Friday Privacy Policy

Effective date: «EFFECTIVE_DATE» First published: «EFFECTIVE_DATE»

rimikimi ("the Company") complies with Korea's Personal Information Protection Act ("PIPA"), the Act on the Protection, Use, etc. of Location Information ("Location Information Act"), and the Framework Act on Artificial Intelligence Development and Establishment of a Foundation for Trust ("AI Framework Act"). This Privacy Policy explains how the Company handles the personal information of users of Friday (the "Service"). It is published inside the app (Settings > About) and on the web at https://rimikimi.com/<app>/privacy.

⚠️ This Service has no user account or login. Instead, the Service is provided through an anonymous identifier generated on your device. Several provisions below reflect this design.

1. General

This Policy describes the categories of personal data the Company collects while operating the Service, the purposes of processing, retention periods, cross-border transfers, sub-processing, deletion procedures, and how you can exercise your rights.

2. Personal Data We Process

Data collected

Data we do NOT collect

• Name, date of birth (beyond the self-declared age-14 check), phone number, email address (unless you provide it when contacting support), home address
• Payment details — payments are processed entirely by the Apple App Store; the Company never holds your card information
• Real-time heart rate — the app does not measure heart rate itself during a run. As of 2026-09-13 it does read heart rate and resting heart rate already recorded in Apple Health (see item ① above), solely to avoid suggesting a harder-than-usual target when your sleep or resting heart rate differs from your own recent baseline
• Voice/microphone input — the Service never uses the microphone
• Raw GPS tracks (your full running route) — stored only on-device and in Apple Health, never uploaded to our server
• The verbatim text of generated speech — only a hash for deduplication is stored server-side

3. Purposes of Processing

1. Storing and displaying your running history
2. Generating personalized text/voice comments comparing today's pace with your past runs and weather
3. Generating loop routes starting from your current location
4. Sending a nudge (reminder notification) when you haven't run for a while
5. Managing the free trial and paid subscription
6. Improving service quality (error analysis, cost/performance measurement)
7. Preventing abuse (e.g., repeated trial resets)
8. Complying with statutory record-keeping obligations (e.g., location-use/provision records)

4. Retention Periods

⚠️ We retain only a hashed device identifier and a run count for 12 months after deletion, solely to prevent repeated trial abuse. This value is not combined with any other personal data. Whether this qualifies under PIPA Art. 21(1) proviso is [unverified — legal review recommended].

5. Processing of Sensitive Data (Health Information)

The Company treats your running records (and, if you consent, Apple Health data) as sensitive data (health information) under PIPA and processes them only after obtaining consent separate from all other consents. The full Korean-language notice shown at consent time is reproduced in the Korean-language version of this page (toggle KO above), §5 and can be reviewed anytime in-app (Settings > About > Health Data Consent). Health information is never used for advertising, marketing, or shared with third parties.

6. Processing of Personal Location Information

The full set of Location Information Act disclosures (purpose, retention, third-party provision, rights and how to exercise them, retention of use/provision records, the location-information manager) is set out in the separate Location-Based Service Terms document. In summary:

• Location permission is requested only for "while using the app" — the Service never requests "Always" location access.
• Raw GPS coordinates during a run are stored only on your device and in Apple Health, never uploaded to our server.
• Only a single starting-point coordinate is sent to our server to generate a route, and it is rounded to ≥100 meters before storage so your exact address cannot be reverse-derived.
• Location-use/provision records are automatically logged and retained for 6 months.
• Personal location information is not provided to third parties. If this changes, affected users will be notified immediately as required by law.

7. Cross-Border Transfer of Personal Data

To generate comment text, synthesize voice, and build running routes, the Company transmits minimal data in real time to the overseas processors listed below. Our database runs in the Seoul region (ap-northeast-2), Korea, so the personal data we store is not transferred abroad.

Never transmitted to the above recipients: location coordinates, the device identifier (hashed or otherwise), your name, or contact details.

How to refuse, and the effect of refusing: If you do not consent to this overseas processing, we cannot provide personalized comments or voice guidance — core functions of the Service will be unavailable. You may withdraw consent anytime via Settings > About > Withdraw Overseas-Transfer Consent; withdrawing lets you cancel your subscription and delete your data.

8. Sub-Processing (Domestic)

9. Deletion / Erasure

🔴 This Service has no account. Deleting the app does NOT automatically delete your server-side records. Before deleting the app, please run Settings > Delete My Data. Requests are processed within 30 days, and completion is confirmed in-app.

Exceptions: location-use/provision records (6-month statutory retention) and trial-usage history (12 months after deletion) are retained per §4 before erasure.

10. Your Rights and How to Exercise Them

Because there is no account, most rights are exercised directly through the device you used: view your history in the Records tab, edit settings directly, disable the nudge/withdraw Health access/withdraw overseas-transfer consent to halt specific processing, or request deletion via Settings > Delete My Data (processed within 30 days). If your device is lost or these in-app paths do not resolve your request, contact the Data Protection Officer below by email; because we retain only a one-way hash of your device identifier, please provide any identifying context you can (approximate usage dates, app version, purchase receipt) to help us process your request.

11. Children Under 14

The Service blocks sign-up for users who self-declare as under 14 and does not process the personal data or location information of children under 14.

12. Security Measures

Encryption at rest; row-level access control with all database access routed through server functions (the app never talks to the database directly); a one-way hash (not the raw identifier) is stored for the device ID; automatic logging of location-data access; API keys are held server-side only and never embedded in the app binary; and minimal collection — data not actually used by the product is not collected. Heart rate was excluded until 2026-09-13 precisely because nothing used it; it was added together with a stated purpose once recovery-aware coaching was introduced.

13. AI Disclosure

Under Article 31 of Korea's AI Framework Act: this Service operates on generative AI. Nudge messages, in-run comments, and the voices that read them aloud are all AI-generated outputs. The facts stated (distance, pace, comparisons, weather) are drawn only from your own records and weather data; if no underlying record exists, the sentence is not generated. This app is not a medical device and may not be used to diagnose, treat, mitigate, or prevent disease. AI comments are not medical advice.

14. Automated Decision-Making

Generated comments are intended to support your experience and do not constitute an automated decision producing legal effects on, or otherwise significantly affecting, you.

15. Data Protection Officer

16. Changes to This Policy

Material changes will be announced in-app at least 7 days before taking effect (30 days for changes materially affecting your rights).

Revision history

Business Information