Piecepool Privacy Policy

Article 1 (Items of Personal Information Collected and Methods of Collection)

(1) The Company collects only the minimum personal information:

(2) The Company does not store the email address of the Google or Apple account and stores only the unique ID used to identify the account. For Members who sign in with Apple, however, the Company also stores an authentication token used to revoke the connection with the Apple account upon withdrawal.

(3) The Company does not collect or store the following information in the features below. Music recognition (iOS app): from when the user taps the recognition button until recognition ends, the nearby sound heard through the microphone is turned on the device into an irreversible signature and sent to Apple (Article 4 (4)); the audio itself is not saved as a file and is sent neither to the Company nor to Apple. Only the song identifier returned as the result is used to look up song information. Microphone access can be turned off at any time in the device settings.

Article 2 (Purposes of Collection and Use of Personal Information)

1. Confirming the intent to register, and identifying and managing Members

2. Providing the core functions of the Service, such as dig records

3. Receiving and handling inquiries and reports, and replying with the results

4. Preventing and sanctioning improper use (violation of the Terms, manipulation of the evaluation systems, false reports, etc.)

5. Analyzing usage statistics to improve the Service (service usage records are analyzed linked to the Member's account)

6. Artist early access: notifying sign-ups when the artist upload space opens, and related notices

7. Contact regarding verified artists and POOL-registered content: requesting clarification on infringement reports and notifying their outcome, operational notices about registered content, and forwarding distribution or collaboration offers

8. Providing service notifications such as likes, follows, digs, DROP reveals and report outcomes (the in-app inbox and app notifications)

Article 3 (Processing and Retention Period of Personal Information)

(1) A Member's personal information is retained until the Member withdraws, and is destroyed without delay upon withdrawal, with the following exceptions:

1. Dig records: may be retained with the profile name de-identified for the integrity of the Service (proof of the order of discovery). Logs may be requested for deletion upon withdrawal.

2. Service usage records: not retained linked to the Member's account after withdrawal. Upon withdrawal, the link between usage records and the Member's account is cut immediately (de-identification), and the account's identifying information (social account identifier, profile name and profile photo) is deleted. The ad referral source, however, is destroyed one year after collection.

(2) Artist early access sign-up data is destroyed without delay one year after the sign-up date (approved sign-ups are kept while the artist account exists), and immediately upon a deletion request (unsober@piecepool.com).

(3) A verified artist's contact email is destroyed without delay when the artist verification is revoked or the Member withdraws, and immediately upon the artist's deletion request (unless an infringement dispute is in progress).

(4) For Members who sign in with Apple, the authentication token for revoking the Apple connection is used only to request that Apple revoke the connection upon withdrawal, and is destroyed without delay after the request.

(5) Device tokens for app notifications are destroyed without delay upon logout or withdrawal, or when the device can no longer receive notifications, and notification settings are destroyed without delay upon withdrawal. Notification delivery records are destroyed 30 days after sending. Received notifications are destroyed 90 days after being read, and when the Member who caused a notification withdraws, the parts concerning that Member are destroyed without delay (a notification caused by that Member alone is destroyed entirely).

(6) For a DROP track whose infringement report has been confirmed, a copy (the 30-second clip) is kept to respond to the dispute and is destroyed without delay when the dispute ends. The track's registration information (title, artist name, introduction, etc.) is kept to prevent the same track from being uploaded again.

Article 4 (Provision of Personal Information to Third Parties and Overseas Transfer)

(1) The Company does not provide users' personal information to third parties, except where the user has given prior consent or where required by law.

(2) The Company transfers personal information overseas as follows to provide the translation feature.

- Recipient: Microsoft Corporation (Azure AI Translator) / Contact: Microsoft privacy web form (see 'How to contact us' at https://www.microsoft.com/en-us/privacy/privacystatement) / Address: One Microsoft Way, Redmond, WA 98052, USA

- Destination countries: Japan, Singapore

- Time and method of transfer: when a text is written or edited (texts written before the feature launched: once, at launch), sent over an encrypted network

- Items transferred: the body text of Logs and of artist introductions (DROP appearance remarks). Author information (name, ID, etc.) is not sent.

- Purpose of transfer: automatic translation of the text (Korean ↔ English)

- Retention and use period: Microsoft does not store the text after processing the translation. The Company keeps the translation result and deletes it when the original text is edited or deleted, or when the author turns off translation permission.

- How to refuse and consequences of refusal: a user who wrote a text can turn off "Allow translation of my writing" in Settings, and their texts will not be translated or transferred. Turning it off does not restrict use of the Service.

(3) The Company transfers personal information overseas as follows to send app notifications.

- Recipients

1. 650 Industries, Inc. (Expo, relays notifications) / Contact: Expo contact form (https://expo.dev/contact), legal@expo.dev / Address: 624 University Ave FL1, Palo Alto, CA 94301, USA

2. Apple Inc. (Apple Push Notification service, delivers to iOS devices) / Contact: Apple privacy contact form (https://www.apple.com/legal/privacy/contact/) / Address: One Apple Park Way, Cupertino, CA 95014, USA

3. Google LLC (Firebase Cloud Messaging, delivers to Android devices) / Contact: Google privacy contact (https://support.google.com/policies?p=privpol_privts) / Address: 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA

- Destination country: United States

- Time and method of transfer: when the user allows notifications in the app (device token issued) and each time a notification is sent, over an encrypted network (the Company → Expo → Apple or Google, depending on the type of the user's device)

- Items transferred: device token; notification title and text (including the profile name of the Member who caused it, song titles and the reason for a report outcome); information on the screen to open when the notification is tapped (notification number, notification type and song number, and for follow notifications the ID of the Member who followed)

- Purpose of transfer: sending app push notifications

- Retention and use period: Expo does not keep notification content longer than needed to deliver it, and keeps device tokens for as long as necessary under Expo's privacy policy. Apple and Google: per each company's privacy policy.

- How to refuse and consequences of refusal: turn notifications off in the app's settings or the device's settings and nothing is transferred. Turning them off does not restrict use of the Service.

(4) The Company transfers personal information overseas as follows to provide music recognition in the iOS app.

- Recipient: Apple Inc. (ShazamKit) / Contact: Apple privacy contact form (https://www.apple.com/legal/privacy/contact/) / Address: One Apple Park Way, Cupertino, CA 95014, USA

- Destination country: United States

- Time and method of transfer: from when the user taps the recognition button until recognition ends (a song is found, the listening time runs out without a match, or the user cancels), over an encrypted network

- Items transferred: audio signature (an irreversible representation of nearby sound made on the device; the audio itself is not sent)

- Purpose of transfer: music recognition

- Retention and use period: per Apple's privacy policy

- How to refuse and consequences of refusal: do not use music recognition, or turn off the app's microphone access in the device settings, and nothing is transferred. Not using it does not restrict use of the Service.

Article 5 (Entrustment of Personal Information Processing)

Article 6 (Rights and Obligations of Data Subjects and How to Exercise Them)

(1) Users may at any time request access to, correction of, deletion of, or suspension of the processing of their personal information. Requests may be made through the in-Service contact feature or by email (unsober@piecepool.com), and the Company will process them without delay.

(2) Because dig records have the nature set forth in Article 12 of the Terms of Service (public and unmodifiable), a request for deletion may be handled by de-identifying the profile name.

Article 7 (Destruction of Personal Information)

(1) The Company destroys, without delay, personal information whose retention period has expired or whose purpose of processing has been achieved. Electronic files are deleted by irrecoverable methods, and other records are shredded or incinerated.

Article 8 (Cookies and Other Automatic Collection Devices)

(1) The Service uses cookies and browser-stored values to keep users logged in, to track sign-up progress, and to remember the language setting, display settings (default genres, whether first-visit guides were shown, theme, volume, region filter, the last song played on the radio, whether a DROP notice was closed) and conveniences (a dig draft in progress, where to return after logging in, whether this browser has logged in before, and the current screen state, which is erased when the browser tab is closed: list and DROP view modes, whether the radio is minimized, feed order, song information for song details, the name entered during sign-up, a summary of the signed-in profile (ID, name and profile photo address), whether visit and ad referral signals have already been sent from this tab, and a temporary background color test value stored only when the address carries a page value); an anonymous identifier (browser storage) to count non-logged-in usage per person; and an anonymous identifier (browser storage) to set the order of DROP stage songs for each non-logged-in viewer. These identifiers do not identify an individual and are not used for advertising. The Service also keeps a session identifier in browser storage (erased when the tab is closed) to group actions taken in the same tab into one flow, and stores it with service usage records. Users may refuse or delete cookies and stored values through their browser settings; in that case, use of features requiring login may be restricted.

(2) The Service does not use advertising cookies or third-party tracking devices.

Article 9 (Personal Information Protection Officer)

Article 10 (Measures to Secure the Safety of Personal Information)

(1) The Company takes the following measures for the safe processing of personal information: minimization of access privileges, encryption in transit (HTTPS), retention of access records, and application of security updates.

Article 11 (Remedies for Infringement of Rights and Interests)

(1) Users may contact the following organizations to report or seek counseling on personal information infringement: Personal Information Infringement Report Center (privacy.kisa.or.kr / 118 without an area code), Personal Information Dispute Mediation Committee (www.kopico.go.kr / 1833-6972), Supreme Prosecutors' Office (www.spo.go.kr / 1301), National Police Agency (ecrm.police.go.kr / 182)

Article 12 (Changes to the Privacy Policy)

(1) If the content of this Policy changes, notice will be given through the in-Service announcements from 7 days before the effective date.

(2) This Policy takes effect on August 13, 2026.

(3) Amended on August 15, 2026: added the artist early access items (Article 1 table, Article 2 no. 6, Article 3 (2)); those parts take effect on the amendment date.

(4) Second amendment on August 15, 2026: added the verified artist contact email and Instagram account items (Article 1 table, Article 2 no. 7, Article 3 (3)) and an optional Instagram account to the artist early access items; those parts take effect on the amendment date. This introduces a collection basis for information the artist provides voluntarily and is not a change adverse to existing users' rights.

(5) Amended on September 15, 2026 to match actual processing: removed Article 3(1) exception 3 (retention of restricted-account identifiers), moved the destruction point in Article 3(3) forward to "without delay upon revocation or withdrawal", added Cloudflare, Inc. (storage and network) to the Article 5 table, and specified the kinds of cookies and the anonymous identifier in Article 8(1). This reduces retention and expands disclosure, and takes effect on the amendment date.

(6) Amended (announced: October 12, 2026 / effective: October 19, 2026): added the Sign in with Apple items (the Apple account unique ID and the token for revoking the connection in the Article 1 table and (2), destruction of that token in Article 3 (4), and Apple Inc. in the Article 5 table); added the optional profile photo to the Article 1 table; stated that service usage records are stored linked to the Member's account (Article 1 table, Article 2 no. 5) and made withdrawal unlink them immediately (Article 3 (1) exception 2); made the reply email for inquiries optional and separated the reports item from inquiries, stating that no email is collected for reports (Article 1 table); and added the overseas transfer for the translation feature (Article 4 (2)) and the entrustment to Microsoft Corporation (Article 5 table). Those parts take effect on the effective date.

(7) Amended (announced: October 19, 2026 / effective: October 19, 2026): added received notifications (Article 1 table, Article 3 (5)), the app notification items and their destruction (Article 1 table, Article 2 no. 8, Article 3 (5)), the overseas transfer for app notifications (Article 4 (3)) and the entrustment to 650 Industries, Inc., Apple Inc. and Google LLC (Article 5 table), the overseas transfer for music recognition (Article 4 (4)) and the entrustment to Apple Inc. (Article 5 table), the information not collected or stored in music recognition (Article 1 (3)), and browser-stored values for display settings and conveniences (including the profile summary, the visit-signal flags and the background color test value), and the anonymous identifier for the DROP song order and the session identifier (Article 8 (1)), and the retention of the copy and registration information of DROP tracks with confirmed infringement reports (Article 3 (6)). The English text of Article 3 (1) 1 now says "Logs", matching the Korean text and the Service. App notifications and music recognition are optional features that work only when the user allows notifications or the microphone on the device, and received notifications are records that arise from the user's own use of the Service; these parts therefore take effect on the announcement date. The information not collected or stored in music recognition (Article 1 (3)) and the browser-stored values for display settings and conveniences (Article 8 (1)) expand the notice of existing processing, so they too take effect on the announcement date.