Privacy Policy

Lindy Operation Inc. (the "Company") complies with the Personal Information Protection Act of the Republic of Korea and related laws. This Privacy Policy explains how the Company handles personal data of users of ChartDraw (the "Service").

• Service: ChartDraw
• Operator: Lindy Operation Inc. (주식회사 린디오퍼레이션)
• Business Registration No.: 193-87-03843
• Address: 808-A128, Yueun Tower 3, 1092 Gyeongui-ro, Paju-si, Gyeonggi-do, Republic of Korea
• Effective: July 21, 2026

This English text is provided for convenience. In the event of any conflict between this translation and the Korean version, the Korean version prevails.

Article 1 (General)

① This Policy applies to all users of the Service.

② The five questions provided each day, and the pattern book's list and descriptions, are available without an account. If you use the Service without creating an account, the Company collects no personal data whatsoever, and your learning records are stored solely on your device.

③ All questions, the case questions within the pattern book, keeping learning records in your account, and the Daily Ranking require signing in. Personal data is collected only when you create an account. The Service contains no payment functionality.

④ When you create an account or sign in, the learning records previously stored on your device are transferred to and merged into that account's records on our servers.

Article 2 (Personal Data Collected)

① On account creation (social sign-in)

• If you sign in with Apple and choose Hide My Email, the Company receives the relay address issued by Apple rather than your actual email address.
• If you sign in with Apple, the Company collects and retains an authentication token issued by Apple until account deletion, solely to revoke the connection to your Apple account when you delete your account. The token is destroyed upon deletion and is not used for any other purpose.
• The Company does not collect passwords for social services.

② Data generated through use of the Service

• Learning records: quiz results, number of attempts, scores, accuracy rate, participation dates
• Daily Ranking records: participation date, number of attempts per question, calculated score, submission time
• Display Name: a name generated automatically by the Company to identify a Member on the Daily Ranking. Users cannot enter or change it, and it does not reveal a real name or email address. However, because it is linked to a Member's account, it constitutes personal data and is protected under this Policy.

③ Automatically generated and collected information

• During sign-in and authentication, your IP address, access time, and authentication event records are stored by our authentication infrastructure. These are used solely to detect unauthorised access and respond to security incidents, and are destroyed when you withdraw.

④ The Company does not collect advertising identifiers, location data, contacts, photos, or call logs, and does not include third-party advertising or analytics SDKs in the Service.

Article 3 (Purposes of Processing)

The Company does not use personal data for purposes other than those listed above. Where a purpose changes, separate consent will be obtained.

Article 3-2 (Information Visible to Other Users)

① When a Member submits a Daily Ranking entry, their Display Name, that day's score, and rank become visible to other users. An entry is created only when the Member actively submits it within the Service; signing in alone does not create one.

② Only the Display Name, score, and rank are disclosed. Email addresses, social account identifiers, and internal account identifiers are never provided to other users under any circumstances.

③ The Display Name is generated automatically from a fixed word list defined by the Company and contains no personal data such as a real name or email address. Because users cannot enter arbitrary text, the Service contains no user-written posts or phrases.

④ Rankings may be viewed only for dates within the past 30 days.

⑤ Deleting your account also deletes your ranking records and Display Name, after which they are no longer shown to other users.

Article 4 (Retention Period)

① The Company retains personal data until the Member withdraws and deletes it without undue delay upon withdrawal.

② Daily Ranking records are used to display rankings for 30 days from the date of entry. After 30 days they are no longer shown to other users and are used only to detect improper participation and to handle disputes. A Member may request deletion of ranking records at any time under Article 8, and they are destroyed on withdrawal.

③ Because the Service contains no payment functionality, there are no transaction records retained separately under the Act on Consumer Protection in Electronic Commerce. If payment functionality is introduced in the future, the items and retention periods required by that Act will be stated in this Policy before such functionality takes effect.

Article 5 (Provision to Third Parties)

① Except as described in Paragraph 2, and except where required by lawful process from investigative or other competent authorities, the Company does not provide users' personal data to third parties.

② Where a Member actively submits a Daily Ranking entry, their Display Name, score, and rank become visible to other users of the Service in accordance with Article 3-2. This disclosure occurs at the moment the Member submits the entry within the Service, together with notice; signing in alone does not disclose anything. Declining to enter the ranking does not restrict use of the learning features.

Article 6 (Outsourcing of Processing)

The Company outsources the processing of personal data as follows.

• The facilities where personal data is stored and processed are located in the Seoul region, Republic of Korea. However, the processor is a US company, and personnel located outside Korea may access those facilities to the extent necessary to perform the outsourced work, such as incident response. Even then, processing is limited to that outsourced work, and the Company restricts this by contract.
• The Company reflects safeguards for the secure handling of personal data in the outsourcing agreement and supervises the processor's compliance.

Article 7 (Destruction of Personal Data)

① The Company destroys personal data without undue delay once the retention period has elapsed or the processing purpose has been achieved.

② Method of destruction

• Electronic files: permanently deleted by technical means that prevent recovery
• Printed materials: shredded or incinerated

Article 8 (Your Rights and How to Exercise Them)

① You may at any time request access to, correction of, deletion of, or suspension of processing of your personal data.

② You can delete your account and personal data directly using the account deletion function on the [Settings] screen within the Service. Deletion also removes the learning records and Daily Ranking records stored on the server, and they cannot be recovered.

③ If you are unable to use the app, you may send a request to danny@lindyoperation.com. The Company will verify your identity, act on the request within 10 days, and notify you of the outcome.

④ If you used the Service without an account, the learning records stored on your device are removed by running [Settings > Reset records] within the Service or by deleting the app.

⑤ A Daily Ranking entry is submitted once per day and its score cannot be modified. However, you may at any time request that the entry be withdrawn from display and deleted from [Settings] within the Service. Deleting your account also removes it.

Article 9 (Children Under 14)

The Company does not collect personal data from children under the age of 14, and users under 14 cannot create an account. Children under 14 may still use the five questions provided each day without an account, in which case no personal data is collected and they do not take part in the Daily Ranking.

Article 10 (Security Measures)

The Company takes the following measures:

• Encryption in transit (HTTPS/TLS)
• Minimization of database access privileges and row-level access control
• Server-side fixing of the fields returned when rankings are queried, so that other users' account identifiers are never included in the response
• Minimization of personnel handling personal data and management of their access rights
• Use of social sign-in so that no passwords are stored by the Company

Article 11 (Privacy Officer)

The officer responsible for personal data processing and for handling user complaints and remedies is:

• Privacy Officer: Daehun Lee (Chief Executive Officer)
• Contact: danny@lindyoperation.com

Article 12 (Remedies for Infringement)

If you need redress for infringement of your personal data rights, you may contact the following bodies.

Article 12-2 (Use of Device Storage and How to Refuse)

① The Service uses no cookies or tracking tools for advertising or analytics.

② However, the following two items are kept in your device's storage.

③ This information is not transmitted to the Company's servers (except for the synchronization of learning records when you sign in), and you may delete it at any time by the means above.

Article 13 (Changes to this Policy)

① Where this Policy is amended, the Company will announce the reason for the change and its effective date within the Service or on the Company's website at least 7 days in advance. For changes that materially affect users' rights, the announcement will be made at least 30 days in advance and Members will be notified individually.

② Superseded versions remain available on the Company's website, organized by effective date.

Addendum

This Policy takes effect on July 21, 2026.