Privacy Policy

Wolha (website and Android/iOS apps, the “Service”), operated by 크레이빙(CRAVING) (the “Company”), complies with the Personal Information Protection Act of Korea and other applicable laws. This policy explains what information the Service collects and how it is used, provided, stored, and destroyed.

1. Personal Information We Collect

[At sign-up and login — required]

• Email sign-up: email address and password (stored with irreversible one-way encryption)
• Social login (Kakao, Google, Apple): the member identifier issued by each provider, the email address and name passed on by the provider (if you agreed to share them), and gender in the case of Kakao
• The nickname and chat name you use within the Service
• Gender and birth year — to confirm you are 15 or older, and for personalization and statistics

[When you use certain features — optional]

• Settings and descriptions you enter when creating a character, and images you upload
• Personas (self-introductions) and chat notes you write
• What you send through Keeper chat, feedback, or reports
• If you allow notifications, the device push token (Android/iOS app) or browser push subscription information
• When you buy paid products: order number, product, payment amount, type of payment method, payment status, and transaction verification information from the app marketplace (Google Play, App Store). The Company does not receive payment method details such as card numbers; these are handled by the payment processor and app marketplaces.

[Information generated and collected automatically while you use the Service]

• The content of your conversations with AI characters, and conversation summaries
• Personalization information organized by AI from your conversations, such as your preferences and relationship memories (see Section 4 below)
• Search terms
• Usage records: screens visited, time spent, records of key actions such as sign-up and payment, and in-service currency usage history
• Sign-up source information: campaign values (UTM) from ads and shared links, the domain of the referring external site, and referral codes
• Device and access information: device type and model, operating system, browser, screen resolution, whether the app is used and its version, access logs and access IP (hosting server records), cookies and sessions
• When errors occur: the error message, the screen path where it occurred, and device/browser information

2. Purposes of Collection and Use

• Member identification, login, account management, and blocking sign-ups by users under 15
• Providing and personalizing core features such as AI character chat and character creation and sharing
• Processing payment, delivery, and cancellation of paid products, and managing purchase history
• Sending notifications (push), delivering announcements, and responding to customer inquiries
• Improving the Service through usage statistics and sign-up source analysis
• Preventing abuse: blocking malicious content and handling reports, preventing repeated collection of sign-up benefits by leaving and re-joining, and analyzing errors

3. Retention Period

As a rule, personal information is kept until you leave the Service. When you leave, information linked to your account — such as your account, conversations, characters you created, push tokens, and inquiry history — is deleted without delay. However, the following information is kept for the periods below.

• Records of contracts and withdrawals of purchase, and of payments and supply of goods: 5 years / Records of consumer complaints or dispute resolution: 3 years (Act on the Consumer Protection in Electronic Commerce, etc.)
• Access log records: 3 months (Protection of Communications Secrets Act)
• The payment ledger and usage statistics (visit, action, and error records) may be kept after you leave, unlinked from your account, for the periods above or within the scope of statistical purposes.
• The email address and social identifier of a deleted account are kept only as hash values that cannot be restored to the original values, and are used solely to prevent duplicate sign-up benefits upon re-joining.

4. AI Processing and Personalization

To generate AI character responses, summarize conversations, organize your preferences and relationship memories, and assist search, the Service processes conversation content, notes, personas, and search terms with an AI model (Google Gemini). Messages sent through Keeper chat (customer inquiries) are processed by the same AI model to classify inquiries, draft automatic acknowledgments, and summarize and translate them for the operator; replies are written by the operator personally. Organized personalization information is used only to keep later conversations flowing naturally and is never used for advertising. We recommend that you do not enter sensitive personal information such as health, beliefs, or contact details in conversations. You can delete your chat history on My Page, and personalization information is deleted together when you delete your account.

5. Outsourcing of Processing and International Transfers

The Company does not sell your personal information. To provide the Service, we outsource processing as listed below, and some processing takes place outside Korea (transmitted over information and communications networks when you use the Service). Data is kept until the purpose of outsourcing is achieved or the outsourcing contract ends, in accordance with each provider’s policies.

• Google LLC (Gemini API, United States, etc.) — AI response generation, conversation summaries, organizing personalization information, search assistance, and classification and translation of customer inquiries: conversation content, notes and personas, search terms, character settings, and customer inquiry content. policies.google.com/privacy
• Vercel Inc. (United States) — web and app server hosting: request information and access logs generated while you use the Service
• Supabase Inc. (data stored in the Seoul, South Korea region) — database storage: member and usage information in general
• Telegram (operational alerts) — alerts to the operator when sign-ups, payments, inquiries, or reports occur, and during daily inquiry checks: nickname, email, gender, sign-up source and device summary, purchased product and amount, the beginning or summary of inquiries, and the reason for and beginning of reports. Used only for operational response.
• Google (Firebase Cloud Messaging), Apple (APNs), and browser push services — sending notifications: device push tokens, and notification titles and content
• Google Play, Apple App Store, and Toss Payments — payment processing and transaction verification: order information and transaction identifiers (payment method information collected by each payment provider is governed by that provider’s policies)
• Kakao, Google, and Apple — authentication for the social login you choose
• Meta Platforms, Inc. (United States and other countries) — Advertising performance measurement and personalized advertising on the website (Section 11): addresses of public pages visited, records of access to sign-up and payment screens, records of completed website payments and the amounts paid, cookie identifiers, IP addresses, and browser information. We do not provide email addresses, names, or conversation content. facebook.com/privacy/policy
• Google LLC (AdMob, United States, etc.) — showing optional rewarded ads in the app and confirming rewards (Section 11; only where rewarded ads are offered): device and advertising identifiers, IP addresses, ad view and interaction records, and the member identifier used to confirm rewards. policies.google.com/privacy

If you do not want your information transferred abroad, you may choose not to sign up or to leave the Service; in that case, use of the Service, such as AI chat, will be limited.

6. Cookies and Similar Technologies

• Session cookies to keep you logged in, and a language setting cookie
• Sign-up source measurement cookies (ad and shared-link information, up to 30 days), a referral code cookie (14 days), and an auxiliary device information cookie (7 days)
• Advertising performance measurement cookies (Meta's _fbp and _fbc, up to 90 days) — Used only on the website; details are provided in Section 11

You can refuse cookies in your browser settings, but some features, such as login, will not be available.

7. Your Rights and How to Exercise Them

You may request access to, correction, deletion, or suspension of processing of your personal information, or withdraw your consent, at any time. On My Page you can delete only your chat history, or leave the Service yourself with “Delete account”. You can turn off notifications at any time in your device or browser settings. Please submit any other requests to the contact below.

8. Destruction of Personal Information

Personal information whose retention period has expired or whose processing purpose has been achieved is destroyed without delay. Electronic files are deleted in a way that cannot be recovered. However, copies remaining in service providers’ backup and log systems are deleted progressively according to each provider’s retention cycle.

9. Security Measures

We implement technical and administrative measures to protect personal information, including one-way password encryption, encryption in transit (HTTPS), access control, and administrator authentication.

10. Protection of Children and Minors

The Service is intended for users aged 15 and over, and users under 15 based on the birth year entered at sign-up cannot sign up. Content that depicts minors or sexualizes them is prohibited, and we operate moderation procedures including pre-filtering, reporting, and blocking.

11. Advertising and Tracking

The app (Android and iOS) does not track users for advertising purposes and does not show personalized ads.

The app may offer optional rewarded video ads that let you get more free chats. These ads are served by Google AdMob (Google LLC) and play only when you choose to watch one. To show the ad, prevent fraud, and confirm the reward, Google may process device and advertising identifiers, your IP address, and ad view and interaction records; the Company receives only your member identifier and a transaction number to confirm the reward. Only non-personalized ads are shown. In the European Economic Area, the United Kingdom, and Switzerland, rewarded ads are shown only after you make a choice in Google's consent message, and you can change that choice at any time under "Ad privacy settings" below the ad button.

The website (wolha.app) uses the Pixel and Conversions API from Meta Platforms, Inc. to promote the service and measure advertising effectiveness.

• Data transmitted: addresses of public pages visited, records of access to sign-up and payment screens, records of completed website payments and the amounts paid, cookies (_fbp and _fbc), IP addresses, and browser information. We do not provide email addresses, names, or conversation content.
• Purposes of use: measuring advertising performance and displaying personalized advertisements
• No data is collected on the conversation or My Information screens, and these technologies are not used for visitors accessing from the European Economic Area, the United Kingdom, or Switzerland, or for app users.
• How to opt out: You can block cookies in your browser settings or turn off personalized advertisements in Meta Ad Preferences.

The measurement of sign-up sources described in Section 6 is used solely for the company's own service improvement and analysis of marketing effectiveness.

12. Privacy Officer and Contact

Privacy officer: 송현섭 (Representative of 크레이빙(CRAVING)) · Email: official@wolha.app · Phone: 010-9027-0729 · Other inquiries: the “Wolha Keeper” chat in the app and on the web

To report or seek advice on privacy violations, you may contact the Personal Information Infringement Report Center (privacy.kisa.or.kr, 118 in Korea) or the Personal Information Dispute Mediation Committee (www.kopico.go.kr, 1833-6972).

13. Notice of Changes

If this policy changes, we will announce the effective date and the changes through an in-service notice. Effective date: September 15, 2026.

Member Chat Rules and Privacy Notice (2026-10-12)

After you opt in, only your separately entered public nickname, bio, approved photo and conversation language are shown to other participating members. We do not publish your email, birth year, gender, social-login identifiers, AI persona or private profile. Messages are delivered to the recipient and may be reviewed by authorized operators as needed for safety checks and reports; they are not sent to AI models. Messages become unavailable in the member interface 30 days after sending; report evidence becomes unavailable to administrators 90 days after the report. Both are deleted at the next scheduled cleanup. Withdrawing profile visibility hides it immediately, but we cannot guarantee retrieval of copies already received by others. The linked rules explain photo processing, retention and deletion.

Read the Member Chat rules and privacy notice