OurBeom

English translation. The Korean version is the binding text. If there is any inconsistency between the Korean and English versions, the Korean version prevails.

Proofie is an iOS and Android timestamp camera app provided by OurBeom (아워범). This Privacy Policy explains what information the App collects, why it is collected, how it is used, and what rights you have in relation to that information.

This Policy applies to the iOS App (App Store ID 6809110642, Bundle ID com.ourbeom.proofie) and the Android App (Package Name com.ourbeom.proofie). It does not apply to the OurBeom website.

Proofie does not require an account or sign-in. Photos and videos (including timelapses), sound recorded in videos, camera originals, edited images and videos, records, notes, and workout information imported from Health remain on your device and are not sent to the Company. Because iOS and Android process different information, this Policy identifies the platform on which each activity occurs.

1. Information We Collect

The three-year retention period for enquiries and the five-year retention period for purchase and subscription information are based on the retention periods under Korea’s Act on Consumer Protection in Electronic Commerce for consumer complaints and disputes and for payment and supply records, respectively.

RevenueCat Purchase and Subscription Records

The Company uses the RevenueCat SDK to record and manage purchase and subscription information on iOS and Android.

Because Proofie does not use user accounts, RevenueCat creates a random anonymous App User ID rather than receiving a Company membership ID. iOS and Android use separate anonymous IDs, and the Company does not link them as belonging to the same person.

• On iOS, StoreKit 2 is the source of truth for purchases, restores, and paid access. RevenueCat records and validates App Store receipts and transactions in observer mode.
• On Android, Google Play Billing is the source of truth for purchases, restores, purchase acknowledgements, and paid access. The RevenueCat Android SDK runs with PurchasesAreCompletedBy.MY_APP. It synchronizes purchases confirmed by Google Play during the first per-install synchronization of an existing active purchase, a new purchase, completion of a pending purchase, and a user-initiated restore.

On neither platform does the App use RevenueCat CustomerInfo or entitlements to unlock paid features. A RevenueCat outage or synchronization failure does not change a purchase or restore completed by the relevant app store or whether paid features are available. RevenueCat is neither the payment provider nor the final authority for App access.

The Android App disables RevenueCat’s automatic advertising-identifier collection and diagnostics in code. As a result, the Android App does not send an advertising ID or RevenueCat diagnostic or crash logs. Technical information such as IP address, device type, and operating system may still be processed as necessary to provide the purchase service.

Proofie does not send RevenueCat photos, videos, recorded sound, camera originals, edited images and videos, records, note contents, categories, places, EXIF information, file paths, card numbers, bank-account numbers, or other payment-method information.

Google Analytics for Firebase

The Company uses Google Analytics for Firebase on both iOS and Android. Statistics from both platforms are collected in a single Google Analytics property, although the installations that send statistics differ by platform.

• iOS: The App uses FirebaseAnalyticsCore 12.19.2. Firebase is initialized only after the App verifies that it is a production installation from the App Store. Firebase is not initialized in the simulator, an Xcode installation, or TestFlight.
• Android: The App uses firebase-analytics 23.2.0 with Firebase Android BoM 34.19.0. Firebase is initialized only in a release build installed from Google Play, including installations from Google Play internal and closed testing. It is not initialized in debug builds, installations made directly (for example, through adb), or installations from other app stores.

Collection is enabled by default for these installations, and the App currently does not provide a setting to disable it.

Google Analytics assigns an app-instance ID to each installation. The Company does not set a membership ID or Google Analytics user ID and does not link this identifier to your name, email address, or telephone number.

Information sent to Google Analytics may include:

• lifecycle and session events such as first_open, session_start, and user_engagement, and, where applicable, app or operating-system updates and in_app_purchase;
• custom events measuring features such as saving a photo or video, attempting to share a photo or video, opening the subscription screen, and purchase or restore flows and their results, with parameters such as template, format, and subscription product (for importing from Health, only that the button was pressed and the category; see Section 3);
• whether a record that is saved or brought into editing is a photo, timelapse, or video and where it came from (the camera, the photo library, or a capture recovered after the App closed before it was saved), the fact that microphone permission was denied, and a fixed code indicating where an error occurred (the length, frame count, or presence of sound of a video and the content of the picture or sound are not included; see Section 3);
• event time, App ID and version, platform, operating system and version, device type, brand and model, and operating-system language;
• on Android, the install referrer provided by Google Play; and
• approximate country, region, and city derived from a masked IP address. Google states that it uses the IP address temporarily to derive location and discards it before logging or storing it. The Company does not receive the IP address itself.

An automatic in_app_purchase event may contain the product ID and name, price or value, currency, quantity, and subscription, trial, or introductory-price status. The Company’s custom events may also record the selected product and the success of a purchase or restore. These events do not contain payment-method information.

The iOS App disables automatic screen reporting, Analytics products that support IDFA, IDFV collection, and the advertising-personalization signal.

The Android App disables automatic screen reporting, advertising-ID collection, the advertising-personalization signal, and ad-storage and ad-user-data consent defaults. It also removes the advertising-ID permission (com.google.android.gms.permission.AD_ID) and Privacy Sandbox advertising permissions from the App.

The Company does not use Google Signals and does not link Google Ads or BigQuery.

Google’s general processing practices are described in How Google Uses Information from Sites or Apps That Use Its Services.

Firebase Installation Information

FirebaseAnalyticsCore 12.19.2 on iOS and firebase-installations 19.1.2 on Android use Firebase Installations.

Firebase Installations creates a Firebase Installation ID (FID) and processes project and app identifiers, installation authentication tokens, and expiration information. The FID and the Analytics app-instance ID are separate identifiers.

Google states that an FID is retained until the Company requests deletion through its API and that deletion from live and backup systems may take up to 180 days. Deletion or replacement may begin after 270 days of inactivity. Deleting an FID does not automatically delete Analytics data.

FirebaseCoreDiagnostics is not included in the Firebase SDK products or dependencies used by the iOS App and therefore does not send separate diagnostic information. The Android App does not include other Firebase diagnostic products such as Crashlytics or Performance Monitoring.

2. Information We Do Not Collect and Payment Processing

The Company does not collect account information, date of birth, name, telephone number, address, contacts, precise GPS location, card numbers, bank-account numbers, or other payment-method information.

The App does not contain advertising and does not track activity outside the App for personalized advertising.

Paid subscriptions on iOS are processed by the Apple App Store, and paid subscriptions on Android are processed by Google Play. The Company does not receive your payment-method information.

Purchase and subscription history and status, receipts, and purchase tokens are processed separately as described in Section 1.

3. Information That Stays on Your Device

Photos and videos you take or select, camera originals (the intermediate video files used to edit a timelapse or video again and the record of the time each scene was captured), sound recorded in videos, records, edited images and videos, notes, categories, places, and App settings remain on your device.

The Company does not receive, retain, or view this information.

These items are deleted when the App is deleted. You can also delete individual records within the App. A timelapse or video that was not saved before the App closed is kept on your device for up to seven days so that you can continue editing it and is then deleted; it is deleted immediately if you choose to take a new one or leave editing without saving. Images and videos saved to your system photo library are managed by iOS Photos or your Android gallery and may remain after Proofie is deleted.

Device Backups — On iOS, because the information above is kept in the App’s storage, it may be included in iCloud Backup or computer backups that you have turned on. These backups are managed by Apple and by you and are not transmitted to the Company. As a result, on iOS, the information may remain in backups made before you deleted the App. The Android App excludes its storage from both Google backup and device-to-device data transfer.

Timelapses, Videos, and the Microphone

Timelapse and video capture and importing videos from your photo library are available in both the iOS and Android Apps.

• Timelapse: The App selects scenes from the camera view at regular intervals and makes a short video (15, 30, or 60 seconds) on your device. It does not record sound.
• Video: You can record up to three minutes. If you have granted microphone permission, sound is recorded as well. The App asks for microphone permission the first time you choose video on the capture screen, and you can still record without sound if you deny it. The microphone is not used for photos or timelapses. On iOS, while video is selected, the microphone is connected to the camera and the system’s microphone-in-use indicator may turn on, but sound is saved only while you are recording.
• Importing a video from your photo library: The App receives only the one video you choose in the operating system’s photo picker. It does not request permission to read your entire photo library. From the chosen video, it reads only the time it was taken and its format information, which it uses for the template’s date and time; it does not read location information. However, on Android, a video in a compatible format is kept on your device as is, without re-encoding, as the original for editing it again, so any information originally contained in that file may also remain on your device.
• Videos the App makes: The resulting videos (MP4) do not contain location information. When saved to Photos or your gallery, a video is dated with the time recording started (for an imported video, the time it was originally taken).

Videos and sound are not sent to the Company’s servers, RevenueCat, Google Analytics, or Discord. They leave the App only when you save or share them yourself. You can turn off microphone permission at any time in Settings › Proofie on iOS or in Settings › Apps › Proofie › Permissions on Android.

Workout Information Imported from Health

If you use "Import from Health" (on Android, "Import from Health Connect") in the Running, Swimming, or Gym category, the App only reads workout records within the permissions you grant. The App does not write, change, or delete any health data.

• iOS (Apple Health, HealthKit): workouts (type, start and end time, duration), walking and running distance, swimming distance, active energy burned, and workout routes.
• Android (Health Connect): exercise sessions (type, start and end time, duration), distance, active calories burned, total calories burned, and exercise routes. For a route recorded by another app, Health Connect asks for your consent for each record.

Imported values such as distance, duration, and calories are placed in the information fields of the photo you choose and are stored only in the record on your device. For a route, the App keeps only the shape of the line it draws on the photo (vertices scaled to a 0–1 range and the aspect ratio); it does not store latitude or longitude coordinates. It does not use place names or maps.

Health data is not sent to the Company's servers, RevenueCat, Google Analytics, or Discord, is not used for advertising or marketing, and is not shared or sold. Usage statistics record only that the import button was pressed and the category at that time; they do not record whether any workout was found or any distance, duration, or calorie value. A photo showing those values is saved or shared only when you do so yourself.

You can turn off access at any time in the iOS Health app (or Settings › Privacy & Security › Health) or in Health Connect settings on Android.

4. Connections Outside the App

• iOS: When you use the Contact feature in Settings and press Send, the enquiry information is transmitted to Discord. Google Analytics is transmitted automatically as described in Section 1. The App Store handles payment and subscription management. Apple Health (HealthKit) is only read on your device (Section 3).
• Android: When you use the Contact feature in Settings and press Send, the enquiry information is transmitted to Discord. Google Analytics is transmitted automatically as described in Section 1. Google Play handles payment and subscription management. Health Connect is only read on your device (Section 3).
• Both platforms: RevenueCat processes purchase and subscription information as described in Section 1. The Terms of Service and this Privacy Policy open the relevant documents on ourbeom.com. Saving and sharing use the operating system’s photo library and sharing features when you initiate those actions.

5. Service Providers and International Transfers

The following service providers process information on behalf of the Company. Information is transferred outside the Republic of Korea over encrypted internet connections when described below.

The Company does not sell personal information.

Most standard aggregated reports are not affected by the Analytics retention settings. FID-related deletion may take up to 180 days.

RevenueCat states that customer data is stored in AWS data centers in the United States. Its current Privacy Policy and Data Processing Addendum govern its subprocessors and specific processing locations. Data is deleted or returned under the applicable contract and law when processing ends or the relevant purpose and legal retention period expire.

For users in the European Economic Area, the United Kingdom, and Switzerland, transfers of information to these providers outside those regions rely on lawful transfer mechanisms provided in each provider's terms, such as the European Commission's Standard Contractual Clauses (with the UK Addendum for the United Kingdom) or an adequacy decision.

If you do not want your enquiry information to be transmitted to Discord, you may contact the Company through another channel, such as email.

If you do not want new purchase and subscription information to be sent to RevenueCat, you may choose not to purchase or restore a subscription. The SDK may still process an anonymous ID and service-necessary technical information when it starts, and paid features will not be available without a purchase.

To stop all new Google Analytics transmissions, you must currently avoid using an iOS production installation from the App Store or an Android installation from Google Play, or delete the App.

6. Retention and Deletion

The retention periods for enquiries and purchase and subscription information are described in Sections 1 and 5.

Information is deleted without undue delay when the applicable retention period expires or the purpose for which it was collected has been fulfilled. If applicable law requires continued retention, the information will be stored separately and deleted when the legally required period ends.

Google Analytics retains event-level data for two months and user-level data for 14 months, with the user-level retention period resetting upon new activity. Most standard aggregated reports are not affected by these settings, so the Company cannot guarantee that every statistic will disappear exactly after two or 14 months.

Payment-method information is retained by Apple or Google, not by the Company.

RevenueCat purchase and subscription records are deleted five years after the subscription ends.

7. Your Rights and Deletion Requests

Regardless of where you live, you may request access to, correction of, deletion of, or restriction of processing of your personal information by contacting contact@ourbeom.com.

The Company will process your request and notify you of the result within 10 days of receiving the request.

An anonymous RevenueCat customer record may be included in a deletion request. Please state the purchase platform and, if available, your store order or transaction information so that the Company can verify the requester and determine how to locate the relevant anonymous record.

Where the record can be identified, the Company will request deletion through the RevenueCat dashboard or API of the customer record and purchase history that the Company is not legally required to retain.

Records subject to a legal retention obligation will be stored separately and deleted when the applicable retention period ends.

Deleting a RevenueCat record does not cancel an App Store or Google Play subscription. You must cancel the subscription separately through the applicable store.

You may also request access to or deletion of identifiable Analytics data. The Company will process such requests to the extent the information can technically be identified and the tools provided by Google allow.

Deleting the App removes photos and records stored on the device and stops future transmissions from the App, but does not automatically delete Analytics data, Firebase Installation IDs, or RevenueCat data that has already been transmitted.

• Republic of Korea: You may request access, correction, deletion, and suspension of processing under the Personal Information Protection Act.
• EEA and UK: Depending on applicable law, you may have rights of access, correction, erasure, restriction of processing, objection, and data portability, and you may lodge a complaint with your local supervisory authority.
• California: Depending on applicable law, you may have rights to know and delete personal information and to receive equal treatment for exercising your privacy rights. The Company does not sell or share personal information.

For GDPR purposes, the Company currently relies on performance of a contract as the legal basis for purchase and subscription processing, and on legitimate interests for responding to enquiries and service-operations analytics, to the extent permitted by applicable law.

8. Users Under 16

Proofie is intended for users aged 16 or older and does not collect dates of birth.

If the Company learns that it has collected personal information from a person under 16, it will delete that information without undue delay.

Please contact contact@ourbeom.com if you believe this has occurred.

9. Security Measures

The Company takes reasonable technical and organizational measures to protect personal information, including:

• photos, videos, and records are not stored on Company servers;
• communications outside the App use encrypted HTTPS connections;
• access to enquiries and service-management consoles is restricted and access rights are managed; and
• accounts used to handle personal information are protected with two-factor authentication.

10. Changes to This Privacy Policy

When this Privacy Policy is changed, the revised Policy will be published at the same address with a new effective date. Previous versions will remain available through the date-selection menu.

The Company will also provide advance notice through the App. Any change that is unfavorable to users will be announced at least 30 days before it takes effect.

Revision History

• October 18, 2026 — Added timelapse and video capture and importing videos from the photo library (iOS and Android 1.6.0): microphone permission and recorded sound, that videos and camera originals are stored only on the device, how long captures not yet saved are kept, iOS device backups and the Android backup exclusion, what is read through the photo picker, and what usage statistics record.
• October 14, 2026 — Added the import of workout records from Apple Health (HealthKit) on iOS and Health Connect on Android (version 1.5.0): what is read, that it stays on the device, that only the shape of a route is kept, and what usage statistics record.
• October 8, 2026 — Extended the enquiry disclosures to Android, whose App (version 1.4.0) added the Contact feature in Settings that sends enquiries to Discord, and stated that the app language is sent with an enquiry.
• October 1, 2026 — Added the Android App and Google Play payment processing; described anonymous IDs, receipts, Google Play purchase tokens, transactions, and technical information processed by RevenueCat on both platforms; aligned observer synchronization, platform-specific access decisions, deletion procedures, and the 16-or-over audience with the implementation; and added Google Analytics for Firebase usage statistics and Firebase installation information for Android.
• September 30, 2026 — Updated the iOS Google Analytics for Firebase disclosures to reflect the actual processing and settings.
• September 20, 2026 — First published.

11. Privacy Officer

12. Further Remedies

Business Information