Privacy Policy

Effective October 10, 2026 · platelog · Support

platelog (the "app") is an app for sharing meal photos with a small crew of 2 to 6 friends, partners, or family. This document explains what information the app receives, when and why, who can see it, and how to delete it.

1. Information we collect

We don't collect location data, and EXIF metadata is removed from photos before they're stored. The app doesn't ask for photo library access (when you send a photo in the room, it only receives the photos you pick in the system picker). There are no ads, no tracking, and no third-party behavioral analytics tools.

Photo-based meal analysis isn't available yet. If it's added, we'll update this document first and ask for your consent in the app.

2. Who can see it

Photos, messages, and reactions can be seen only by members of the same crew. There's no public feed. The operator accesses them only as far as needed to run the service (handling outages).

3. Where it's stored and who processes it

To run the app, we entrust processing to the companies below. Information is sent to them over the internet as you use the app.

• Supabase Pte. Ltd. (a Singapore company; servers in Tokyo, Japan, ap-northeast-1): database and file storage, and sign-in. It keeps all the information in section 1 until you delete your account (section 5). Contact: privacy@supabase.com
• Apple Inc. (United States): delivering notifications to iPhone (APNs). It handles the push token, the notification text (member nicknames, message and comment text), and a photo thumbnail URL that works for only 10 minutes, for as long as delivery requires (under Apple's policy). Privacy contact
• Google LLC (United States): delivering notifications to Android (FCM). The information sent and how it's kept are the same as for Apple (under Google's policy). Privacy contact

If you don't want your information sent this way, you can stop using the app and delete your account. You won't be able to use the app after that.

4. How we keep it safe

• Every database table has row-level permissions, so the server gives photos, messages, and reactions only to members of the same crew.
• The server admin key stays on the server and is never put in the app.
• Data is sent over TLS and encrypted when stored. Photos are read only through signed URLs that expire quickly, and EXIF metadata is removed before storage.
• Personal information is handled in Korea (the operator), Japan (servers), Singapore (Supabase), and the United States (Apple, Google). We check each country's data protection rules and take the measures above.

5. Retention and deletion

• When you delete a post or message, it disappears right away, and its files are deleted shortly after.
• If you choose how long to keep photos in Settings (Forever · 30 days · 90 days · 1 year), older photos are deleted automatically every day.
• You can delete your account right away in the app's Settings. Your photos, posts, reactions, messages, and device tokens are deleted with it. If you were the leader, the role passes to the member who joined first (if you were the only member, the crew is deleted too).
• Deleted records may remain in restricted database backups until they expire under the active service plan. Supabase database backups do not contain photo files. Provider security logs and voluntary support correspondence have separate retention purposes. Copies that members previously downloaded or shared cannot be erased from their devices.

6. Notifications

You can turn each type of notification on or off in the app. When a type is off, the server doesn't send it.

7. Your rights

In the app, you can export your photos (Settings → Me → Export my photos), delete photos and messages, and delete your account at any time.

For anything else, such as accessing, correcting, or deleting your information, stopping its processing, or learning its purposes of use or the records of what was provided to third parties, email the address below. To confirm it's you, include the email address of the account you sign in with (or your nickname and crew name). Once confirmed, we'll handle it without delay, free of charge.

8. Operator and contact

• Operator and controller: JUNEYOUNG KIM, an independent developer based in South Korea using the name lpaiu. Contact: lpaiu.cs@gmail.com. A postal contact can be requested by email.
• Privacy officer, questions, and complaints: the operator, lpaiu.cs@gmail.com
• In Korea, you can also seek advice or file a report with the Personal Information Dispute Mediation Committee (1833-6972, kopico.go.kr) and the Personal Information Infringement Report Center (118 from within Korea, privacy.kisa.or.kr).
• If you live in Japan, you can also contact the Personal Information Protection Commission's consultation line (03-6457-9849, weekdays 9:30–17:30 JST).

If this document changes, we'll update the effective date and announce it on this page and in the app's update notes.

This page is a translation of the Korean version. If they differ, the Korean version prevails to the extent permitted by applicable law; your mandatory rights are preserved.

9. Additional processing and privacy rights

Crew memberships, invite information, notification preferences, reports and blocks are stored to operate the crew and safety features. Providers may generate connection and security logs such as IP addresses, timestamps, account references and errors to operate and protect the service. They are not used for behavioral advertising. If you email support, the developer receives the details you send; see website and support privacy.

Where required by law, account and sharing functions rely on processing needed to provide the service you request; optional features use consent where required; security, reports and support rely on legitimate interests in running a safe service, and legal obligations may require limited processing. Do not upload sensitive medical records or other people's information without the permissions required by applicable law. We do not sell personal information, share it for targeted advertising, or use it for automated decisions with legal effects.

Depending on the law that applies, you may request access, correction, deletion, portability, restriction or objection, withdraw consent where it is relied on, or complain to a local privacy regulator. We respond within applicable legal deadlines and explain any refusal or permitted extension. Verification uses only information necessary to establish that the request relates to your account; a nickname and crew name alone may not be sufficient. Never send passwords or one-time login codes. Support information is retained only while needed for the request and necessary follow-up or a legal obligation. Core account data is retained while the account is active; removed content follows the deletion and cleanup process in section 5.

Services are operated from South Korea, with the recipients and countries described in section 3. Contact us for information about the safeguards applicable to your information or to raise a concern about an international transfer.