Effective 2026.10.08 · Edition 6 · Operator MOYO Studio · Contact [email protected]

MOYO Studio (Onbit) processes personal information lawfully and keeps it safe, in accordance with Korea's Personal Information Protection Act and related laws. Under Article 30 of that Act, we establish and publish this policy so that you know the procedures and standards by which your personal information is handled, and so that any related complaint can be resolved quickly.

[In one paragraph] Onbit's Globe, Passport, stamps and calendar work from start to finish without an account. Photos are read on your device for their capture location and time only; originals never leave it. Your Trips tab records (trip summaries, trip cover photos, packing lists, spending, exchange rates and so on) are kept on our server under an anonymous ID even without an account, and you can delete them in the Me tab at any time. The only photos uploaded are one cover photo per city and one per trip (both newly made images with no location data), plus any receipt photo you attach to a shared trip. Your device's location and your photos' capture coordinates are never uploaded under any circumstance. We do, however, store the coordinates of places you pick on the map (a shop, a sight) so we can show them on the map. Before you connect a friend, we ask for your consent to share location information; once connected, only that friend sees your name and city records, and we let you know each time they are shared. People you invite to plan a trip together see only that trip. Place search, maps, travel times and weather are fetched from Google on your behalf, without sending your name or email. There are no ads, we do not track you outside the app, and we never sell personal information.

[Summary · key processing at a glance] The essentials before the full text. This is a summary; the full text below governs. · Permissions requested: photos, location and notifications only, each asked the moment you tap that feature (Article 2-2) · What we process: an anonymous identifier; if you link an account, your email, name, city records with the days you were there, and one cover photo per city; if you use the Trips tab, even without an account, trip records, trip summaries and one cover photo per trip; if you plan a trip together, that trip's plan, packing list, spending, receipt photos and members' display names; if you turn on notifications, a device token and your device's time zone · Location: your device's coordinates are never sent to our server. The result of turning a photo's capture location into a city on your device (which city you were in and when), and the place names and place coordinates you write or choose in your trip records, are kept on our server · Sensitive data, national identifiers, biometrics: not processed · What other people can see: a friend connected by code sees your name, city records, (if enabled) cover photos and calendar "Together" trips (Article 4-2); members of a shared trip see that trip's contents and who added what (Article 4-3) · Collected automatically: crash diagnostics and anonymous analytics — analytics can be turned off in Me > Data. Adding to trip statistics (numbers that identify no one) can be turned off under Me > Notifications > "Help other travelers anonymously" and for each trip (Article 2.9) · Third-party disclosure: none / Processor: Google LLC (Firebase, Google Maps Platform) / Overseas transfer: United States (diagnostics, analytics, maps and place information) · Retention: destroyed immediately when you delete your account or use "Delete my records from the server" (shared trips until the trip is deleted or everyone leaves; diagnostics 90 days; analytics 14 months; location use and provision records 6 months) · Complaints: MOYO Studio Privacy Officer · [email protected]

Article 1 (Scope and where to find this) This policy applies to the app "Onbit" provided by MOYO Studio ("the Company"). The same text is available at any time in the app under Me > About > Privacy Policy, and on the web. Business information · Trade name: MOYO (모두의 요리) · Representative: Kyunghwan Im · Business registration number: 836-13-02732 · Address: 18-16 Mabang-ro 10-gil, 4F E223 (Yangjae-dong, Jinwoo Bldg.), Seocho-gu, Seoul, 06776, Korea

Article 2 (What we process and how we collect it)

1. Generated automatically when you use Onbit without an account · Anonymous authentication identifier (UID), app installation identifier · Usage records: city keys, country codes, day-count buckets and similar aggregate events · Crash diagnostics: where in the code the error occurred (stack trace), device model, OS and app version, IP address
2. When you link an account (optional) · The email address provided by Apple or Google, and the name they supply · The passport name you choose Trips tab records are kept under an anonymous ID even without an account (2.3-2). If you link an account, the same records move to it and can be restored on a new device. Planning a trip together (2.3-3) requires a linked account.
3. Kept automatically once an account is linked (optional) · City records (city name, country code, day count, first day lit, photo count) · The list of days you were in each city, and how many photos you took on each of those days — used so the server can send the "N years ago today" notification. Readable only by you; never shown to friends. · Light shards, places saved for this year and when you saved them, year stamps and arrival marks, quest progress, interest in printed items · One cover photo per city, and the line you wrote on that photo · On-device identifiers pointing to the photos you chose for covers and stamp backs (not the photos themselves) · Home city: the city name you confirmed (not an address), used to leave outings near home out of your trips · Your goal for this year (how many new countries) 3-2. When you use the Trips tab (optional; kept under an anonymous ID even without an account) · The trip records you write or choose: legs (mode of transport; flight number, aircraft type, registration, seat, cabin, terminal, gate; scheduled and actual times; lounge, meal, miles and similar), places (name, category, rating; menu, price, wait, room, nightly rate and similar), spending (amount, currency, category), city notes, and your trip rating and one-line summary · Travel companions: their names, if you write them. Only you can see these names, and they are left out of "One image" share cards by default. · On-device identifiers pointing to the photos attached to a record (the photos themselves are not uploaded) · Packing lists and what you checked off, spending (amount, currency, category, number of people splitting it), and exchange rates you set · Trip summaries: numbers such as the trip's cities, dates, days stayed, ways of getting around, rating, and photo and video counts (no coordinates) · One cover photo per trip: a new image, 1080 px on the long side, made from the photo you chose, so it carries none of the original's capture location (EXIF) · Places you loved: the Google place ID, name, coordinates and Google Maps link of the place you chose, how it was (loved it, it was fine, not great), what was good, one line, and on-device identifiers pointing to attached photos (the photos themselves are not uploaded) 3-3. When you plan a trip together (optional; requires an account) · The trip: cities, dates (or number of nights), the creator's identifier, and a city label (Korean and English names and a city key) · Members: identifier, the display name used in that trip, role (creator or member), and when they joined · The plan: place labels, Google place IDs, place coordinates, Google Maps links, day, time, "been there" marks, and who added each · Packing: items (built-in items are stored as item codes and shown in each viewer's language) and checks, and who added each · Recent changes: who did what (joined, added a place, set the dates and so on) · Invite links: the invite code, expiry (7 days), usage count, the inviter's display name and the trip name, and whether it was turned off · Notification send marks: kept so the same reminder is never sent twice (which reminder went to whom) · In-app invitations: an invitation kept under the recipient's account (the sender's identifier and display name, the trip's cities and dates, and whether it was accepted) · Invites by email: the email address the inviter types in. If an Onbit account uses that address, we send an in-app invitation; we never tell the inviter whether an account exists. The address is used only to send the invitation and is not stored. · Finding people by name: by name, you can only find friends you're already connected with and people you've planned a trip with before. There is no way to look up strangers by name. 3-4. Trip ledger and settle-up (optional) · Expenses: what it was, amount, currency, the exchange rate used and its date, the KRW amount, the card charge in KRW, category (flights, stay, food, coffee and snacks, getting around, sights and tickets, shopping, other) and detail, how it was paid (card, cash, transit card, app pay — we never take card numbers), place (Google place ID, name, coordinates), time, who paid, who's splitting, receipt items and who had each, each person's share, tax-free, tip, notes, tags, date, and who added it · Receipt photos: a new image, no more than 1600 px on the long side, made from the photo you chose. It is uploaded to our storage so members of the shared trip can check it when settling up. · Settle-up: "sent" and "received" marks (who sent, who received, amount) 3-5. When you use place search, maps, travel times and weather · What we send to Google (our server makes the request on your behalf): the search text, the coordinates at the centre of the map (where you moved the map — not your device's location), place IDs, the coordinates of trip cities and saved places, and the app language. We never send your name, email or account details. · Showing the map: maps in the app are drawn by the Google Maps SDK, which exchanges the information needed to display the map between your device and Google (the Google Privacy Policy applies).
4. When you connect a friend (optional) · An invite code (8 characters, single use) and the identifier of the person who created it · The link record (the identifiers of the two connected people) · The passport summary shown to your friend (name, countries lit, city keys with month and day count, whether cover photos are shared) · Calendar "Together" requests (sent from "Who were you with on this trip?"): the identifiers of the sender and the recipient, the city, the month, whether it was accepted, and when it was created · Your consent to share location information with friends (when you agreed and which edition of the terms applied) and how you want to be notified (each time, or every 30 days) · Sharing record: the date, the friend who received it, the purpose and how many times that day — visible only to you and deleted automatically after 6 months
5. When you turn on notifications (optional) · Push notification token (per device), the time you chose, your device's time zone (its offset from UTC, refreshed each time you open the app) and language · Notification settings: whether "Shared trip updates" and "Trip reminders" (a week before, the day before, the morning you leave, and the day after you're back) are on
6. When you fill in "About me" (optional) · Birth decade, gender
7. Processed on your device only and never collected · The capture coordinates in your photos (EXIF) and the photo originals · The coordinates used to check that you have arrived somewhere (discarded the moment the check is made; never stored or transmitted) · Trip auto-fill calculations: the nearest airport, suggested modes of transport, candidates for where you stayed and ate, and the distance traced by your photos are computed from the airport list built into the app and the photo locations on your device. Only what you confirm with "Yes" becomes a record; a suggestion you pass over with "No" is remembered on your device only, at a resolution of about 300 m, so it is not suggested again. · Putting "Taken near here" photos first when you save a place you loved: the distance between each photo's capture location and the chosen place is calculated on your device only. · Calendar photos, lock screen images and "One image" share cards: made on your device, and leave it only when you share them or save them to your photo library yourself. The recipient is then the app you chose. · Videos in trip credits: videos taken during a trip are read on your device only; the server keeps only how many there were. · Traveler type (the entry stamp in the Me tab): calculated on your device only, from your trip records and the times your photos were taken. · The days you completed "Today's one" in the Today tab: remembered on your device only.
8. Records of the use and provision of location information (automatic) · Your user ID, the date and time location information was used or shared with a friend, the purpose (which feature), and, where shared, the friend who received it — never coordinates. Under Article 16(2) of the Act on the Protection and Use of Location Information, the server records these automatically in a place neither you nor the app can read or delete, keeps them for 6 months, and then deletes them automatically.
9. Adding to anonymous trip statistics (automatic; can be turned off) · To show other travelers what trips tend to look like, parts of a finished trip are turned into numbers that identify no one and added together. No individual record is kept; we only count "one more trip falls into this range". · What is added: city, country and month of travel; nights and number of people; how you got there; whether it was a first visit; how it was; a range of photos per day; a range of spending per person per day (converted to US dollars); ranges of spending share by category and card share; the place IDs of places added and places loved, with what was good; packing items checked; a range for the first plan of the day; a range for places per day · What is never added: names, photos, receipts, notes, exact dates, exact amounts, companions · So that no one is counted twice, we keep a mark of which groups you've already added to, under your own account only (only you can access it; deleted with your account). · How to turn it off: Me > Notifications > "Help other travelers anonymously" (for everything), or the last screen of "Write up a past trip" for each trip. Once off, nothing new is added. A shared trip is left out entirely if any one member has turned it off. · These numbers are shown only after at least 11 different people and 30 trips are in the same group, and while numbers are small they are shown only roughly, such as "6 in 10". About location: your device's current coordinates and your photos' capture coordinates are never sent to our server under any circumstance. However, three things are kept on our server. One is the result of turning a photo's capture location into a city on your device — that is, which city you were in and when — which is city-level information (an area of several kilometres or more). The second is the place names you write in your trip records or choose from suggestions (for example, where you stayed or ate), together with the dates of that trip. The third is the coordinates of places you search for or pick on the map (a shop, a sight), stored so we can pin them on the map and work out travel times; these are the locations of places you chose, not where you were. The first is kept once you link an account; the second and third are kept under an anonymous ID even without one (shared trips under your account). How we collect: generated automatically as you use the app, entered or chosen by you, and received through Apple or Google sign-in. What we process is the minimum needed for the purposes above. Your device's coordinates and photo originals are not needed for those purposes, so we do not collect them.