Introduction

AllSelfy (the 'Service') values your privacy and complies with applicable laws. This Privacy Policy explains what information is collected when you use our Service and how it is used.

Information We Collect

AllSelfy can be used without registration. Only minimal information is collected automatically. Additional information is collected when you sign in with Google or Kakao to use the Psych Profile feature.

• Device information (browser type, operating system, screen resolution)
• Usage data (pages visited, time spent, test participation records)
• Identifiers through cookies and similar technologies
• IP address (used by analytics and ad tools to estimate location and prevent fraud)
• [Social Sign-In] Email address, nickname, and profile picture (collected via Google OAuth or Kakao OAuth)
• [Social Sign-In] Test results and response records (stored on server)
• [With push notifications enabled] Web push subscription data (push endpoint, encryption keys, MBTI type and relationship kind) — deleted immediately on unsubscribe

Personal Information by Legal Basis

We process the personal information below without consent, only as far as needed to provide the features you ask for. The legal basis is Article 15(1)(4) of the Personal Information Protection Act (entering into and performing a contract).

• Membership: your email, nickname, profile picture and account ID. Kept until you delete your account.
• Sign-in records: when you sign in, your IP address and browser information are stored with your sign-in session. Signing out deletes that session record. Deleting your account deletes all of them.
• Psych Profile and cross-device sync: your test results and answer records. Kept until you delete your account.
• Group Rooms: room names, your nickname in a room, invite codes, roles, activity times, shared results and your account ID. Retention periods are in the Group Rooms section.
• MBTI Talk (Korean only): your nickname, MBTI type and the questions and replies you write, plus likes, bookmarks, blocks and notifications. They are deleted when you delete your account. Reports and moderation records may be kept separately.
• Web push notifications: your subscription data. Deleted as soon as you unsubscribe.
• Group Rooms human check (Turnstile): IP address and browser information. See the Overseas Transfer of Personal Information section.
• Behavioral data that does not identify you is described in the Behavioral Information Collected by Third Parties section.

Social Sign-In & Data Storage

You may sign in with your Google or Kakao account to use the Psych Profile feature. The following describes the information collected and how it is processed.

• Collected: Email, nickname (name), and profile picture from your Google or Kakao account
• Stored: Test results (type, timestamp), individual question responses
• Location: a Supabase cloud database in the Seoul region. The work we outsource is listed in the Outsourced Processing section. Remote access by overseas support staff is described in the Overseas Transfer of Personal Information section.
• Usage: Psych profile analysis, cross-device result synchronization
• Account deletion: you can delete your account at any time on the My Profile tab in My Results. Your profile and test records are permanently deleted right away. Group Rooms data, abuse-prevention records and deletion-retry records are deleted within the periods stated in the Group Rooms section.
• Non-signed-in users can use all test features without any restrictions
• Legal basis: we process this information without consent, only as needed to provide the features you request (Article 15(1)(4) of the Personal Information Protection Act: entering into and performing a contract). Membership is only for users aged 14 or older.

Group Rooms

Group Rooms lets signed-in users collect test results with their friends in one place. We process the information below when you use this feature. What happens when you delete your account is described in the account deletion item.

• Stored: the room name, your nickname in the room, the invite code and your role (owner or member). We also store when the room was created, when you joined and the room's last activity time.
• Shared results: only the test, the result and the time you shared it to a room you picked. Your individual answers are not stored.
• Account link: your sign-in account ID (Supabase), to confirm it is you. Your email, name and profile picture are not stored.
• Outsourced processing: the Group Rooms server and its data storage run in the AWS Seoul region. The work we outsource is listed in the Outsourced Processing section.
• Overseas transfer: for the overseas transfer used by the human check (Turnstile), see the Overseas Transfer of Personal Information section.
• Retention: a room closes 180 days after its last activity, and everything in it is then deleted without delay. Opening the room counts as activity. Daily usage counts that prevent abuse (including your account ID) are kept for up to 3 days. The marker that blocks new records right after account deletion (including your account ID) is kept for up to 4 days. The usage counts for the day you delete your account are kept with this marker, also for up to 4 days. Both are deleted automatically when their period ends.
• Operational records: request logs are kept for 7 days and never include your account ID or IP address. An unfinished account-deletion request (account ID and request time) is kept for up to 30 days and is deleted as soon as the deletion finishes. A record of a failed room cleanup (room ID) is kept for 30 days.
• Deletion: you can delete a shared result, leave a room or delete all your Group Rooms data at any time. There are no backups, so deleted data cannot be restored.
• Inside a room: members can see each other's nickname, role, join time and shared results. Anyone who opens the invite link sees the room name and member count before joining.
• When the owner deletes a room, every member's data in it is deleted. When the owner removes a member, that member's shared results are deleted. When the last member leaves, the room is deleted. When the owner leaves or deletes their account, the member who joined first becomes the owner, and the room name stays with the room.
• Account deletion: deleting your account also deletes your Group Rooms data. When a member who signs in with Kakao or Google deletes their account, we notify our Group Rooms server even if they never used Group Rooms, so that any remaining data is deleted and new records are blocked. If our server cannot finish right away, we delete it within 5 days of your account deletion.
• On-device storage: invite codes, room screens and what you were doing before signing in are kept briefly in this tab only (sessionStorage). If some Group Rooms data could not be deleted when you deleted your account, this browser (localStorage) keeps your account ID and sign-in token. They are used only to ask our Group Rooms server to retry the deletion on your next visit. They are removed as soon as the deletion finishes. Seven days after the token expires they are no longer used, and they are removed on your next visit. You can clear them at any time by deleting this site's data in your browser.
• Legal basis: we process Group Rooms information without consent, only as needed to provide the feature you request (Article 15(1)(4) of the Personal Information Protection Act: entering into and performing a contract). Group Rooms is only for users aged 14 or older.

Play with friends (link sharing)

Play with friends lets you swap test answers with a friend through a link. You can use it without signing in. We do not store its contents on our servers.

• What the link holds: your answers, your predictions of a friend's answers and your result type. It also holds your nickname if you enter one (optional). The link contents are scrambled so they are hard to read, but they are not encrypted.
• Who can see it: anyone who receives the link can see what it holds. If you post it in a group chat, everyone in that chat can see it. Do not put your real name or contact details in the nickname.
• No server storage: we do not store link contents on our servers. When a link is opened, our site delivery service (AWS CloudFront) briefly processes the address. We do not keep access logs that contain this address.
• Analytics: when the page opens, the link contents are removed from the address bar before analytics and ad tools run. Usage statistics only receive the test, mode, score band, number of questions and sharing method. Answers, predictions and nicknames are not sent.
• On your device: records of links you sent or received stay in this browser (localStorage), up to 50. These records include answers, predictions and nicknames. Unfinished progress stays for 30 minutes. Your last nickname is also kept. The link you just opened stays only in this tab (sessionStorage) for a short time. You can delete all of this at any time by clearing site data in your browser.
• Sending: you send the link yourself, using the method you choose (KakaoTalk, copying the link or another app).

From October 20, 2026: The AllSelfy App

The AllSelfy app is made up of app screens and the web pages of allselfy.com. The information we process in the app is described below.

• Sign-in: in the app you can sign in with Google or Kakao. In the iOS app you can also sign in with Apple. The website does not offer Apple sign-in.
• Apple sign-in information: we receive your email address and an account identifier from Apple. If you choose to hide your email, we receive a private relay address that Apple creates instead of your real address. We do not receive your name. We use this information only for signing in and managing your account.
• Google and Kakao sign-in information: what we receive when you sign in with Google or Kakao is described in the Social Sign-In & Data Storage section.
• Public information in MBTI Talk: your nickname, MBTI type and posts are visible to other members. People who are not signed in can also read public posts.
• Deleting a question: when you delete your question, other members' answers to it are deleted too.
• Reports: after you delete your account, report details remain as moderation records. We check them for deletion 30 days after the last action on a report ends.
• Analytics: Google Analytics runs on the web pages inside the app. What it collects is the same as in the Google Analytics 4 entry of the Overseas Transfer of Personal Information section.
• Ads and tracking: inside the app, the ad-related consent signals start as denied. The app has no ads and does not track you.
• Data only on your device: your library, drafts, settings and saved result images stay only on your device. We do not send them to our servers.
• Deleting the app: deleting the app removes your library, drafts and settings. Images you saved to your photo library stay there.
• Sign-in token: it is kept in your device's secure storage. It is deleted when you sign out or delete your account.
• Photo library permission: we use it only to save a result image that you chose to save.
• Notifications: the app does not send push notifications.
• Outsourcing and overseas transfer: the companies and transfers that the app uses are described in the Outsourced Processing section and the Overseas Transfer of Personal Information section.

Outsourced Processing

To run the service, we outsource the processing of personal information to the companies below.

• Supabase Pte. Ltd. (Singapore): sign-in and account management, and running the member database (test results and more). Data is stored in the Seoul region. See the Overseas Transfer of Personal Information section for the overseas transfer.
• Amazon Web Services (AWS): running the Group Rooms server (Lambda) and storing its data (DynamoDB), plus operational logs (CloudWatch Logs), operational alerts (SNS) and deletion-failure records (S3). Data is stored in the Seoul region. We also use it for site delivery (CloudFront), which briefly processes IP addresses and requested addresses. We do not keep site access logs.
• Google LLC (USA): usage statistics (Google Analytics 4). See the Overseas Transfer of Personal Information section for the overseas transfer.
• Cloudflare, Inc. (USA): the human check (Turnstile) in Group Rooms. See the Overseas Transfer of Personal Information section.
• Sub-processing: our processors may sub-contract part of their work. Their sub-processors and tasks are listed at the links below.
• Supabase sub-processors: https://supabase.com/legal/customer-resources/subprocessor-list
• AWS sub-processors: https://aws.amazon.com/compliance/sub-processors/
• Google sub-processors: https://business.safety.google/subprocessors/
• Cloudflare sub-processors: https://www.cloudflare.com/gdpr/subprocessors/

Overseas Transfer of Personal Information

We transfer personal information abroad as described below. The legal basis is given for each transfer.

Cookies and How to Refuse Them

Cookies are small pieces of information stored in your browser. They are sent to the server automatically when you visit a site.

• Purpose: usage statistics and advertising. Advertising cookies are described in the Behavioral Information Collected by Third Parties section.
• How to refuse: you can block cookies in your browser settings.
• Chrome: Settings > Privacy and security > Third-party cookies
• Edge: Settings > Cookies and site permissions
• Safari (iOS): Settings > Safari > Advanced > Block All Cookies
• Samsung Internet: Menu > Privacy > Smart anti-tracking > Always
• If you block cookies, some features may not work properly.

Behavioral Information Collected by Third Parties

The tools below collect behavioral information directly, using cookies and similar technologies. They do so in a way that does not identify you personally.

• Google Analytics 4: Google LLC (USA) collects it with JavaScript and cookies.
• It uses pages visited, events, device information and IP address for usage statistics.
• Test results are sent only as a result type. Your answers to each question are not sent.
• Google AdSense: Google LLC (USA) and its ad partners collect it with cookies.
• They show ads based on your visits to this site and other sites, and measure ad performance.
• Google handles AdSense processing under its own responsibility. Details: https://policies.google.com/technologies/ads
• You can turn off personalized ads in Google's Ad Settings: https://adssettings.google.com
• You can opt out of third-party ad cookies at https://www.aboutads.info
• We do not collect sensitive behavioral information such as ideology, beliefs or medical history.
• Contact: contact@allselfy.com
• Public MBTI Talk post views and dedicated measurement keys are sent to Google Analytics 4. Original post IDs, titles, text and author details are not sent.

Your Rights and How to Exercise Them

You may at any time request access to, correction or deletion of, or suspension of processing of your personal information. You may also withdraw consent.

• Refuse cookie collection (through browser settings)
• Disable personalized advertising
• Request deletion of collected data
• Inquire about or object to data processing
• How to exercise: email contact@allselfy.com. After confirming that you are the person concerned or their representative, we act within 10 days and tell you the result. A legal guardian or someone you authorize may also make the request.
• Self-service deletion: signed-in members can delete their account on the My Profile tab in My Results. Group Rooms data can be viewed and deleted in the Group Rooms screens (delete a result, leave a room, or delete all Group Rooms data). To correct your nickname in a room, contact us.
• Legal guardians: a legal guardian of a child under 14 may exercise these rights over the child's personal information.

Destruction of Personal Information

When the retention period ends or the purpose is fulfilled, we destroy personal information without delay. Electronic files are deleted so that they cannot be restored. When you delete your account, your profile and test records are deleted right away. Group Rooms data is deleted automatically when its period ends. If a deletion fails, we keep a retry record (up to 30 days) and delete it again. We do not keep separate backups of Group Rooms data.

Security Measures

We take the following measures to protect personal information.

• Data in transit is encrypted with HTTPS.
• Data stored on our servers is also encrypted.
• Access to data is limited to the minimum necessary.
• Sign-in tokens are accepted only after their signatures are verified.
• Group Rooms operational logs do not record account IDs or IP addresses.

Children's Privacy

Social sign-in (membership) and Group Rooms are only for users aged 14 or older. We do not accept sign-ups from children under 14, so we have no guardian-consent process. You confirm your age yourself with a checkbox when you sign in and when you create or join a room. If we learn that we received information from a child under 14, we delete it without delay: the account and its Group Rooms data, including nicknames, shared results and room names the child created. Parents or guardians who learn that their child is using the service can tell us at contact@allselfy.com.

Privacy Officer and Privacy Contact

The team below oversees the protection of personal information and handles privacy questions, complaints and requests for remedy. We respond and act without delay.

Changes to This Policy

This Privacy Policy may be updated due to legal changes or service modifications. We will notify you of changes through in-service announcements.

Contact Us

For privacy-related inquiries, please contact us at:

contact@allselfy.com