Privacy Policy

You can use the basic features of all three apps without signing in. If you don’t sign in, your records stay on your device and are not sent to Haruda’s servers. The “automatically collected data” below, however, is collected whether or not you sign in.

When you create an account or sign in (optional)

• Email address, password (stored with one-way encryption), nickname
• Whether you agreed to receive marketing messages, app language, email verification records
• If you signed up with a Google account (not offered in the current apps): the account identifier, email address, name, and profile photo URL provided by Google, and the sign-in token Google issued

App records synced when you sign in

• Haruda Focus: subjects, focus records (date, start and end time, focus time, focus score, description), timer settings, D-Days, avatar and app settings
• Haruda Alarm: sleep records (date, wake-up and bedtime, nap minutes, memo). Alarm settings are not sent to the server.
• Haruda Ritual: habits (name, icon, color, goal, days, reminder settings), check-ins, diary entries (text, mood), memos, and the settings, reference notes, results, and values you enter yourself for the auto-calculation bots
• Together in Haruda Focus: the spaces you join and your role, your status in the space (focusing, resting, offline), cheers you send and receive (up to 20 characters), and reports

When you make a purchase

• The product, platform (App Store or Google Play), store transaction number, store-signed proof of purchase (receipt), and entitlement period
• Gift codes in Haruda Focus and Haruda Alarm: the codes you create and whether they have been used
• Payments are processed by the App Store and Google Play. We never receive your card number or other payment details.

Automatically collected data

• Service usage: last access time
• Ad SDKs (Google AdMob, Meta Audience Network): advertising identifier, device information (model, OS version), IP address, ad impressions and clicks
• Analytics and crash tools (Firebase Analytics, Firebase Crashlytics, Sentry, Meta SDK): app usage events, device information, app version, error and crash information

We don’t link this data to your account. Section 5 lists the companies and countries, and Section 7 covers ads and how to opt out.

Only when you use a feature

• Weather in Haruda Alarm: if you allow location access, your device’s latitude and longitude are sent to the weather provider (OpenWeather). They are not stored on Haruda’s servers.
• Support: if you email us, your email address and the content of your message

Data that stays on your device

The list of allowed apps you choose for Focus Lock, photos for the camera wake-up mission in Haruda Alarm, alarm settings, and records you keep without signing in never leave your device.

We use personal data only for the following purposes.

• Account creation, sign-in, identity verification, and password reset
• Syncing and keeping your records across devices
• Running Together spaces, delivering cheers, handling reports, and preventing misuse
• Verifying purchases, issuing and redeeming gift codes, providing benefits, and handling refunds and disputes
• Estimating values with the Haruda Ritual auto-calculation bots (if you turn a bot on; Section 6)
• Showing ads to free users and measuring ad performance
• Usage statistics for fixing errors and improving the service
• Showing the weather in Haruda Alarm
• Notices and support, and news about new features if you agreed to receive marketing messages

We keep your data until you delete your account. When you do, we promptly delete your account information and records from all three apps from Haruda’s servers, except for the data below, which we keep only for the stated purpose and period.

• Purchase records(product, store transaction number, proof of purchase, subscription period) — 5 years, to keep payment and delivery records as required by Korea’s Act on the Consumer Protection in Electronic Commerce. After account deletion they are kept with your member number only, without your email or other account information.
• Account deletion records(email address, member number if any, time of deletion) — kept so that a deleted account and its records don’t come back.
• Report handling records (reported cheer, member numbers of the reporter and the sender, and outcome) — 1 year after the report is resolved, to handle misuse and prevent it from happening again.
• Gift code records(member number of the creator, code, whether it has been used) — so that the recipient can still redeem the code and the same code can’t be used twice, 5 years from the day the code is created (the same period as payment and delivery records under Korea’s Act on the Consumer Protection in Electronic Commerce).
• Support emails (email address, message) — to respond to your inquiry, 3 years after the inquiry is resolved (the same period as records of consumer complaints and dispute handling under that Act).

Cheers expire 7 days after they are sent. In Together spaces, a deleted account appears only as “Has Left,” with no nickname, email, or other information that identifies you (your member number and the dates you joined and left remain so that statistics periods stay consistent). Data processed by the companies in Sections 5 and 6 is kept according to each company’s retention policy.

We process your personal data only for the purposes in Section 2 and don’t provide it to third parties unless you consent or the law specifically requires or permits it (including requests from law enforcement or other authorities under procedures set by law). Entrusting processing to service providers, including transfers abroad, is described in Section 5.

Because of how the service works, however, the following may be received or seen by other people or companies.

• If you join a Together space, other members of that space can see your nickname, your status in the space, and your focus time statistics, and a cheer is shown to the member who receives it together with who sent it. If you share an invite link, anyone who receives it can see your nickname and the space name.
• Data that Google and Meta receive directly through ad SDKs is handled by each company under its own policy (Sections 5 and 7).

To run the service, we entrust personal data to the companies below or let them receive it directly through SDKs in the apps. Except for our servers, they process it outside the Republic of Korea. Transfers abroad other than for ads (AdMob and Meta) are entrustments of processing or storage needed to perform our contract with you, made after disclosure in this policy under Article 28-8(1)(iii) of Korea’s Personal Information Protection Act.

Data is sent over encrypted connections when you use the relevant feature (by SDKs, while you use the app). Our servers keep data for the periods in Section 3 and Anthropic as described in Section 6; the other companies keep it under their own retention policies. Each company’s name links to its privacy policy, which includes its contact details. AdMob and Meta also use the data they receive to run and improve their own ad services.

If you don’t want your data transferred abroad, you can stay signed out (your account, records, and emails aren’t sent), turn off the auto-calculation bots, or not allow location access (you won’t see the weather). You can delete or reset your advertising identifier in your device settings (Section 7). The analytics, crash, and ad SDKs can’t be turned off in the apps; if you don’t want them, stop using and delete the apps, in which case you can’t use the service.

When a premium user turns on a bot, the memo text of the habits chosen for that bot and the bot reference notes the user writes are sent from servers and computers that Haruda operates in the Republic of Korea to the API of Anthropic (United States) to estimate values such as calories, protein, or training volume.

• Only the memo text, reference notes, and calculation instructions are sent — never your name, email, or member number.
• They are sent when you save or edit a memo and when you ask for a recalculation. When you turn on a bot or add habits for it, the last 30 days of memos for those habits are sent; when you edit the reference notes, the last 7 days of memos are sent again for recalculation.
• Memos of habits not chosen for a bot, and diary entries, are not sent.
• Whatever you write in a memo is sent as is, including sensitive details such as your health, so please write only what the calculation needs in memos of habits a bot reads.
• Memo text is not written to Haruda’s server logs.
• The results (estimated values per item, memo fragments the bot couldn’t read, and the model name) are stored on Haruda’s servers and deleted when you delete your account.
• The estimates are only shown to you for reference. They aren’t used to judge your records or goals or to make any decision that affects your rights or obligations.
• Nothing is sent once you turn the bot off or your premium period ends.
• Haruda entrusts the processing of personal data to Anthropic under Anthropic’s Commercial Terms of Service and Data Processing Addendum. Anthropic doesn’t use what it receives for AI training and deletes it within 30 days of receipt. It may, however, keep it longer when needed to review usage policy violations or to comply with the law.

Instead of cookies, the apps collect data automatically through advertising identifiers and the SDKs in Section 5. The haruda.xyz website doesn’t use cookies or visitor analytics.

Personalized ads

Haruda Ritual requests only non-personalized ads. In Haruda Focus and Haruda Alarm, depending on your device settings, you may see personalized ads based on your advertising identifier and app usage. In that case, Google and Meta collect behavioral data such as ad impressions and clicks directly through their ad SDKs and keep it under their own policies. Paid users don’t see ads.

How to opt out

• Android: Settings > Google > Ads (on some devices, Settings > Privacy > Ads) to delete or reset your advertising ID
• iOS: the apps don’t ask for tracking permission, so they don’t receive your advertising identifier (IDFA). You can check this under Settings > Privacy & Security > Tracking.
• When you delete an app, its SDKs stop sending data.

When a retention period ends or you delete your account, we promptly delete your personal data. Electronic data is deleted from the database so it can’t be recovered. Data we keep after account deletion under law or for the reasons in Section 3 (which lists the data, the grounds, and the periods) is kept separately with your account information removed, used only for that purpose, and deleted when the period ends.

Data left in automatic database backups is deleted once the backup retention period (up to 35 days) has passed.

• Passwords are stored with one-way encryption (bcrypt).
• Traffic between the apps or website and Haruda’s servers is encrypted (HTTPS).
• Bot calculation requests are sent over encrypted connections, and memo text isn’t logged.
• Personal data is processed in the Republic of Korea and the countries in Sections 5 and 6. See Section 13 for each country’s system.

You (or your legal representative or authorized agent) can exercise the following rights at any time.

• Access, correct, or delete your personal data, or ask us to stop processing it
• Withdraw consent (for example, to marketing messages)
• Delete your account: in the app’s settings, or on the account deletion page on the web.

For other requests, email the privacy officer (Section 11). We’ll verify your identity, handle the request within the period required by law, and let you know the result. If an agent makes the request, we need proof of the authorization. You can’t ask us to delete data that another law requires us to keep (Section 3) while that period runs, and if we refuse a request or handle only part of it, we’ll tell you why.

Children under 14

Haruda doesn’t accept account sign-ups from children under 14. If we learn that a child under 14 has signed up, we delete the account and its records.

For questions, complaints, or requests about your personal data, contact us below. You can write in any language.

If you need advice on or want to report an infringement of your personal data, you can contact the Korean authorities below.

• Personal Information Dispute Mediation Committee: 1833-6972 (within Korea), www.kopico.go.kr
• Personal Information Infringement Report Center (KISA): 118 (within Korea), privacy.kisa.or.kr
• Supreme Prosecutors’ Office: 1301 (within Korea), www.spo.go.kr
• Korean National Police Agency: 182 (within Korea), ecrm.police.go.kr

If you live outside Korea, you can also contact the data protection authority in your country.

Under Japan’s Act on the Protection of Personal Information, we inform you of the following.

• Haruda is a business in the Republic of Korea and processes the personal data of users in Japan in Korea. Korea has the Personal Information Protection Act, which Haruda complies with.
• Provision to third parties in foreign countries: the companies in Section 5 process personal data in the Republic of Korea, the United States, Ireland, the United Kingdom, and Latvia, and Anthropic in Section 6 processes it in the United States. You can find information on each country’s personal information protection system in the survey of foreign systemspublished by Japan’s Personal Information Protection Commission.
• The companies in Section 5 protect personal data under their own terms of use and privacy policies. We’ll tell you about the measures they take on request.
• We entrust processing to Anthropic in Section 6. Under the contract, Anthropic doesn’t use the memo text and reference notes it receives for AI training and deletes them within 30 days of receipt.
• You can request notification of the purpose of use, disclosure (including disclosure of records of provision to third parties), correction, addition or deletion, suspension of use or erasure, and suspension of provision to third parties of retained personal data in the way described in Section 10. We accept requests by email sent from the email address you signed up with, and verify your identity by checking that the sending address matches your account’s email. We charge no fee.
• The business’s name, address, and representative are in Section 11, the purposes of use in Section 2, security measures in Section 9, and where to make complaints in Section 11.
• Information the apps send externally (recipients, the data, and the purpose) is described in Sections 5 to 7.

Under Article 8 of Taiwan’s Personal Data Protection Act, we inform you of the following.

1. Collector: Haruda (Section 11)
2. Purposes: those in Section 2. The specified purposes are 〇六九 contracts and similar legal relationships, 〇九〇 consumer and customer management and service, 一三五 information and communication services, 一三六 information, communication and database management, 一四八 online shopping and other e-commerce services, 一五七 surveys, statistics and research analysis, and 〇四〇 marketing (if you agreed to receive marketing messages).
3. Categories of personal data: Section 1
4. Period, area, recipients, and method of use: the period is in Section 3, the area is the Republic of Korea and the countries in Sections 5 and 6, the recipients are Haruda and the companies in Sections 5 and 6 (what members of a Together space can see is in Section 4), and the data is processed and used electronically and transferred internationally.
5. Your rights (Article 3 of the Act): you can request to inquire about or review your data, obtain copies, supplement or correct it, stop its collection, processing, or use, and delete it, as described in Section 10.
6. If you don’t provide your data: without account information you can’t use features that need an account, such as sign-in, sync, Together, and the auto-calculation bots, but the basic features work without an account. Without location access, you can’t see the weather.

This policy applies from the effective date above. When we change it, we post the changes here with an effective date, and we let you know in advance through the apps or website about changes that are significant or less favorable to you.