OurBeom

English translation. The Korean version is the binding text; where the two differ, the Korean version governs.

Proofie is an iOS timestamp camera app made by OurBeom (아워범). This policy explains what the App collects, why it collects it, and what you can ask us to do. It covers the iOS App (App Store ID 6809110642, bundle ID com.ourbeom.proofie), not the OurBeom website.

There are no accounts or sign-in. Photos and records stay on your device and are not sent to the Company. What leaves the App consists of enquiries that you choose to send, subscription-processing information, and usage statistics linked to pseudonymous identifiers.

1. What we collect

The three-year period for enquiry information is the period for preserving consumer complaint and dispute records under Korea's Act on Consumer Protection in Electronic Commerce.

Google Analytics for Firebase usage statistics

The Company uses FirebaseAnalyticsCore 12.19.2 for iOS. Firebase is initialised only after the App verifies that it is an App Store production installation. Firebase is not initialised and no usage statistics are sent from the simulator, an App installed directly from Xcode, or a TestFlight installation. Statistics are on by default in an App Store production installation, and the App currently has no setting that turns them off.

Google Analytics automatically assigns an app-instance ID to each installation when the App is first opened. In exported data, a pseudonymous identifier of this kind may appear as user_pseudo_id. The Company does not create a separate account, member ID, or Google Analytics User-ID, and does not link this identifier to a name, email address, or telephone number. The identifier can nevertheless connect events generated by the same App installation, so this policy does not describe the statistics as completely anonymous.

The statistics sent are as follows.

• App-lifecycle and session events automatically collected by Firebase, such as first_open, session_start, and user_engagement, and, where applicable, App or operating-system update events and in_app_purchase
• Fourteen custom event types that measure use of product features, such as saving a photo, attempting to share, opening the subscription screen, and the purchase or restore flow and its outcome, together with analytical parameters such as the template, aspect ratio, or subscription product selected
• The event time, App identifier and App version, platform, operating system and version, device category, brand and model, operating-system language, and similar automatically collected information
• Approximate country, region, and city derived from a masked IP address. Google says it processes the IP address temporarily to derive location and discards it before the address is logged or stored; the Company cannot see the IP address itself in Google Analytics.

An automatic in_app_purchase event may include the product ID and name, price or value, currency and quantity and, where applicable, whether it is a subscription, free trial, or introductory-price offer. It does not include a card number, bank account number, or other payment-method information. The success or failure of a purchase or restore and the product selected may also be recorded in a custom event sent by the Company.

The App has automatic screen reporting turned off, so it does not send automatic screen_view events or screen names and screen IDs. It also uses the Analytics product that has no support for the advertising identifier (IDFA), has disabled collection of the identifier for vendors (IDFV), and turns off the App signal that permits use for ad personalisation. Google Signals is not used, and the property is not linked to Google Ads or BigQuery. Property-level ad personalisation is allowed in all 307 regions, but the events sent by the App carry the signal that disallows ad personalisation. Granular location and device data collection is enabled in all 307 regions in the Firebase console, so the approximate location and device information described above is processed.

What the Company can see in the Google Analytics console consists of aggregated reports and some event- and user-level information associated with pseudonymous identifiers. Google processes the IP address and automatically collected information to produce these reports, but does not provide the IP address itself to the Company. You can also read how Google uses information from sites or apps that use its services.

Among the Analytics account's data-sharing settings, Google products and services is off. Modelling contributions and business insights, technical support, and recommendations for your business are on. The console explains that modelling uses aggregated and anonymised measurement data, that technical support permits Google support staff to access Analytics data and the account to provide support, and that recommendations may use account-usage and configuration information.

Firebase installation information

FirebaseAnalyticsCore 12.19.2 uses Firebase Installations. This service creates a Firebase installation ID (FID) for each App installation and processes the Firebase project and App identifiers and an installation authentication token and its expiry information. It does so to identify and authenticate an installation and may support analytics and attribution. The FID and the Analytics app-instance ID are different identifiers, and deleting an FID does not also delete Analytics data.

Google says an FID is retained until the Company requests its deletion through an API, and removal of associated data from live and backup systems may take up to 180 days after the request. Backend deletion or rotation of the FID may begin after the App has been inactive for 270 days. If services that generate FIDs continue to be used, a new FID may be created after deletion.

FirebaseCoreDiagnostics is not included in the FirebaseAnalyticsCore product or its dependencies in the Firebase iOS SDK 12.19.2 used by the App, so that component does not separately collect or send diagnostics in this setup.

Content we do not send

Usage statistics do not contain photos, the records and output images created, the actual contents of a memo, category, or place, whether a memo or place was entered, photo EXIF information, file paths, raw error text, names, email addresses, or telephone numbers.

Subscription records follow two paths. Automatic and custom purchase events are kept in Google Analytics, while transaction receipt information is kept by the purchase-management service RevenueCat. Neither contains payment-method information. The five-year receipt-retention period is the period for preserving payment and supply records under Korea's Act on Consumer Protection in Electronic Commerce.

We will give advance notice and obtain any consent required before using this information for another purpose.

2. What we do not collect

The Company does not collect account information, names, telephone numbers, addresses, contacts, precise GPS location, payment-method information, the advertising identifier (IDFA), or the identifier for vendors (IDFV). As described in Section 1, however, pseudonymous identifiers and an approximate location derived from a masked IP address are processed. The App carries no advertising.

We do not track activity outside the App. We do not engage in tracking as Apple defines it — linking data with information collected in other companies' apps or websites for targeted advertising — and the App therefore does not show an App Tracking Transparency prompt.

Paid subscriptions are charged by Apple's App Store. The Company does not receive payment-method information such as a card or bank account number. The App checks with the App Store on the device to decide whether to unlock paid features. The purchase or restore is nevertheless recorded as described in Section 1.

An image attached to an enquiry is resized and saved again before it is sent, so original metadata such as the shooting location (EXIF) is not sent with it.

3. What stays on your device

Photos taken or selected, records and output images created, memos, categories, places, and App settings are all stored only on your device. The Company does not receive, keep, or view them.

They disappear with the App when you delete it, and you can delete an individual record inside the App. Images saved to the photo library are managed by the iOS Photos app and remain there even if you delete Proofie.

4. Connections outside the App

Contact in Settings sends its contents only when you press Send. Terms of Use and Privacy Policy open the corresponding documents on ourbeom.com. Subscription purchase and cancellation are handled by the iOS App Store screen, and saving and sharing are handled by the iOS Photos app and share sheet. Google Analytics usage statistics are sent automatically under the conditions set out in Section 1.

5. Processors and international transfers

The providers below process data for the Company. Information is transferred outside the Republic of Korea over an encrypted internet connection at the time specified in each row. The Company does not sell personal information.

The Google Analytics contracting party and data processor is Google LLC. Firebase states that Google generally acts as a processor for Firebase services; Google Analytics is governed by the separate Google Analytics Terms of Service and Google Ads Data Processing Terms. Google does not guarantee a fixed list of processing countries for Firebase services that do not offer location selection and says facility locations may vary by service.

If you do not want an international transfer, the current options are as follows.

• You can avoid sending enquiry information to Discord by not using Contact in the App and using another stated contact method instead.
• You can avoid sending subscription information to RevenueCat by not buying or restoring a subscription. Paid features will then be unavailable.
• At present, completely preventing a new transfer to Google requires not opening the App for the first time, or deleting it. The App has no control that disables usage statistics alone. Deleting the App makes the App unavailable; if you reinstall and run an App Store production installation, new identifiers may be created and statistics transmission may resume. You can request deletion of information already sent as described in Section 7.

We will update this policy if a recipient or destination country changes. Google's facility locations may change; the current locations are available at the official links above.

We do not disclose personal information to third parties other than the providers above, except where a law-enforcement authority makes a lawful request under applicable procedure.

6. Retention and deletion

The retention periods for enquiry and subscription information are shown in the table in Section 1. We delete information without undue delay when its period expires or its purpose has been fulfilled. Electronic files are deleted using a method that makes recovery difficult, and any printout is shredded or incinerated. If the law requires continued retention, the information is kept separately from other personal information and deleted at the end of that period.

The Google Analytics property retains event data for 2 months and user data for 14 months, and the user-data period resets when there is new activity. Google processes deletion under this setting on a monthly basis. The setting applies to Explorations and user-level data but not to most standard aggregated reports. We therefore cannot promise that every statistic disappears exactly 2 or 14 months after collection.

Payment-method information such as a card or bank account number is kept by Apple and not by the Company. Transaction receipt information is deleted five years after the subscription ends, as required for payment and supply records under Korea's Act on Consumer Protection in Electronic Commerce.

7. Your rights and deletion of Analytics data

Wherever you are, you can make the requests below by writing to contact@ourbeom.com. We will act and tell you the outcome within 10 days after receiving the request.

Because the Company creates neither an account nor an Analytics User-ID, it normally cannot identify a particular Analytics app instance from a name or email address alone. Google Analytics provides a function for submitting a user deletion request using the app-instance ID, but the App does not currently show that ID to you. If you want access to or deletion of data for a particular installation, contact us. After verifying the requester, we will explain the scope that can technically be identified and the process available through Google's deletion tools. Google's user-deletion process may first hide the data in reports and take up to 63 days to remove it permanently from its servers.

Deleting the App removes on-device photos and records and stops later statistics transmission, but it does not automatically delete Analytics data already sent or server data associated with an FID. FID deletion and Analytics data deletion are separate processes. Figures already aggregated and no longer linked to an individual installation may remain after a deletion request.

• Republic of Korea (PIPA) — you may request access to, correction or deletion of, or suspension of processing of, your personal information. You may also act through a legal representative or an authorised person; in that case, attach the authorisation. If we refuse a request, we will give the reason and explain how to object.
• European Economic Area and United Kingdom (GDPR) — you have rights of access, correction, deletion, restriction, objection, and data portability, and may complain to the supervisory authority in your country.
• California (CCPA/CPRA) — you have the right to know what has been collected, to request deletion, and not to be discriminated against for exercising these rights. The Company does not sell or share personal information and has not done so in the preceding 12 months.

For GDPR purposes, the legal basis for processing an enquiry is the legitimate interest in answering it (Article 6(1)(f)), and the legal basis for usage statistics is the legitimate interest in analysing and improving the App under the same provision.

8. Children under 14

Proofie is not directed at children under 14, and we do not knowingly collect their personal information. Its App Store age rating is not in a category directed at children.

If we learn that information about a child under 14 has been collected, we will delete it without undue delay. If you believe a child has provided personal information, write to contact@ourbeom.com.

9. Security measures

• Photos and records are not stored on a server.
• All communication outside the App uses an encrypted connection (HTTPS).
• Access to enquiry information and service consoles is limited to the minimum number of people and access rights are managed.
• Two-factor authentication is applied to accounts that handle personal information.

10. Notice of changes

When this policy changes, a new edition with a new effective date is posted at the same address. Earlier editions remain available through the date menu at the top of the page. The address does not change. We also give advance notice inside the App, and give at least 30 days' notice before a change unfavourable to users takes effect.

Revision history

• 30 September 2026 — Changed the usage-statistics processor from PostHog, Inc. to Google LLC, the contracting party for Google Analytics for Firebase, and corrected the descriptions of pseudonymous identifiers, automatic events and purchase information, device information, approximate location, retention, and deletion to match the actual processing and settings.
• 20 September 2026 — First published.

11. Privacy officer

For questions, complaints, or remedies relating to personal information, contact us below and we will reply without undue delay. The privacy officer also receives data-access requests.

12. Further remedies

If our answer is not sufficient, you may seek dispute resolution or make a report to the bodies below.

Business information