Privacy Policy
Last updated: October 2, 2026
The short version
- We use your data to match you with a small group and run your quests. Nothing else.
- We never sell your data or use it for advertising.
- Only people in your group see your profile details, your group chat and group photos.
- Volunteer quest group selfies are deleted automatically after 90 days.
- At check-in we keep only your distance from the venue, never your coordinates.
- You can see, fix or delete your data and withdraw consent at any time.
1. What we collect
| Kind | Items | Required? |
|---|---|---|
| Account | Email address and Google account ID (sign-in with Google) | Required |
| Profile | Name or nickname, date of birth, gender, spoken languages, home area (neighborhood level); photo, bio and job | Required, except photo, bio and job. A venue account (venue owners who only list a venue) gives only a name until it makes a friend profile |
| Personality and interests | Big Five test results, MBTI, activity interests | Required for matching (not asked of venue accounts) |
| Lifestyle | Exercise, education, drinking, smoking, children | Optional |
| Matching and quests | Match requests (cities, group size, categories), groups, availability and votes, check-ins (time, distance from the venue, whether you were within 200 m), quest results, strikes, blocks, review tags you give and receive | Created as you use the service |
| Messages | Group chat messages | Created as you use the service |
| Events | Events you host (title, description, date and time, place, cost, size, and a poster or photo if you add one), events you join, your comments on events, and reports you send | Created as you use the service |
| Points and ranking | Points history, level, badges, monthly rank, whether you appear on the leaderboard, and the venue perks you use | Created as you use the service |
| Volunteer quests | The 1365 activity your group chose (public data), whether you confirmed signing up on 1365, group selfie photos and who is tagged in them, your 1365 certificate, your location when you upload a selfie | Photos: required to finish a volunteer quest (with your consent). Certificate and location: optional |
| Venue owners | Business name, business registration number, address, contact details, menu, photos, opening hours | Required to list a venue |
| Plan | Whether you have Doreham+ and until when, the history of your membership (when it started, was extended or ended), and how many match requests you made this month | Created as you use the service |
| Push notifications | If you turn them on for a browser or phone: the push address your browser gives us for that device, its encryption keys, your language and your browser type | Optional |
| Collected automatically | Sign-in cookie, your language choice (stored in your browser), server logs (IP address, browser, pages requested) | Required to run the service |
We do not collect resident registration numbers, card numbers or your continuous location.
2. Why we use it
- Matching you with compatible people and forming groups
- Running quests: scheduling, check-in, volunteer attendance, reviews
- Safety and fairness: strikes for no-shows, blocks, handling reports
- Showing community events in your city, and telling you about changes to events you host or join
- Points, levels, badges and the national leaderboard, and partner venue perks
- Notifications and emails about your matches, quests and events
- Fixing problems and improving the service
- Meeting legal obligations
3. How long we keep it
| Data | Kept until |
|---|---|
| Account, profile, match and quest records | You delete your account. Then deleted within 30 days, including backups |
| Group chat messages | You delete your account. Your messages are then anonymized so the group chat still makes sense to others |
| Check-ins | Kept with the quest record. We store only your distance from the venue, not your coordinates |
| Events you host, events you join, comments and reports | You delete your account (then deleted with it). You can delete a comment or cancel an event yourself at any time |
| Points history and perk use | You delete your account (then deleted with it) |
| Volunteer group selfies and 1365 certificates (and the location attached to a selfie) | 90 days after upload, then deleted automatically. Deleted sooner if you withdraw your consent |
| Push notification addresses | You turn notifications off or sign out on that device, the push service tells us the address expired, or you delete your account |
| Server logs | A short period, for security and fixing problems |
4. Who can see your information
We do not sell your data. It is shared only as follows:
- Your group: people in your matched group see your profile, your messages in the group chat and the group's photos. People who leave a group before it ends can no longer see its photos.
- Partner venues: owners see how many people checked in and anonymous review tags. They do not see your profile.
- Other members, for points: your name, photo, city, level and points appear on the national leaderboard, and your level, points and badges on your profile. You can hide yourself from the leaderboard any time (Ranking → My points); your points and perks stay.
- Partner venues, for perks: when you use a perk, staff see your name, photo and level on your screen. The venue sees how many times each perk was used, not who used it.
- Other members, for events: signed-in members can see events you host (with your name and photo as the host) and your comments on events. Who is going to an event is shown only to its host and to other people going. The host never sees who reported an event.
- The law: when a court order or law requires it.
- Service providers: listed in section 5. They process data only to run Doreham for us.
5. Service providers and transfers outside Korea
These companies process data for us. Data is sent over encrypted connections while you use the service.
| Company (country) | What they do | Data |
|---|---|---|
| Supabase Inc. (USA; data stored in the AWS Seoul region, Korea) | Database, file storage, sign-in | All account and app data, photos |
| Vercel Inc. (USA; our servers run in Seoul) | Hosting and server functions; routes translation requests (Vercel AI Gateway) | Requests, IP addresses, server logs |
| Resend Inc. (USA) | Sending email | Email address, name, email content |
| Google LLC (USA) | Sign-in with Google | Google account ID, email, name |
| Google LLC (USA); as backups when it is unavailable: Anthropic PBC, OpenAI (USA) | Automatic translation between Korean and English of public 1365 listings and of the events members post | Only the text being translated: listing text, and the title, description and place of an event. Never your name, account or contact details |
| Kakao Corp. (Korea) | Address search when registering a venue; map links | The address you search |
| The push service of your browser, only if you turn notifications on: Google (Chrome, Android), Apple (Safari, iPhone, Mac), Mozilla (Firefox), Microsoft (Edge) (USA) | Delivering notifications to your device | The notification text (for example an event title, a group member's name, or the start of a new group chat message) and the device's push address. The text is encrypted so only your device can read it |
You can refuse these transfers by not using Doreham or by deleting your account, but we cannot run the service without them.
6. Location
- Check-in: when you tap check-in, your phone's location is compared with the venue's. We save only the distance and whether you were within 200 m.
- Volunteer selfie: if you allow it, your location when you upload the selfie is saved with the photo and deleted with it.
- We never track your location in the background.
7. Photos in volunteer quests
A volunteer quest finishes with one group selfie taken at the activity. Before your first volunteer quest we ask for your consent. The photo is stored privately, shown only to your group through links that expire after an hour, and deleted automatically after 90 days. You can withdraw your consent on your profile page at any time. We then delete every group selfie and certificate you uploaded or appear in.
8. Your rights
- See, correct or delete your information
- Ask us to stop processing it
- Withdraw a consent (profile page → Privacy)
- Delete your account (profile page → Delete account); it happens right away
- Get a copy of your data
Edit your profile in the app, or email privacy@doreham.co.kr. We reply within 10 days. You can also contact the Personal Information Infringement Report Center (privacy.kisa.or.kr, call 118) or the Personal Information Dispute Mediation Committee (kopico.go.kr, 1833-6972).
9. How we protect it
- Encrypted connections (HTTPS) everywhere
- Database rules so each person can only read what they are allowed to (Row Level Security)
- Secret keys kept on the server only; photos in private storage
- Sign-in through Google, so we never store passwords
- Access to the database limited to the operator; regular security checks
10. Cookies and browser storage
We use one cookie to keep you signed in and store your language choice in your browser. If you turn on notifications, your browser also keeps a small service worker from doreham.co.kr that only shows our notifications. We do not use advertising or tracking cookies.
11. Minors
Doreham is not for anyone under 16. If we learn we collected information from someone under 16, we delete it.
12. How we delete data
Data past its retention period is deleted by automatic daily jobs. Deleted files and database records cannot be recovered.
13. Privacy officer
Sophia Mosalla, founder
Email: privacy@doreham.co.kr
14. Changes
We will announce changes in the app or by email at least 7 days before they take effect (30 days for changes that reduce your rights).