Privacy Policy

1. Who we are and scope

Unbyul (운별) is a mobile app that calculates a person's saju (四柱命理, the Korean Four Pillars of Destiny) and Western astrological chart from their gender, birth date, birth time and birth place, and presents interpretations of them. It is operated by OKSUSU CODE LAB (옥수수코드랩), a sole proprietorship registered in the Republic of Korea and represented by LEE YONGSOO (이용수). Business registration number: 462-25-02344. Mail-order business report number: 2026-Goyang Deogyang-gu-2357.

In this policy, "we", "us" and "our" mean OKSUSU CODE LAB, and "you" means a person who uses the app or the website. We are the controller, that is, the business responsible for the personal information described here.

This policy applies to the Unbyul app for iOS and Android, the website at https://unbyul.com, and the support we provide by email. It does not apply to the App Store, Google Play or any other service run by a third party, even where we link to it. Those services have their own privacy policies.

Unbyul is offered in the Republic of Korea, the United States and Japan. Sections 11 to 13 contain additional notices for people in those places. Where local law gives you rights beyond what is written here, the local law applies.

Unbyul is for entertainment and reference only. Nothing in the app is professional, medical, legal or financial advice.

2. Information we collect

Information you give us

• Profile: your nickname (or the name you choose to enter), gender, birth date, birth time (optional) and birth place at city level. These are the inputs used to calculate your charts.
• Account (only if you sign in): the identifier Apple or Google provides when you sign in with them, and the email address they share with us (Apple may share a private relay address). We do not offer email-and-password accounts. Until you sign in, your profile and chart stay on your device and are not sent to our servers; they are uploaded to your account when you first sign in.
• Other people's profiles (optional): for compatibility readings you may add another person's nickname, gender, birth date, birth time and birth place. You are responsible for having that person's permission before entering their details. We use these profiles only to produce the reading you requested.
• Compatibility invites (optional): when a signed-in user creates an invite link, we keep the inviter's nickname and birth details (gender, birth date, birth time, birthplace) with the invite. When the invited person agrees and accepts, we also keep their nickname and birth details. Neither person can see the other's birth details; they are used only to work out the compatibility result (the score and five axes, each person's day master and element balance) and when either person opens the full compatibility report through that invite.
• Support messages: what you write to us when you contact support, and the email address you write from.

Information collected automatically

• Device model, operating system version, app version, and language and region setting.
• Push notification token, if you allow notifications.
• Pseudonymous user and device identifiers generated by us or our service providers. These are random values that do not contain your name or email address.
• IP address, access logs (time, request, result) and crash logs.
• In-app event analytics, such as which screens were viewed and which purchases were made.

Purchase information

When you buy coins or reports, we receive the product purchased, a transaction identifier and a purchase receipt from Apple or Google, and we keep your coin balance and a ledger of coins credited and spent. The ledger also records free coins given for attendance and rewarded ads (transaction ID, date and number of coins). Payment is handled entirely by Apple or Google. We never receive your card number or any other payment credential.

Rewarded ads (only if you choose to watch one)

When you choose to watch a short ad to receive free coins, the Google AdMob SDK in the app sends Google LLC device information (such as device model, operating system and app version), your IP address, an advertising identifier or app-set identifier on Android (the SDK may read the Android advertising ID), and ad interaction events (such as whether the ad was shown and completed). To verify the reward, the app passes a pseudonymous user ID and your local date to AdMob, which returns them to our server together with confirmation that the ad was completed (server-side verification). This information does not include your name or email address. We request non-personalised ads only. On iOS, the app does not ask for App Tracking Transparency permission and does not access the advertising identifier (IDFA).

What we do not collect

We do not collect precise location (GPS), contacts, photos, or microphone or camera data, and our servers do not collect advertising identifiers (for the Android advertising identifier that the AdMob SDK sends to Google, see "Rewarded ads" above). Your birth place is a city you type or select, not a measured location.

3. How we use information

We use personal information for the following purposes and for no others without telling you first.

• Creating and managing your account: signing you in, recognising you, and syncing your data across your devices.
• Calculating your charts: converting your birth data into a saju chart (four pillars, five elements and related factors) and an astrological chart (positions of the Sun, Moon and planets and their signs). This calculation is done by deterministic code on our servers, not by an AI model.
• Generating and showing interpretations: see Section 4.
• Selling and delivering coins and reports: processing purchases, crediting coins, unlocking reports, keeping the coin ledger and handling refunds.
• Giving free coins: crediting attendance rewards and, if you choose, showing rewarded ads that give free coins and confirming that the ad was completed.
• Customer support: answering your questions and resolving problems and complaints.
• Push notifications you opted into: a daily fortune notice and purchase confirmations. You can turn these off at any time in your device settings or in the app.
• Preventing fraud and abuse: detecting duplicate or fraudulent purchases, misuse of promotions, and attempts to interfere with the service.
• Measuring and improving the service: understanding which features are used and fixing crashes and errors.
• Meeting legal obligations: keeping the transaction records required by commerce and tax law, and responding to lawful requests from authorities.

Where the law requires a legal basis, we rely on your consent (for example, for the optional birth time and for push notifications), the need to perform our contract with you (account, charts, purchases), our legitimate interest in running a secure and reliable service (security, analytics, crash reporting), and our legal obligations (record keeping). Rewarded ads are shown only when you choose to watch one, to provide the reward you asked for. We do not request personalised ads and do not use your information for targeted advertising, and we do not make automated decisions about you that have legal or similarly significant effects.

4. AI-generated interpretations

The charts themselves are calculated by our own code. The explanatory text you read is written by a large language model (Claude) provided by Anthropic, PBC through its API.

What we send to the model: the computed chart data (for example, the eight characters of the four pillars, the balance of the five elements, and the positions and signs of the Sun, Moon and planets), together with your nickname, gender and birth year so the text can address you naturally. For compatibility readings, the same elements of the other person's profile are included.

What we do not send: your email address, login identifiers, device identifiers, purchase history, IP address or anything else that identifies your account.

Anthropic processes this data as our service provider under its commercial terms and does not use API inputs or outputs to train its models. Under Anthropic's standard retention policy the data is deleted within 30 days, unless a longer period is needed to enforce its usage policy or is required by law.

Generated text is stored on our servers and attached to your account so that it can be shown again without being regenerated. It is deleted together with your account. Interpretations are produced from traditional rules and the model's writing; they are not statements of fact and should be read as entertainment and reference only.

5. Sharing, processors and international transfers

We do not sell personal information, and we do not share it with anyone for personalised advertising. We share information only with the service providers listed below, who process it on our instructions; with Apple and Google as described; with Google (AdMob) when you choose to watch a rewarded ad; and when the law requires it.

Google AdMob (rewarded ads). Rewarded ads are provided by AdMob, a service of Google LLC. We request non-personalised (contextual) ads only, and we show no banner or interstitial ads. When you choose to watch an ad, AdMob receives the device information and identifiers described in Section 2 directly from your device and processes them for ad serving, measurement and fraud prevention as an independent business under its own privacy policy, not as our service provider. You can read how Google uses this information at https://policies.google.com/technologies/partner-sites. If you do not want ads, simply do not tap the button to watch one; on Android you can also reset or delete your advertising ID in your device's system settings.

All of these companies are headquartered in the United States, which means that from the standpoint of Korean and Japanese law your information is transferred abroad. Supabase stores our database in the AWS Seoul region in Korea, but the company operating it is in the United States. Transfers take place over an encrypted network connection at the moment you use the relevant feature.

We may replace one of these providers with an equivalent service. If we do, we will update this table and, where the change is material, notify you as described in Section 14.

Legal requests. We may disclose information when a court, law enforcement agency or regulator requires it under applicable law, or where necessary to protect the safety or rights of users or others.

Business transfer. If OKSUSU CODE LAB is reorganised or the Unbyul service is transferred to another business, your information may be transferred with it. We will notify you beforehand, and the new operator will remain bound by this policy until it is changed in accordance with Section 14.

6. Retention and deletion

We keep your account and profile data, coin ledger and generated reports for as long as your account exists. When you delete your account, we delete this data within 30 days. Copies held in backups are purged within a further 30 days.

The only exception is records we are legally required to keep. These are stored separately from the live service, used only for the purpose the law requires, and deleted when the period ends. The periods below come from Korean law, which applies to us as a Korean business; we keep the same records for all users.

Logs and analytics. Crash logs are kept for 90 days, analytics events for 12 months and web access logs for up to 30 days, after which they are deleted or made anonymous.

Rewarded ads. The reward records we keep (transaction ID, date and number of coins credited) are part of the coin ledger and are kept until your account is deleted. Information Google collects through AdMob is retained under Google's policies.

Compatibility invites. An invite that is not accepted expires after 30 days and is then deleted together with the inviter's birth details. An accepted invite (both nicknames, both sets of birth details and the result) is deleted when either the inviter or the person who accepted deletes their account, and either of them can ask for deletion earlier at support@oksusucode.com.

Inactive accounts. If you do not sign in for 2 years, we will send a notice to your registered email address at least 30 days in advance and then either delete your data or move it to separate, restricted storage. You can keep your account active simply by signing in before that date.

How to delete. In the app, open Settings → Account → Delete account. You can also email us at support@oksusucode.com or follow the instructions at https://unbyul.com/account-deletion. Deleting your account forfeits unused coins, except where a refund is owed under our Terms of Service or applicable law.

7. Your rights and how to exercise them

Subject to the law that applies to you, you have the following rights over your personal information:

• Access: to know what information we hold about you and to receive a copy.
• Correction: to have inaccurate information corrected. You can edit your profile, including your birth data, in the app at any time.
• Deletion: to have your information deleted (Section 6).
• Restriction: to ask us to stop processing some or all of your information.
• Withdrawal of consent: to withdraw consent you have given, for example by turning off push notifications or removing your birth time. Withdrawal does not affect processing that has already taken place.
• Portability: where applicable, to receive your data in a machine-readable form.

How to exercise them. Most rights can be exercised directly in the app under Settings → Account. For anything else, email support@oksusucode.com from the address registered to your account, or tell us your nickname and sign-in method so we can locate the account. We may ask you to confirm your identity before acting, and we use that information only for verification. You may act through an authorised representative where the law allows; we will ask for proof of authority.

Response time. We respond within 10 days to requests under Korean law, within 45 days to requests from California residents (extendable once by a further 45 days where permitted, with notice to you), and without undue delay to requests under Japanese law. We do not charge for handling requests unless the law allows it and the request is clearly excessive.

If we cannot grant a request, we will tell you why and how you can appeal, including through the public bodies listed in Sections 11 to 13.

8. Security

We take the following measures to keep your information safe:

• Encryption in transit (TLS) between the app, the website and our servers, and encryption at rest for our database and backups.
• Access to personal information limited to the representative and to the automated systems that need it, protected by multi-factor authentication and logged.
• No card numbers on our servers; payment is handled by Apple and Google.
• Pseudonymous identifiers, rather than names or email addresses, in analytics and crash reporting.
• Regular review of access logs, software updates and the security settings of the services we use.

No system is perfectly secure. If a breach affecting your personal information occurs, we will notify you and the competent authorities as required by law.

9. Children

Unbyul is not directed at children. You must be at least 14 years old to create an account, in every country where the app is available. We do not knowingly collect personal information from anyone under 14. If we learn that we have done so, we delete the account and its data promptly. In the United States, the Children's Online Privacy Protection Act (COPPA) protects children under 13; our higher minimum age of 14 applies there as well. If you believe a child under 14 has given us information, please contact support@oksusucode.com.

10. Cookies and similar technologies (website)

Our website at unbyul.com uses only the technical storage needed to make it work: your language preference is saved in your browser so that the site opens in the language you chose. We do not use advertising cookies, tracking pixels or third-party analytics on the website. Cloudflare, which hosts the site, may set a cookie that is strictly necessary for security and performance.

The Unbyul app includes the Google AdMob SDK for rewarded ads. Ads are shown only when you choose to watch one to receive free coins, and we request non-personalised ads only. There are no banner or interstitial ads and no ads inside purchased reports. On iOS, the app does not ask for App Tracking Transparency permission and does not access the advertising identifier (IDFA). On Android you can reset or delete your advertising ID in your system settings. The analytics and crash-reporting tools in the app (PostHog and Sentry) use the pseudonymous identifiers described in Section 2 and are not used for advertising.

11. Notice for Korea (Personal Information Protection Act)

This section applies to users in the Republic of Korea and is provided under the Personal Information Protection Act (PIPA). The Korean-language version of this policy is the authoritative version for users in Korea.

Items, purposes and retention. As described in Sections 2, 3 and 6. Providing a birth time is optional; the app works without it, with lower precision. Persons under 14 cannot register.

Entrustment of processing (처리위탁). We entrust the following work to the following processors and supervise them by contract as required by Article 26 of PIPA.

Provision to a third party (제3자 제공). Only when you choose to watch a rewarded ad, personal information is provided to a third party as follows. You may refuse; if you do (by not tapping the button to watch an ad), you will not receive ad-reward coins, but nothing else in the service is restricted.

• Recipient: Google LLC (AdMob)
• Recipient's purpose: serving and measuring rewarded ads, fraud prevention, confirming that the ad was completed
• Items: device information, IP address, Android advertising identifier or app-set identifier, ad interaction events, pseudonymous user ID and local date for reward verification
• Retention: per Google's privacy policy

Showing an invite result. When you accept a compatibility invite and agree to it, the person who invited you is shown the result for the two of you (the score and five axes, your day master and element balance, and your nickname). Your birth date, birth time and birthplace are not provided. If you do not agree, you cannot accept the invite, and nothing else in the Service is affected. The result is kept for the period in Section 6.

Overseas transfer (국외 이전). Personal information is transferred to the following recipients outside Korea. You may refuse the transfer by not registering, by deleting your account, or by contacting support@oksusucode.com. Because these services are necessary to operate Unbyul, refusing will prevent or limit your use of the service.

Rights and remedies. You may request access to, correction or deletion of, or suspension of processing of your personal information at any time (Section 7). If you believe your rights have been infringed, you may also contact: the Personal Information Infringement Report Center (privacy.kisa.or.kr, 118), the Personal Information Dispute Mediation Committee (www.kopico.go.kr, 1833-6972), the Supreme Prosecutors' Office (www.spo.go.kr, 1301) or the Korean National Police Agency (ecrm.police.go.kr, 182).

12. Notice for California residents

This section applies to California residents under the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA). In the past 12 months we have collected the categories of personal information listed below. We do not sell personal information, we do not share it for cross-context behavioral advertising, and we do not request targeted (personalised) ads. When you choose to watch an ad for free coins, Google AdMob serves a non-personalised (contextual) rewarded ad and receives device information and identifiers (Section 5). The only sensitive personal information we may collect is your account log-in credential, which we use solely to authenticate you.

Sources are you, your device, and Apple or Google when you sign in or purchase. Business purposes are those in Section 3, and retention periods are those in Section 6. Each category is disclosed to the service providers in Section 5 under contracts that limit their use of it to the services they provide to us. The exception is Google AdMob, which receives information directly from your device when you choose to watch an ad and processes it under its own policies to serve and measure non-personalised ads and to prevent fraud.

Your rights. You have the right to know what personal information we collect, use and disclose; to delete it; to correct inaccurate information; to opt out of sale or sharing (we do neither); to limit the use of sensitive personal information (we already use it only to provide the service); and not to be discriminated against for exercising these rights.

How to exercise them. Use Settings → Account in the app, or email support@oksusucode.com. We verify requests by matching them to the email address or sign-in identifier on the account and may ask for additional confirmation. You may designate an authorized agent; we will ask for signed permission and may also verify your identity directly. We respond within 45 days and will tell you if we need up to 45 more.

Global Privacy Control. We treat a GPC signal from your browser as a request to opt out of sale and sharing. Because we do not sell or share personal information, honoring it changes nothing about how we treat you.

We do not knowingly sell or share the personal information of consumers under 16, and no one under 14 may use Unbyul.

13. Notice for Japan (Act on the Protection of Personal Information)

This section applies to users in Japan under the Act on the Protection of Personal Information (APPI). The Japanese-language version of this policy is the authoritative version for users in Japan.

Purpose of use. The purposes in Section 3. We do not use personal information beyond these purposes without your consent.

Provision to third parties. We do not provide personal data to third parties, except for entrustment to the processors in Section 5 and disclosures required by law. However, when you choose to watch a rewarded ad, the Google AdMob SDK in the app sends device information and identifiers directly from your device to Google, which processes them under its own policies (Section 5). We do not engage in joint use.

Third parties and processors in foreign countries. The companies in Section 5 are located in the United States. The United States has no single comprehensive federal privacy law; information on its legal system is published by Japan's Personal Information Protection Commission. Each processor is bound by contract to protect your data to a standard equivalent to the APPI, and we monitor their compliance. Google LLC (AdMob), which provides rewarded ads, is also located in the United States and processes information as an independent business under its own privacy policy, not as our processor.

Requests about retained personal data. You may request disclosure, correction, addition, deletion, suspension of use or suspension of third-party provision of your retained personal data by emailing support@oksusucode.com. We verify your identity, respond without undue delay and do not charge a fee.

Security management measures. See Section 8.

Complaints. Please send complaints about our handling of personal information to support@oksusucode.com. We will respond promptly and in good faith.

14. Changes to this policy

We may update this policy when our service, our providers or the law change. The effective date and version number at the top will be updated each time. For material changes, we will give notice in the app or on the website at least 7 days before the change takes effect, and at least 30 days in advance in Korea for changes that affect your rights. Continued use after the effective date means the updated policy applies to you, except where your consent is legally required, in which case we will ask for it. Earlier versions are available on request.

Change history. Version 1.3 (October 6, 2026): added Google AdMob rewarded ads and the recording of attendance and ad reward coins.

15. Contact and privacy officer

Our privacy officer is responsible for this policy and for handling your questions, requests and complaints.

• Privacy officer: LEE YONGSOO (이용수), representative of OKSUSU CODE LAB
• Email: support@oksusucode.com
• App website: https://unbyul.com
• Company website: https://oksusucode.com

Please do not include sensitive information in your first email; we will tell you what we need to help. Public bodies you may contact if you are not satisfied with our response are listed in Sections 11 to 13.