Teampler Privacy Policy

Effective date: 2026-08-19 Last updated: 2026-08-19

Teampler (“the App”) establishes and discloses this Privacy Policy in accordance with Article 30 of the Personal Information Protection Act (Republic of Korea), to protect personal information of data subjects and to promptly and effectively handle related grievances.

The App is a cloud service used after authentication via social sign-in (OAuth) or an email-and-password account. After sign-in, some data is stored on the operator’s server to enable multi-device sync and real-time collaboration, and some data is also cached on the user’s device for fast restore.

Users may sign out or delete their account at any time to permanently delete server-side data.

1. Personal Information Processed

1.1 Account & service data (stored on the operator’s server)

Depending on the sign-up method (social sign-in or email-and-password), the following items are stored on the operator’s server.

• Account identifiers
  • Provider (google / apple / kakao / email)
  • Provider user ID (sub) — internal identifier, not displayed
  • Email (for social sign-in, if shared by provider — may include Apple Hide My Email relay; for email-and-password sign-up, entered directly by the user)
  • Display name (as set in the provider for social sign-in, or entered by the user for email-and-password sign-up)
• Email-and-password accounts (only if signed up this way)
  • Password — stored only as an argon2 hash; the plaintext password is never stored.
  • Email verification code (OTP) — used to confirm sign-up. Stored hashed (SHA-256) in a temporary store (Redis) for up to 10 minutes and discarded immediately after verification.
• Authentication tokens
  • JWT issued by the app (7-day validity, stored in device SecureStore)
  • Expo Push Token (optional, only if notification permission granted)
• Team and session data
  • Team name, members (name/grade/role: host|admin|member), court settings
  • Session data: queue, court slots, participants, guests
  • Session start/end times, queue entry timestamps
  • Meeting records: summaries of ended meetings and per-attendee wait/play time statistics (including attendee names)
  • Cumulative member activity statistics: totals for attendance count, play time, and wait time (numbers only)

1.2 Data cached on the device

For fast restore and offline display, copies of the team/session data above and app settings are cached on the user’s device in local storage (AsyncStorage), and authentication tokens are stored in secure storage (SecureStore). This data never leaves the device and is removed when the app is deleted or the account is deleted.

1.3 Automatically collected information

• Standard HTTP metadata during API calls (IP address, User-Agent) — short-term logs for operational debugging
• App version and platform (iOS/Android) — sent as API request headers and used to notify you when a version is no longer supported
• Tokens routed via Expo Push infrastructure for notification delivery
• Information sent to Expo EAS Update servers when the app checks for updates — platform, app build identifier (runtimeVersion), release channel, and an installation identifier. No account, team, or session data is included.

The App does NOT use analytics, advertising, or crash-tracking SDKs. No advertising identifiers, cookies, or tracking pixels are used.

2. Purpose of Processing

Stored information is used only for the following purposes.

• User identification and authentication via social sign-in or email-and-password
• Sending and verifying the email verification code (OTP) for email-and-password sign-up
• Multi-device synchronization of team/session data (including real-time WebSocket)
• Session operation (court placement, queue management)
• Restoring previous state from the on-device cache on app relaunch / offline
• Sending push notifications (only when permitted)

The App does NOT use personal information for marketing, advertising, profiling, or automated decision-making.

3. Retention and Use Periods

Upon account deletion, the user’s account, teams (including teams they host), sessions, and invite codes are permanently deleted.

4. Third-Party Disclosure

The operator does NOT disclose user information to any third party for advertising, marketing, or profiling purposes.

However, the following infrastructure providers process data on the operator’s behalf. The scope and purpose are described in section 5.

• Google, Apple, Kakao (social sign-in)
• Amazon Web Services (server hosting)
• MongoDB Atlas (database)
• Amazon Web Services (sending the verification-code email for email-and-password sign-up — Amazon SES)
• Expo (push notification delivery, app update distribution)
• Google Firebase Cloud Messaging (Android) · Apple Push Notification service (iOS) (push message delivery to devices)

5. Outsourcing of Processing

Each processor follows its own privacy policy. The operator applies contractual safeguards to ensure data subject rights are preserved.

6. Deletion Procedures and Methods

• Procedure
  • Local cache: Deleted when the app is removed or the account is deleted
  • Cloud data: On “Delete account”, the server transactionally removes the account, hosted teams, sessions, and invites
  • Sign-out: The device JWT is deleted immediately, and the server registers the JWT in a revocation list
• Method
  • Local: Permanently deleted via the OS app-data deletion mechanism
  • Server: Permanently deleted from MongoDB Atlas. Backups are rotated and deleted within 7 days per operator policy

Users can delete their data by:

1. Sign out — Settings → Account → “Sign out” (server data retained; device tokens revoked)
2. Delete account — Settings → Account → “Delete account” (both server and local data permanently deleted)
3. Remove the app — Delete the app from the device (only the local cache is deleted; server-side cloud data remains)
4. Request deletion by email — Even if you cannot access the app (e.g., after uninstalling or unable to sign in), email support@teampler.com with the email you signed up with; after identity verification we will permanently delete your account and related data (within a few business days).

7. Rights of Data Subjects

Under Articles 35-37 of the Personal Information Protection Act, users have the right to access, correct, delete, and suspend processing of their personal information.

• Access: In-app screens, or request via the contact in section 13
• Correction: Directly edit member name/grade in Team Settings
• Deletion: Use the “Delete account” method in section 6
• Suspension: Sign out or remove the app

For additional inquiries, contact the privacy officer in section 13.

8. Security Measures

• Transport encryption: All server communication uses HTTPS/WSS (TLS 1.2+).
• Token security: JWTs are stored in the device’s OS secure storage (SecureStore — iOS Keychain / Android Keystore) and cannot be accessed by other apps.
• Password security: Passwords for email-and-password accounts are stored only as argon2 hashes; plaintext is never retained. Email verification codes (OTP) are likewise hashed, stored temporarily, and discarded immediately after verification.
• Immediate revocation: When a user signs out, the JWT is added to a server-side revocation list (Redis blocklist), invalidating it even if intercepted.
• Minimum permission principle: The app does NOT request camera, location, microphone, contacts, or photo permissions.
• OAuth ID token verification: Social sign-in ID tokens are verified directly using each provider’s public keys.
• No analytics/ads/crash SDKs: The app does not include any SDK that tracks user behavior.

9. Automatic Collection (Cookies, etc.)

The App does NOT use cookies, advertising identifiers (IDFA/AAID), or tracking pixels.

10. Children Under 14

The App is not directed at children under 14 and does not knowingly collect personal information from them.

11. App Permissions

The App uses only the following OS permissions, all requiring explicit user consent.

• Network access (internet & network state): Server communication, and connectivity detection (offline indicator / auto-reconnect)
• Push notifications (optional): For session notifications from other hosts (only when user permits; not required for app functionality)

The App does NOT request camera, location, microphone, contacts, or photo permissions.

12. Cross-Border Transfer

The operator’s server is located in the Korea region (Seoul). However, transfers outside Korea may occur in the following cases.

• Expo push infrastructure: Push notification tokens and payloads are routed via Expo servers in the United States. Notifications do not include personal information (e.g., “It’s your turn”).
• Push message delivery (FCM/APNs): After Expo, push messages are delivered to devices via Google Firebase Cloud Messaging (Android) or Apple Push Notification service (iOS); tokens and payloads are routed through Google/Apple servers in the United States in this process. Notifications do not include personal information.
• App update distribution (Expo EAS Update): On launch the app contacts Expo servers (u.expo.dev) in the United States to check for updates; platform, app build identifier, release channel, installation identifier, and the connecting IP address are transmitted. No account, team, or session data is sent.
• OAuth providers: During authentication with Google, Apple, or Kakao, the app accesses each provider’s public-key endpoints for ID-token validation. No additional user data is transferred.

Transfer items, countries, dates, methods, recipients, purposes, and retention periods are disclosed throughout this policy. Users may refuse cross-border transfer by declining (since the App requires sign-in, it then becomes unavailable).

13. Privacy Officer

The app operator is responsible for personal information processing and grievance handling.

• Name: Teampler Operator (No1Joon)
• Email: support@teampler.com

Users may direct any inquiries, complaints, or remedy requests related to personal information to the above contact.

14. Remedies

Users may contact the following bodies for dispute resolution and counseling regarding personal information violations.

15. Policy Changes

If this Privacy Policy is added to, deleted from, or amended, the changes will be announced on this page at least 7 days before they take effect. For changes that materially affect user rights, notice will be given at least 30 days in advance.

16. Contact

For inquiries regarding this policy, please contact:

Email: support@teampler.com