Seoul Haru Privacy Policy

1. Information processed and purposes of use

Seoul Haru does not require ordinary users to register an account or make a payment.

A. Current location information

If you grant location permission in your browser or device, the following information is used:

• Latitude
• Longitude
• Time the location information was stored

Current location information is used only for the following purposes:

• Calculating the distance between your current location and a place
• Sorting places by distance
• Displaying your current location on the map
• Finding places near your current location

Your precise location is not sent to Seoul Haru's server and is not used for visitor analytics.

Current location information may be stored in your browser's sessionStorage and is treated as valid for up to ten minutes.

Expired location information is deleted when location information is checked again, and is also deleted when the browser session ends.

You can use Seoul Haru's main features other than location-based features without granting location permission.

B. Service usage statistics

Seoul Haru processes the following information to operate the service and understand its usage:

• Randomly generated anonymous session identifier
• Device type
• Operating system category
• Browser category
• First observed time
• Last observed time
• Number of analytics requests

User-Agent information may be examined within the browser and reduced to device type, operating system category and browser category.

The full User-Agent string is not sent to Seoul Haru's server or stored as visitor analytics information.

Seoul Haru does not store the following information for visitor statistics:

• Precise GPS location
• Places viewed by the user
• Search terms
• Full User-Agent string
• Visitor IP address
• Visited page URL

Individual analytics information linked to a session identifier is retained for up to 30 days from the last observed time. Information exceeding that period is automatically deleted.

Aggregate statistics, such as cumulative visitor counts that cannot identify a person or specific session, may continue to be retained as operational statistics.

C. Connection and security information

Connection IP addresses may be processed temporarily on the server for security, preventing abnormal access and limiting request rates.

The Seoul Haru application does not persist connection IP addresses in visitor analytics data.

Cloudtype, Seoul Haru's hosting provider, has informed Seoul Haru that it may store end users' original IP addresses in its internal monitoring system for up to 30 days to respond to DoS attacks and service abuse.

Cloudtype has also stated that it does not collect Seoul Haru end users' User-Agent or request paths for that monitoring purpose, and may process operational information such as HTTP status codes and request and response sizes for up to 30 days to monitor response status.

Seoul Haru has been informed that Cloudtype's internal operations staff may access that monitoring information as necessary for maintenance and service operation.

Seoul Haru has been informed that information Cloudtype sends to Better Stack consists of access logs for Cloudtype's own service, and that end-user information relating to the deployed Seoul Haru application is not sent to external services, including Better Stack.

2. Processing and retention periods

Seoul Haru retains personal information only for the period necessary for its processing purpose and deletes it when that purpose is achieved or the retention period expires.

• Current location: valid for up to ten minutes; deleted when checked again after expiration
• Location information and anonymous identifiers in session storage: deleted when the browser session ends
• Anonymous visitor analytics: up to 30 days from the last observed time
• Cumulative aggregate statistics not linked to a person or specific session: may continue to be retained for service operations
• IP-based rate-limiting information: processed temporarily as necessary to enforce request limits
• Original IP addresses used for Cloudtype security monitoring: up to 30 days
• Browser theme preferences: until the user deletes stored browser data
• Administrator authentication cookie: up to 12 hours after issue or until sign-out

3. Deletion of personal information

Seoul Haru deletes personal information without delay when its retention period expires or its processing purpose is achieved.

Electronically stored information is removed from the service's stored records so that it is no longer used by the service.

Current location stored in the browser is valid for up to ten minutes and is deleted when checked again after expiration. It is also deleted when the browser session ends.

Session-scoped information, including anonymous session identifiers, is deleted when the browser session ends.

Analytics linked to a session identifier is automatically deleted from Seoul Haru's server when more than 30 days have passed since the last observed time.

Cumulative aggregate statistics not linked to a person or specific session may continue to be retained for service operations.

4. Browser storage and cookies

A. sessionStorage

The following information may be stored in the browser's sessionStorage:

• Current latitude
• Current longitude
• Time the location information was stored
• Anonymous session identifier

Anonymous identifiers are used for a browser session and deleted when it ends.

Current location is treated as valid for up to ten minutes. Expired location information is deleted when checked again and is also deleted when the browser session ends.

B. localStorage

Display preferences such as light or dark theme may be stored.

Theme preferences support convenience and are not sent to Seoul Haru's server.

C. Administrator authentication cookie

Administrator features use an admin_session cookie to maintain authentication.

This cookie is not used for ordinary-user analytics or advertising tracking and is deleted after a maximum of 12 hours or on sign-out.

Seoul Haru currently does not use advertising-tracking cookies for ordinary users.

5. External map services

Seoul Haru uses OpenFreeMap and OpenStreetMap to provide maps.

When displaying the default map, dark map or similar maps, your browser connects directly to OpenFreeMap's map servers.

If OpenFreeMap is unavailable or a fallback map is used, the browser may connect directly to OpenStreetMap's map-tile servers.

During these network connections, the following technical information may be transmitted or processed:

• IP address
• Ordinary request information sent automatically by the browser
• Request date and time
• Information about the referring website
• Requested map style or map tile
• Tile coordinates from which the approximate area displayed on the map may be inferred

Seoul Haru does not directly send precise GPS coordinates, anonymous session identifiers or account information as separate data fields in external map requests.

However, moving the map to your current location causes tiles for that area to be requested, which may indirectly reveal the approximate area displayed.

External requests may include referring-website information according to browser policy. Under the current settings, external services generally receive origin-domain information rather than the full page path.

OpenFreeMap states that ordinary server logs do not store IP addresses. It may temporarily enable IP logging when necessary to investigate misuse or security incidents, and states that these records are deleted at the end of the investigation or within a maximum of 30 days.

OpenStreetMap states that providing and operating its maps may involve processing IP addresses, ordinary request information, request times and information about the services accessed.

The map displays attribution to OpenMapTiles and OpenStreetMap contributors and a link to OpenStreetMap copyright information.

6. Links to external maps and search

Seoul Haru's links to Naver Map and Kakao Map do not use those services' SDKs or APIs within Seoul Haru.

Selecting a map or search button opens that service's external search page.

After moving to an external service, information processing is governed by that provider's privacy policy and terms.

7. Seoul public data

Seoul Haru may use the following public data from the Seoul Metropolitan Government:

• Seoul real-time city data
• Real-time population and crowding information
• Rally, traffic restriction and incident information
• Cultural event information

Seoul Metropolitan Government and Seoul Open Data Plaza APIs are called by Seoul Haru's server.

Precise GPS locations, anonymous session identifiers and account information are not sent to Seoul public-data APIs.

8. Disclosure to third parties

Seoul Haru does not sell your personal information or arbitrarily provide personal information it holds to third parties against your wishes.

When external map features are used, however, the browser connects directly to OpenFreeMap or OpenStreetMap, whose providers may process technical information necessary to deliver the map.

Selecting an external Naver Map or Kakao Map link takes you directly to that service, after which its provider's information-processing policy applies.

9. Outsourced processing and hosting

Seoul Haru uses Cloudtype's server hosting to provide and operate the service.

Cloudtype may process original IP addresses and operational information within the scope described in this policy for security and stable operation.

According to Cloudtype's explanation, end users' User-Agent and request paths are not collected for that monitoring purpose, and end-user information from the deployed Seoul Haru application is not sent to Better Stack or other external services.

Changes to the hosting provider or information-processing practices will be reflected in this Privacy Policy.

10. Possible processing abroad by external map services

When displaying a map, your browser may connect directly to external map services located outside Korea or using global network infrastructure.

Some technical information needed to provide the map may therefore be processed outside Korea. The following information explains those data flows.

Where this constitutes an overseas transfer of personal information under the Personal Information Protection Act, the requirements and safeguards of applicable law, including Article 28-8, apply.

A. OpenFreeMap

• Provider: Hyperknot Software Kft.
• Country: Hungary
• When connected: when Seoul Haru displays the default map, dark map or similar maps
• Connection method: the browser connects directly to map servers over HTTPS
• Information potentially processed: IP address, ordinary browser request information, referring website, request time, requested map styles and map tiles
• Purposes: map display, operation and security
• Retention: the provider states that ordinary server logs do not store IP addresses; if IP logging is necessary to investigate misuse or security incidents, records are deleted at the end of the investigation or within a maximum of 30 days
• Other information: statistics without IP addresses or anonymized logs may be retained for purposes such as service improvement

OpenFreeMap may use global content delivery networks such as Cloudflare to deliver maps.

B. OpenStreetMap

• Provider: OpenStreetMap Foundation
• Main countries of service operation: United Kingdom, Ireland and the Netherlands
• When connected: when OpenFreeMap is unavailable or an OpenStreetMap fallback is used
• Connection method: the browser connects directly to map-tile servers over HTTPS
• Information potentially processed: IP address, ordinary browser request information, referring website, request time and requested map tiles
• Purposes: map display, operation, security and service improvement
• Retention: governed by the OpenStreetMap Foundation's privacy policy; the official policy reviewed by Seoul Haru did not explicitly specify a single retention period for map-tile request logs
• Other information: tiles may be delivered through global caches and content delivery networks, so processing locations can vary with network conditions and server allocation

Seoul Haru does not directly send precise GPS coordinates, anonymous session identifiers or account information to OpenFreeMap or OpenStreetMap as separate data fields.

However, requests for map tiles centered on your location may indirectly reveal the approximate area currently displayed.

You may use browser network or content-blocking features if you do not wish to connect to external map services. Blocking map servers may prevent some or all of Seoul Haru's map features from displaying correctly.

For details of each external map service's information processing, consult its privacy policy.

• OpenFreeMap Privacy Policy: https://openfreemap.org/privacy/
• OpenStreetMap Foundation Privacy Policy: https://osmfoundation.org/wiki/Privacy_Policy

11. Advertising and external analytics

Seoul Haru currently uses no external advertising SDK or third-party visitor analytics SDK.

The following information is currently neither collected nor used for advertising:

• Advertising identifiers
• Advertising-tracking cookies
• Precise GPS location
• Search terms
• Viewed places
• Cross-service user-tracking information

If future advertising or external analytics changes information processing, this policy will be updated before those features are applied.

12. Your rights and how to exercise them

You may deny or withdraw location permission in your browser or device settings.

You may delete location information, anonymous session identifiers and display preferences stored in your browser.

Within the scope of applicable law, you may request access to, correction or deletion of your personal information, or suspension of its processing.

Requests may be submitted using the privacy contact below.

Seoul Haru handles requests to exercise your rights in accordance with applicable law.

13. Security safeguards

Taking account of the service's scale and the nature of the information processed, Seoul Haru applies the following safeguards to protect personal and usage information:

• Encrypted communications over HTTPS
• Restricted access to administrator features
• Protection of administrator credentials
• Rate limits on abnormal requests
• Minimization of personal-information transfers between browser and server
• Restrictions on sending precise location to the server
• Limited retention of visitor analytics
• Automatic deletion of analytics older than 30 days
• Self-hosting of major frontend libraries
• Management of API keys and administrator credentials through environment variables
• Limits on disclosure of internal information in production error responses

14. Privacy contact and complaints

Contact the address below about Seoul Haru's information processing, your rights or privacy complaints.

Privacy and complaints contact: Seoul Haru Privacy Inquiries

Email: seoulharu124@gmail.com

15. Changes to this Privacy Policy

Changes to this Privacy Policy will be announced through notices within Seoul Haru or similar means before taking effect.

Changes significantly affecting your rights will be notified in the manner required by applicable law.

Effective date: to be confirmed before formal operation (provisional)