Privacy Policy
The Korean version is the original. If the two differ, the Korean version prevails to the extent permitted by the law of your country.
외눈박이 원숭이 연구소 (Oenunbagi Wonsungi Yeonguso) (representative: Sangyun Lee) ("we") runs the MARU app and web service (the "Service"). This policy explains what personal information the Service handles, why, who processes it for us, and when we delete it.
In short
- You start with an anonymous account, no sign-up. We only keep a nickname and an age band — never your birth year or month.
- Your location stays on your device. It is never sent to our server.
- If the writer allowed it, chat is translated by sending only the message text to Google Cloud Translation. Otherwise, or when server translation isn't available, it is translated on the reader's own device.
- Photos and postcards are stored only on your device.
- Chat is checked for abuse and kept for a fixed period, then deleted.
- MARU is not for anyone under 14.
1. What we process and why
| When | Data | Purpose | Legal basis |
|---|---|---|---|
| First launch | Anonymous account ID (Firebase UID) | Let you sit as a guest and keep your name, looks and collection | Contract |
| Welcome card | Nickname, age band (under 14 · 14–15 · 16–17 · 18+). Your birth year and month are used only to work out the band and are not stored. | Minimum age check, youth protection (youth mode) | Legal obligation · contract |
| Signing in with Apple or Google (optional) | The provider's account ID, e-mail address (or Apple's relay address if you hide it). We never receive passwords. | Chat, 1:1 talk, friends, purchases; use on several devices | Contract |
| Dressing up and using the app | Character looks, owned items, collection book, stardust, sky passport stamps, and the country flag you choose in Settings (none unless you pick one) | Show your character to others, keep your collection | Contract |
| While you sit in a plaza | Current place and room ("maru"), seat, nickname, looks, online status, typing indicator, gestures | Show you to others in the same room in real time | Contract |
| Sending chat or 1:1 messages | Message text, time, language, place and room, nickname, chosen flag | Deliver and store messages, check for abuse, handle reports | Contract · legitimate interest |
| Wishes, notes, constellations | Text (up to 80 characters), constellation name and star positions, reactions | Show them to other users, safety checks | Contract |
| Friends and blocking | Friend links, block list, time spent together | See which sky a friend is under, hide blocked people, glyph decoding | Contract |
| Reports and moderation | Reporter and reported account, reason, the message and a few lines before it, filter result, warnings / mutes / bans, appeals | Enforce the community rules, prevent repeat abuse, respond to lawful requests | Legitimate interest · legal obligation |
| Purchases (once paid features are enabled) | Product, transaction ID, time, and the store's proof of purchase (used only so our server can check with Apple or Google that the purchase is real). Card details are handled by Apple or Google; we never see them. | Deliver, restore and refund purchases | Contract · legal obligation |
| Ads | Advertising ID (IDFA / AAID), device information, IP address — collected by Google AdMob | Show banner ads | Contract · consent for personalised ads |
| Automatically | Access logs (IP address, time), app version, device language | Security, abuse prevention, lawful requests | Legitimate interest · legal obligation |
| When the app crashes or hits an error (app) | Crash reports: the error and where in the code it happened, app version, device model and OS version, time, the name of the sky you were in. No name, chat or location. | Finding and fixing crashes | Legitimate interest |
What never leaves your device
- Location: if you allow "sky near me", the device's approximate location is rounded to about 10 km (0.1°) and stored only on this device, where the nearest sky is calculated. Coordinates, the nearest place, and any country derived from them are never sent to our server. The flag next to your chat name is something you pick in Settings, not your location. You can turn location off in Settings at any time.
- Photos and weather postcards: stored in this device's storage (IndexedDB, up to 120). They leave the device only when you share or save them yourself. If we add account backup later, we will update this policy first.
- Birth year and month: used only to work out your age band, never stored.
- On-device translation: Apple Translation (iOS 18+), Google ML Kit (Android) and the browser's built-in translator (Chrome) translate on the reader's device. The message does not go to our server or a translation company for this. It is used when the writer didn't allow server translation, or when server translation isn't available (daily limit reached, offline).
Sending messages for translation (optional, with consent)
When a reader uses another language, our server sends the message text and target languages to Google Cloud Translation (machine translation, not a generative AI model). No names, account IDs or countries are sent. We ask before your first chat message; if you decline, your messages are never sent to the server; they are translated only on the reader's device, or delivered in the original. (From 27 October 2026 server translation is used before on-device translation, because on-device quality was poor.) You can change this any time in Menu > Settings & Help > Send my messages for translation. Identical sentences are cached on our server for 30 days so they are not sent again. Only the sentence and its translation are kept, not who wrote it.
Weather
Our server fetches weather and alerts from OpenWeather using each place's coordinates and shares them with everyone at that place. No user location or personal data is sent to OpenWeather. Sun and moon positions are computed on your device (SunCalc).
2. How long we keep it
| Data | Retention |
|---|---|
| Account, nickname, age band, looks, collection, friends, passport | Until you delete your account; deleted immediately then. |
| Live presence (seat, status, gestures) | Removed as soon as you leave the room or disconnect. |
| Plaza chat and 1:1 messages | 90 days from sending. Your 1:1 messages are deleted when you delete your account. |
| Reports, incidents, sanctions and appeals (including a few lines of context) | 1 year after the case is closed, kept separately even if the account is deleted, then deleted. |
| Wishes | Shown for 7 days, then deleted (reported ones: as for reports). |
| Notes for the next visitor | Deleted after 30 days or 20 readers (reported ones: as for reports). |
| Access logs (IP, time) | 3 months |
| Purchase and withdrawal records | 5 years (Korean E-Commerce Consumer Protection Act) |
| Complaint and dispute records | 3 years (same Act) |
| Data on your device (location, photos, postcards, settings) | Until you delete it or uninstall the app. We have no access to it. |
When retention ends we delete the data without delay, in a way that cannot be recovered. Records kept because the law requires it are stored separately and used only for that purpose.
3. Sharing with third parties
We do not give your personal information to third parties, except:
- when a public authority requests it through a lawful procedure (we record the request number and share only what is required);
- when urgently needed to protect someone's life or safety;
- if you consent to personalised ads, Google processes your advertising ID for its own advertising purposes (section 7).
Visible to other users: your nickname, character, chosen flag, plaza chat, gestures, and wishes / notes / constellations within their audience. Friends can see which sky you are under. Your e-mail and account ID are never shown.
4. Processors and international transfers
We use the processors below under their data processing terms. Data is transferred over the network whenever you use the Service. To avoid a transfer, you can turn the related feature off (translation sending, signing in) or delete your account; that feature will then be unavailable.
| Recipient | Country / region | Task | Data | Retention |
|---|---|---|---|---|
| Google LLC — Firebase Authentication | USA | Anonymous accounts, Apple / Google sign-in | Account ID, e-mail (if signed in) | Until account deletion |
| Google LLC — Firebase Realtime Database | Singapore (asia-southeast1) | Live rooms, presence, chat, reports | Nickname, looks, flag, seat, chat, reports | As in section 2 |
| Google LLC — Firebase Hosting | USA and global CDN | Web version and this website | Access logs (IP) | Per Google's policy |
| Google LLC — Firebase Crashlytics | USA | App crash and error reports | Crash reports, app and device info, installation ID | 90 days |
| Google LLC — Google Cloud Translation | USA and others | Translating chat (only with the writer's consent) | Message text, target languages | Used only for translation, per Google Cloud data processing terms |
| Google LLC — AdMob (app) / AdSense (web) | USA | Banner ads | Advertising ID, device info, IP | Per Google's policy |
| Apple Inc. — Sign in with Apple, App Store payments | USA | Sign-in, in-app purchases | Apple account ID, purchase info | Per Apple's policy |
| Google LLC — Google Play billing | USA | In-app purchases | Purchase info | Per Google's policy |
Privacy contacts: Google policies.google.com/privacy · Apple apple.com/legal/privacy/contact. In-app purchases are processed only by Apple (App Store) and Google (Google Play); we use no third-party purchase-management service (such as RevenueCat). Our own server (Google Cloud · Firebase) checks purchases directly with Apple and Google.
5. Automated decisions (chat moderation)
So everyone can sit comfortably, our server checks every chat message automatically.
- Blocked words (including variants with spaces, symbols or numbers) are masked with ● and recorded as a warning.
- After 3 warnings you cannot send chat for 24 hours (you can still read and use gestures).
- Severe content such as threats goes straight to a human review queue.
- To prevent flooding we limit sending speed and daily messages (300 plaza · 300 1:1) and reject the same message repeated within 2 minutes.
If you are muted or banned we tell you what, why (which rule), how (automatic filter or human review) and until when. Tap [Appeal] and a person reviews it again. To ask for an explanation of, or contest, an automated decision, use the appeal button or contact us below.
6. Your rights
- You can ask to access, correct, delete or restrict your data, withdraw consent, and ask for an explanation of or object to automated decisions.
- Nickname, age band, flag, translation sending and location can be changed in Menu > Settings & Help.
- Delete your account: Menu > Settings & Help > Delete account and data (confirm twice). If you can't open the app, see Account deletion.
- For a copy of your data, contact us below. We reply within 30 days after verifying it's you.
- You may act through a representative with written authorisation.
7. Ads and on-device storage
- The app shows Google AdMob banner ads at the top and bottom (AdSense on the web). The ad provider collects your advertising ID and device information.
- Users under 18 only see non-personalised ads. In the EEA, UK and Switzerland we ask for consent before personalised ads, and on iOS we ask for App Tracking Transparency permission only if personalised ads are used.
- You can turn off personalised ads in your device settings (iOS: Settings > Privacy & Security > Tracking; Android: Settings > Google > Ads).
- The app and web store settings, photos and location on the device (localStorage, IndexedDB). We do not use tracking cookies or analytics tools.
- Buying "Clear Sky" removes ads.
8. Children and teens
- MARU is not available to anyone under 14. On first visit you choose your birth year and month; if you are under 14 the Service does not open and the device remembers this. If we learn we hold data from someone under 14, we delete it.
- Under 18 (youth mode): non-personalised ads only, 1:1 talk with friends only, no paid random parcels, wishes are read-and-cheer only.
9. Security
- All traffic is encrypted (HTTPS / TLS).
- Database security rules let you write only your own data; reports cannot be read from the app.
- The admin tool is limited to operator accounts; views and exports are logged and moderation records are append-only.
- We collect only what we need. Location, photos and birth dates never reach our server.
- If a data breach occurs, we notify you and the regulator as the law requires (within 72 hours).
10. EU / UK (GDPR) and other regions
- Legal bases: account, chat, translation and purchases — contract (Art. 6(1)(b)); reports and security logs — legitimate interests (f) and legal obligation (c); personalised ads and location — consent (a).
- Your rights: access, rectification, erasure, restriction, portability, objection, withdrawal of consent, and complaint to your supervisory authority.
- Transfers to US companies rely on the EU-US Data Privacy Framework or Standard Contractual Clauses. Transfers from the EU to Korea rely on the 2021 adequacy decision.
- EU / UK representative: [to be appointed before EU / UK launch]
- US states (e.g. California): we do not sell personal information. Where personalised advertising counts as "sharing", you can opt out in your device settings or the ad consent screen.
11. Contact
Privacy officer: Sangyun Lee (representative)
E-mail: tssu106@gmail.com · Phone: +82-10-9426-9289
Users in Korea may also contact the Personal Information Infringement Report Center (privacy.kisa.or.kr, 118) or the Personal Information Dispute Mediation Committee (kopico.go.kr, 1833-6972).
12. Changes
We announce changes in the app and on this page 7 days before they take effect (30 days for changes that are less favourable to you).
- 21 October 2026 — first draft