Privacy Policy
Last updated 2026-10-02
This English version is provided for your convenience. If there is any conflict between it and the Korean version, the Korean version prevails. Altair ("the Service") is an anonymous journaling app. We do not normally collect information that directly identifies you, such as your real name, email address, or phone number.
01Information we collect
| Category | What | When |
|---|---|---|
| Anonymous auth | An anonymous authentication ID (Supabase anonymous) | Automatically, on first use |
| Account link (optional) | Apple or Google sign-in identifier | If you link an account |
| Log | Log text (public/friends up to 140 characters, private up to 1,000), the moon phase, and the time written | When you write a log |
| Photo (optional) | An image you attach to a log | When you attach a photo |
| Music (optional) | The YouTube video ID and title you attach | When you attach music |
| Comment | Comment text (up to 140 characters) and time | When you comment |
| Name (optional) | A name you set yourself (nickname, up to 20 characters) | When you set a name |
| Location (optional) | A place name only (city/district level, e.g. "Busan Haeundae-gu") | When you attach location |
| Anonymous code | A 4-character anonymous code | At account creation |
| Recovery | A bcrypt hash of your recovery code (the code itself is not stored) | When you set a recovery code |
| Interactions | Like and save history, friend relationships (mutually approved), and per-friend aliases | When you use these features |
| Notifications | In-app notification records and your notification settings | When they occur or you change settings |
| Push (optional) | Push subscription details (endpoint and the encryption keys p256dh and auth) | When you turn on push |
| Report / block | Report and block history (including a short snippet of the reported content captured at report time) | When you report or block |
| Operational | Account creation time and whether you have written any logs | Automatically, during use |
| Content check | The text of logs and comments (see section 10) | When you write (automatic) |
| Automatic | An authentication token (stored on your device) and cookies needed to run the Service | Automatically, during use |
02How we use your information
We use this information only to provide and operate the Service (your anonymous account, logs, observation, comments, friends, saves, likes, and notifications), to keep the Service safe (content checks, reports, and blocks), and to maintain reliability and security. If we ever want to use information for a new purpose, we will update this policy and, where required, ask for your consent.
03How long we keep your information
- ·Account and logs: when you "end your journey," you choose to keep or erase your logs. Either way, private logs, friends-only logs, your name, likes, saves, friend relationships, notifications, and push subscriptions are deleted immediately. If you choose "erase," public logs that no one has observed yet are also deleted; if you choose "keep," they are anonymized and kept. In either case, public logs that have already been observed are anonymized and kept (unlinked from you), because other users' observations, saves, and likes rest on them.
- ·Photos: follow their log. A photo is deleted when its log is deleted, and kept with a log that is anonymized and retained.
- ·Comments: when you end your journey, you may also choose to delete the comments you wrote; otherwise they are unlinked from you and kept anonymously.
- ·Recovery code hash: kept while your account exists, then deleted.
- ·Report and block history: kept for one year to handle abuse, then deleted.
- ·Text sent for content checking: used only for the check and not separately stored.
- ·Where the law requires a longer retention period, we keep the information for that period.
04Location (optional)
If you attach location, we store only a coarse place name (city/district level). We do not send or store your precise coordinates. You can use the Service without location.
05How we dispose of information
When the purpose is fulfilled or a retention period ends, we delete the information so that it cannot be recovered. Where we anonymize information instead, we process it so that it can no longer identify a specific individual.
06We do not sell or share your personal information
We do not sell your personal information, and we do not share it for advertising or cross-context behavioral advertising. We do not provide it to third parties, except for the service providers listed below and except where a competent authority makes a lawful request under applicable law.
07Service providers
| Provider | Role |
|---|---|
| Supabase, Inc. | Anonymous authentication and data storage (backend infrastructure) |
| Vercel, Inc. | Service hosting |
| Anthropic, PBC | Automated checking of inappropriate content |
08International data transfer and processing location
Your data is stored in the Republic of Korea. Some information is processed in or accessed from the United States by the providers below during operation and support. Your processing location is the same regardless of the country you use the Service from.
| Recipient | Location | Items | Purpose |
|---|---|---|---|
| Supabase, Inc. | Stored in Korea; US entity may access in support | Anonymous auth ID, logs and comments and their metadata, photos, name, place name, interactions, notifications, push subscriptions | Authentication and data storage |
| Vercel, Inc. | United States | Network information from your connection | Service hosting |
| Anthropic, PBC | United States | Log and comment text (only when the AI check is active) | Automated content checking |
09Third-party content (YouTube music)
You may attach a YouTube video (music) to a log. We store only the video ID and title.
- ·When a log with music is viewed or played, your browser/device connects directly to YouTube (Google) servers to show the thumbnail and play the video.
- ·We use the youtube-nocookie.com domain (YouTube's privacy-enhanced mode).
- ·For how YouTube/Google handles data, see Google's privacy policy. If you do not attach or play music, this connection does not happen.
10Automated content checks
To protect users from inappropriate content, we automatically check the text of logs and comments.
- ·The check has two stages: (1) a rule-based check (banned words, links, contact details) that runs entirely on our server and is not sent anywhere, and (2) an AI contextual check (when active).
- ·When the AI check is active, the text of the log or comment is sent to Anthropic's API (United States) for that check.
- ·This checking is essential to operating the Service and cannot be turned off for individual logs or comments; your agreement to this policy when you start using the Service serves as your consent.
- ·Text sent for checking is used only for the check and is not separately stored.
- ·Content found to be inappropriate may be withheld from display. You may dispute a decision through our contact channel.
11Children under 16
The Service is intended for people aged 16 and older. We do not knowingly allow anyone under 16 to sign up or use the Service. If we learn that an account belongs to someone under 16, we delete the account and its data.
12Your rights and how to exercise them
- ·You may request to access, correct, delete, or restrict processing of your personal information.
- ·Because the Service is anonymous, we verify you through your anonymous code and recovery code. If you lose these, we may be unable to identify your account and fulfill a request.
- ·A log that has been observed cannot be edited, but you can delete it at any time. You can also use "End the journey" to delete or anonymize your entire account's data.
- ·To exercise a right, use the in-app features or email zoe@vanegyre.com. We respond without undue delay.
13Region-specific rights
If you are in Korea. This Service is provided under the Personal Information Protection Act (PIPA). The international transfer above is disclosed under Article 28-8(1)(iii) of PIPA, and this disclosure serves in place of separate consent. You may contact the Personal Information Dispute Mediation Committee (kopico.go.kr), the Privacy Infringement Report Center (privacy.kisa.or.kr), or the police cybercrime units.
If you are in the United States (incl. California). We do not sell or share your personal information. You may request access to, deletion of, or correction of your personal information, and we will not deny you service or otherwise retaliate for exercising these rights.
If you are in Canada. You may request access to, and correction of, your personal information, and may complain to the Office of the Privacy Commissioner of Canada (OPC, priv.gc.ca).
If you are in Australia. You may request access to, and correction of, your personal information, and may complain to the Office of the Australian Information Commissioner (OAIC, oaic.gov.au).
If you are in the United States (incl. California). We do not sell or share your personal information. You may request access to, deletion of, or correction of your personal information, and we will not deny you service or otherwise retaliate for exercising these rights.
If you are in Canada. You may request access to, and correction of, your personal information, and may complain to the Office of the Privacy Commissioner of Canada (OPC, priv.gc.ca).
If you are in Australia. You may request access to, and correction of, your personal information, and may complain to the Office of the Australian Information Commissioner (OAIC, oaic.gov.au).
14Security
- ·Recovery codes are stored only as bcrypt hashes; we do not store the originals.
- ·Data is encrypted in transit.
- ·Database access is controlled with row-level security, and access rights are kept to a minimum.
- ·We minimize collection itself — for example, we never send or store precise location coordinates.
15Cookies
- ·We use an authentication token (stored on your device) and cookies necessary to run the Service.
- ·You can block cookies in your browser settings, but some features, such as signing in, may then be limited.
- ·We do not use cookies for advertising or for tracking you.
16Data breach notification
If we learn that personal information has been lost, stolen, or exposed, we will notify affected users without undue delay and, where required, report to the relevant authorities, as applicable law provides.
17Changes to this policy
We may update this policy as laws or the Service change, and we will announce changes within the Service. For significant changes, we will give notice before they take effect. The authoritative record of effective dates and revision history is kept in the Korean version.
18Contact
Privacy officer: Vanegyre. Email: zoe@vanegyre.com.