Privacy Policy
Effective: 2026-08-09
팡(the “Company”) establishes this policy under the Korean Personal Information Protection Act to protect user information and handle related concerns promptly.
1. What we collect and why
| Category | Data | Purpose | Retention |
|---|---|---|---|
| Payment | Payment method details (handled by the payment processor), approval number, amount, timestamp | Selling credits, refunds, settlement | 5 years (Korean e-commerce law) |
| Usage | Wallet identifier stored in your browser, generation requests (topic, script, link, uploaded images), generated output | Producing and delivering videos | Auto-deleted 7 days after creation (processing may take up to 24h) |
| Account | When you sign in with Google: account identifier (uid) and email address. The email is held by the authentication provider (Google Firebase Authentication); only the account identifier is stored on our servers. | Carrying credits across devices, granting the one-time signup bonus, preventing duplicate claims | Until you delete your account or request deletion |
| Notifications (optional) | App push token (FCM registration token) | Notifying you when a video finishes or fails | Deleted with the generation request after 7 days (invalidated immediately if you revoke the notification permission) |
| Automatic | IP address, access time, server-side error logs | Abuse prevention, incident response | Rate-limit counters are deleted automatically after 1 hour. Server access logs are retained for 30 days by our cloud provider (Google Cloud). |
We do not collect names, dates of birth, addresses or similar identifiers. The wallet identifier that distinguishes users is stored in your browser (localStorage) or in app storage and does not by itself identify a person.
The error logs above are written on our servers when a request fails. The app itself sends no crash reports, no diagnostic or performance data and no usage analytics — it carries no analytics or crash-reporting SDK. Submitting links or document text is a web-only feature. The Android app sends the topic you type, the length and the language, plus images you attach yourself to replace a scene background. Attached images are not read from your photo library — only the files you pick in the system picker are transmitted, and they follow the same retention as your generation history (7 days).
The web app works without signing in; Google sign-in is optional there and simply lets you carry credits across devices. The Android apprequires a Google sign-in, because credits that are not tied to an account cannot be recovered once the app is uninstalled. The app’s notification permission stays optional — you can follow progress on screen without it.
2. Payment data
The Company never collects or stores card numbersor other payment credentials. Payment happens in the processor’s own window; we receive and store only the result (approval number, amount, timestamp). Credit purchases made in the Android app go through Google Play in-app billing: we receive the purchase token issued by Google, verify it, and record the credit grant. The token is kept in hashed form in our ledger, and payment credentials are handled by Google and never provided to us.
3. Processors
The Company entrusts the following processing, with contractual safeguards for secure handling of personal data.
| Processor | Entrusted work |
|---|---|
| 토스페이먼츠 (Toss Payments) | Payment processing and payment method authentication |
| 카카오페이 (KakaoPay) | Payment processing when KakaoPay is chosen (only when that feature is used) |
| Google (Google Play 인앱결제) | Payment processing and receipt verification for in-app credit purchases (Android app) (only when that feature is used) |
| Google (Firebase 인증·클라우드 메시징) | Google account sign-in and delivery of completion notifications (when you sign in or allow notifications) (only when that feature is used) |
| Google (Gemini API) | Generating scripts, images and speech from your topic, script or article text |
| Microsoft (Edge TTS) | Speech synthesis of script text |
| Anthropic (Claude API) | Script generation when the alternate engine is used (only when that feature is used) |
| OpenAI | Speech synthesis when the alternate engine is used (only when that feature is used) |
| Openverse · Pexels · Pixabay · Unsplash | Background image search (only the search query is sent) |
Cross-border transfer: among the processors above, Google, Microsoft, Anthropic, OpenAI and the image search services operate servers outside Korea. The content of your generation requests (topic, script, document text) is therefore transmitted to and processed on their overseas servers. This is necessary for the core function of the Service (AI generation). Items, timing and method of transfer: transmitted over the network when the work in the table above is performed.
4. Deletion
Generated video, audio and image files, and the request content behind them, are deleted irreversibly by the automatic retention policies of our storage and database once the retention period ends. Payment records that must be preserved by law are stored separately for the required period and then destroyed.
5. Your rights
You may request access, correction, deletion or suspension of processing of your personal data at any time using the contact below, and the Company will act without delay. You can delete the wallet identifier stored in your browser yourself — note that doing so makes any remaining credits unrecoverable.
Deleting your account can be done straight from the account menu in the app, and if you have already uninstalled it you can follow the Account and data deletion guide to request removal by email. That page sets out exactly what is deleted and what is retained under Korean law.
6. Cookies and automatic collection
We use no advertising or tracking cookies. Only values needed to run the Service (wallet identifier, interface language) are kept in browser storage, and you can clear them in your browser settings.
7. Security measures
Access to personal data is limited to the minimum necessary, transmission is encrypted, and payment data is handled only through the payment processor and never stored on Company servers.
8. Data protection officer
Name: 황태준
Contact: help@onehook.app / 050-6730-1118
For reports or consultation regarding privacy infringement in Korea, you may contact the Privacy Infringement Report Center (privacy.kisa.or.kr, 118) or the Personal Information Dispute Mediation Committee (kopico.go.kr, 1833-6972).
9. Changes to this policy
Changes are announced within the Service 7 days before they take effect.
This English text is a courtesy translation. The Korean version is the legally binding original; if the two differ, the Korean version prevails.