal-confirmation email is sent to the sender's email and does not include a name. The company does not write names or full email addresses in its logs.
6. 7.The service does not collect a per-participant note. For a promise together, the invite screen shows the title, the creator's name, the open time, the fee, and the promise content the first time that invite link is opened, so an invited participant can review it before joining. Opening the same link again does not show the content; the creator has to issue a new invite link. The content is available only through that invite link, and not after the participation deadline or the seal. After the seal, nobody can view it until the open time.
7. 8.When one person enters several recipients (up to 20), each name and email is format-checked, and at the open time each person receives an open notice that greets them by name. The price is the per-seat amount times the number of people. Including the sender as a recipient counts as a seat. An undeliverable address is never charged.

Article 3 (Children under 14)

The company does not offer the service to children under 14. A promise can be created only after the required "14 or older" box is checked. If the company learns that it has collected a child's personal information, it deletes it without delay.

Article 4 (Retention)

1. 1.The company keeps personal information only for the period required by law or the period told to you when it was collected.
2. 2.Retention by item:

A block capsule's contents and attached files are deleted when the storage period ends.

1. 3.The following records are kept for the statutory period. They do not include the message body, the email address, or the name, and they are stored apart from the message.

Article 5 (Destruction)

1. 1.The company destroys personal information without delay when the retention period ends or it is no longer needed.
2. 2.Payment records that must be kept by law are stored apart from the message body, email address, and name.
3. 3.Procedure: an automatic job runs at the top of each hour and selects drafts, message bodies, email addresses, names, and payment records whose Article 4 period has ended. Information past its period is destroyed within an hour. The job records when it ran and how many items it processed, without the personal information itself.
4. 4.Method: electronic files are deleted from the database so they cannot be restored. Encrypted bodies and names are deleted as ciphertext. Paper, if any, is shredded or incinerated.
5. 5.Copies left in the database provider's backups are deleted when the backup retention ends (up to 14 days). If data is restored from a backup, information that should already have been destroyed is destroyed again right after the restore.

Article 6 (Third-party provision)

The company processes personal information only for the Article 1 purposes and does not provide it to a third party except with consent or where Articles 17 and 18 of the Act allow it. Sending the open notice to the recipient and the seal confirmation to the sender is performing the service the user asked for, not providing personal information to a third party. There is no third-party provision at this time.

Article 7 (Processors)

1. 1.The company entrusts processing as follows so it can provide the service.

1. 2.Payment is made through Toss Payments.
2. 3.Entrustment contracts state the limits in Article 26 of the Act, including no use beyond the entrusted purpose, security measures, limits on sub-processing, supervision, and liability. The company supervises the processors.
3. 4.If the work or the processor changes, the company publishes the change through this policy without delay.

Article 8 (Overseas transfer)

1. 1.To perform the service contract, the company entrusts and stores personal information overseas under Article 28-8 (1) 3 of the Act (processing and storage needed to conclude and perform a contract with you, disclosed in this policy).

1. 2.The database (Supabase) runs in the Republic of Korea (Seoul).
2. 3.If you do not want an overseas transfer, do not use the service, or ask the privacy officer to delete your information. The work above is necessary to provide the service, so refusing the transfer means you cannot use the service.
3. 4.Protections for overseas transfers include encryption in transit, encrypted storage of the message body and the name, and review of the processor's data terms, as in Article 29-10 of the Enforcement Decree.

Article 9 (Who may read a message before it opens)

Until the open time, nobody — including the author — can read a sealed body through the service screens or features. The exception is a promise together: the first time an unused valid invite link is opened, and only before the seal (before the participation deadline), the server decrypts the body before the open time and shows it on the invite screen once so an invited participant can review it. Opening the same link again does not show the body again. After the seal, the service decrypts the body only after the open time. The body is stored with AES-256-GCM. The decryption key is kept in a server environment variable, separate from the database. The company does hold that key, so decryption is technically possible. Aside from that invite-link case and an unavoidable case such as incident response or a legal duty, the company does not decrypt or read the body.

1. 1.The open-notice email does not include the message body. KakaoTalk notifications and SMS contain only the open link. After the seal, the body is available only through the open link.
2. 2.There is no member login. You can use the service without your real name. You are responsible for problems that arise because your identity cannot be confirmed. Anyone who has the open link can read the body after the open time. Keep the link to yourself.

Article 10 (Your rights)

1. 1.You may ask the company to access, correct, delete, or suspend processing of your personal information.
2. 2.Cancel delivery / delete: the "Cancel delivery / delete" control on the open-link screen destroys that message's body, email address, and name immediately. There is no account, so the person who holds the link is treated as the requester, after a confirmation that the deletion cannot be undone. Deleting before the open time stops the open-notice email.
3. 3.Other requests can be sent to alltimecapsule@gmail.com. The company acts within 10 days of receiving the request and tells you the result. It checks that the requester is entitled to the message by way of the open link and the email address stored with the message.
4. 4.Payment records that must be kept by law are not deleted with the message. They are kept separately, without the body, email address, or name, for the Article 4 period. Refunds of the fee follow the refund policy.
5. 5.Because of the seal, a request to read the body before the open time may be refused, and the company will tell you why.
6. 6.A legal representative or an agent may exercise these rights. A power of attorney is required.
7. 7.Access and suspension requests may be limited under Article 35 (4) and Article 37 (2) of the Act.

Article 11 (Safeguards)

The company takes the following measures.

1. 1.Administrative: personal information is handled by one person, the representative. An internal data-protection practice is in place. If the operator has to look in the database, the reason and time are recorded.
2. 2.Technical
3. (1)All traffic between you and the service uses HTTPS, with HSTS.
4. (2)The message body and the name are encrypted in the application with AES-256-GCM (a random 96-bit IV per record). The decryption key is kept in a server environment variable, separate from the database.
5. (3)The database is reachable only with the server's management key, and row-level security blocks other access.
6. (4)The database runs on storage encrypted by the cloud provider.
7. (5)Secrets are kept only in restricted server environment variables. They are not in source code or the browser. Preview deployments cannot reach production database, mail, or payment keys.
8. (6)Before the open time, the server decrypts the body and sends it to a screen only the first time an unused valid invite link for a promise together is opened, and only before the seal (before the participation deadline). It does not decrypt the body to show that link again. After the seal, the server decrypts the body only after the open time.
9. (7)Security headers (content security policy, frame blocking, and others) are set, and write, payment, and delete requests are rate-limited.
10. (8)A payment-complete signal is applied only after the provider's signature is checked.
11. (9)Error and job logs written by the service do not include the message body, the name, a full email address, or an open link. The host's access logs may include the request URL (including an open link) and are deleted after the Article 4 period.
12. 3.Physical: the servers and the database run in the processors' data centers with access control.

Article 12 (Cookies)

1. 1.The company uses two cookies. "yak-locale" remembers Korean or English, stores only the language, and lasts one year. "yak-invite-session" lets the browser that first opened an invite link finish joining and paying. It stores only a signature bound to that link, does not store the promise content, and lasts 2 hours.
2. 2.To show the list of messages you created ("My promises"), the browser stores the open-link id, the open time, and the status. It does not store the message body, the email address, or the name, and that list is not sent to the company.
3. 3.The company does not use cookies or tools for analytics, advertising, or behavioral tracking.
4. 4.You can refuse cookies or clear site storage in the browser. The language choice may not stick, joining and paying after opening an invite link may not finish, and "My promises" may not appear.
5. ·Chrome: Settings > Privacy and security > Third-party cookies / Clear browsing data
6. ·Safari: Settings > Safari > Advanced > Website Data
7. ·Edge: Settings > Cookies and site permissions

Article 13 (Privacy officer)

1. 1.The company designates the following privacy officer for complaints and remedies.

1. 2.You can contact the privacy officer about any privacy question, complaint, or harm related to the service. The company answers and handles it without delay.

Article 14 (Remedies)

You may apply to the following bodies for dispute resolution or advice about a privacy infringement.

1. 1.Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
2. 2.Personal Information Infringement Report Center: 118 (privacy.kisa.or.kr)
3. 3.Supreme Prosecutors' Office: 1301 (www.spo.go.kr)
4. 4.National Police Agency: 182 (ecrm.police.go.kr)

Article 15 (Business information)

Article 16 (Changes)

1. 1.This privacy policy applies from 30 September 2026.
2. 2.If this policy is added to, deleted, or revised, the company gives notice on the service at least 7 days before the change. A change that materially affects your rights is announced at least 30 days before.
3. 3.Previous policy: the 26 September 2026 version (before the name item was collected). The 30 September 2026 version added the name during the soft launch and, on the same day, was revised to record the recipient's name and email (to send the open notice) separately from the sender's name and email (seal confirmation and showing who it is from).