Nalbom Privacy Policy

This policy applies to Nalbom (the "app"), a mobile app made by JUNIXION ("we", "us"), a business registered in the Republic of Korea. Our company website (www.junixion.com) has its own website privacy policy.

This policy is also available in Korean. The Korean, English, and Japanese versions describe the same app. If they ever differ, the version that is more favorable to you applies.

1. At a glance

• There is no sign-up. We do not collect your name, email address, or phone number. Only if you turn on sharing or D-day web links does the app sign in to the Nalbom server with a random anonymous ID, with no account or email (see section 4). If you email us a question or a refund request, we receive your email address and what you write (see section 7-2).
• We process personal information only for these purposes (purpose: items · legal basis · how long). The app does not use cookies.
  • Sharing and D-day web links: anonymous IDs, encrypted data, push tokens · to provide the features you turn on (Korean Personal Information Protection Act, Article 15(1)(4)) · until the deletion times in section 7
  • Confirming and restoring Nalbom Lifetime: RevenueCat's anonymous ID and purchase history · performance of the contract (same provision) · until the times in section 7; transaction records for 5 years
  • Crash reports (optional): the error information in section 4 · your consent (Article 15(1)(1)) · 30 days from receipt
  • Questions and refunds: the information in section 7-2 · refunds and purchase checks: performance of the contract (Article 15(1)(4)); other questions: our legitimate interest in answering them (Article 15(1)(6)) · the periods in section 7-2
  • Connection records: the IP address used and connection details showing the app and OS version · security and error checking (Article 15(1)(6)) · connection records on the Nalbom server (Supabase) stay only for Supabase's default log retention for our plan (1 day on the Free plan, 7 days on the Pro plan); we don't extend them or download and keep them, and no sign-in audit records are kept
• What you save in the app stays on your device by default. Only records you share or send as a D-day web link are encrypted on your device and kept as encrypted data on the Nalbom server (Supabase, Seoul region). The keys exist only on your devices (Keychain/Keystore) and in the links you share; the server holds only re-encrypted copies of the keys, so we cannot read the content either.
• Once a day, the app downloads public holiday tables from the Nalbom server. No personal information or records are sent.
• We do not use advertising IDs, device location (GPS, cell, or Wi-Fi location) or the location permission, or usage analytics tools. Places are kept only as names you type yourself. Crash reports are sent only from devices where you allowed them when first asked (sections 4 and 5).
• Nalbom Lifetime is bought through App Store or Google Play in-app purchase. To confirm purchases, the purchase service RevenueCat handles an anonymous ID and your purchase history (see section 4).
• We do not track you across other companies' apps or websites, so we do not respond differently to Do Not Track signals. We do not sell personal information or share it for targeted advertising, and we do not collect behavioral information for advertising.
• Records that may be sensitive, such as mood entries, stay only on your device. We do not process sensitive information or pseudonymized information.

2. Information stored on your device

The following is information you type in or attach yourself. It is stored only in the app's storage on your device (the app's database and the shared storage used by widgets and the share extension).

• Events (including the time zone name you pick for an event, such as Europe/Paris), notes, to-dos, Today's top 3, D-days and anniversaries (including the birth year for birthday D-days, optional), daily entries (text, photos, voice memos, attached files, links, place names), and day schedules. Attached photos are resized on your device to 2048 px on the long side before they are saved (if a photo can't be resized, the original is saved). Attached files (PDFs and more, up to 20 MB each) are files you choose in the Files app; they are copied into the app's attachment folder with their original file name and size, and are not put on the Nalbom server, in shared spaces, or in your device calendars (Google or iCloud). Deleted notes are kept on this device for 30 days so you can restore them, then removed along with their photos (they are not included in iCloud or backups).
• What you enter in work tools, such as annual leave, work hours, shift calendar and rosters, work journal, gift ledger (amounts and currency, and a short note to tell apart people with the same name), payday and clock-out time settings, hourly wage, company size, allowance, overtime threshold and deduction settings
• Business trip destinations and dates, packing lists, expenses (amount and currency), per diem and lodging rates, and receipt photos
• Spending records (date, description, amount and currency), fixed costs (name, amount, due date, reminder on or off, note), and your budget settings. Nalbom does not connect to banks, cards, or payment services, and this never leaves your device (except in a backup file you save or share yourself; see section 6).
• Booking details read from a booking message you share to Nalbom or paste in (text message, messenger, email, and so on): the booking place, date and time, departure and arrival, flight and seat, hotel or restaurant name and address, number of people, booking number, and other fields you check. The message is read entirely on your device. On iPhone, iPad, and Mac, a message shared to Nalbom is kept briefly in on-device storage shared by the app and its share extension until the app reads it, and is deleted as soon as it is read.
• Text shared from other apps (messengers, map apps, and so on): text that isn't a booking is saved on your device as a note when you tap Save, and a place shared from a map app is saved as its name, address, and link.
• Your one-line daily note and mood
• Pasting a roster: the text you paste into the box is read only on your device to fill in shifts; it is not saved or sent, and the app does not read your clipboard.
• A Photo a Day: one photo per date and when it was saved. The photo is cropped to a square, resized to a 1080 px JPEG, and kept in the app's storage. It is also included in backup files (.nalbom). It is never sent to the Nalbom server or a shared space (if you turn on iCloud sync, it syncs through your iCloud as described in section 6), and when you change or remove a photo, the old file on the device is deleted too.
• For a couple D-day: Our lists (section names and order, each item, and whether it is done), the calendar you chose as "our calendar" (its device calendar ID), and when you last merged a list you received. This is stored on your device and included in backup files. If you connect as a couple, Our lists are also kept on the server as encrypted data, as described in section 4.
• Shared events (title, date, time, place, notes), anniversaries you add (name, date, whether it repeats every year), memories (date, a line, a photo, and who added it) with hearts and comments on them, and photos received in a shared space. These are stored on your device and included in backup files, received photos too. If you add them to a couple connection or a shared space, they are also kept on the server as encrypted data, as described in section 4.
• Sharing and D-day web links: the spaces you joined and their keys, the name you use in a space, the D-day links you made and their keys, and the holiday tables downloaded from the server. Shared-space keys are kept only on this device in its secure storage (iPhone Keychain, Android Keystore), and the anonymous sign-in is encrypted with a key kept there and stored in the app's storage. The app's storage may be included in device backups, but it can't be decrypted on another device without the key (where secure storage is unavailable, the key is also kept in the app's storage, and there it may be included in system backups). Values in secure storage are not included in device backups or moved to a new device. On a new device, rejoin with an invite link. Or, scan the QR code shown on the new device with the camera of your device that already has the space, and the new device can show the same space. The space key is not in the QR code; your device encrypts it with the new device's public key so only that device can open it, and sends it through the server.
• App settings, such as accent color, notifications, holiday country and region, Second country, and last used currency, whether to send crash reports (this device only, not in backups), and whether the sharing age question was answered (only that it was answered)
• On Android, our payment service (RevenueCat) may keep an anonymous ID in Google Block Store (your Google backup) so purchases can be restored. The Nalbom app itself does not use Block Store.
• To-dos you check off and clock-ins or clock-outs you tap on a Home Screen widget (including the time): kept briefly in on-device storage shared by the app and its widgets so they can be added to your records when you open the app or return to it. They are not sent anywhere.
• Couple widget (Nalbom Lifetime) memory photo copies: copies of your couple D-day memory photos, resized to 900 px on the long side, up to the latest 30, in an on-device folder the widget reads (the App Group folder shared by the app and its widgets on iOS, the app folder on Android). They are never sent to the server or iCloud and are not included in backup files (only the originals are), and they are deleted when you no longer have Lifetime, the memory photos are gone, you delete a memory, or a photo falls outside the latest 30.
• Couple widget background photo: the one photo you choose under Style › Widget background on a couple D-day (choosing one requires Nalbom Lifetime) is kept in app storage like other D-day photos, and a resized copy is kept in the widget folder above. The widget folder copy never leaves your device. If the couple D-day is in a shared space, the photo is encrypted and shared with your partner as described in section 4 (it shows on their widget too); if you use the couple D-day on your own, it is not sent to the Nalbom server. If you turn on iCloud sync, it syncs to your iCloud like other D-day photos (section 6). If you remove the photo, the widget goes back to showing a different memory photo each day.

This information is deleted when you delete it in the app or delete the app. If your device's system backup (such as iCloud Backup) is on, app data may be included in that backup (Google device backup on Android does not include events, notes, or photos), which is handled under Apple's or Google's policies. Automatic iCloud Drive backup on iPhone, iPad, and Mac is described in section 6.

3. Device permissions

The app asks for a permission only when you use the feature that needs it. All permissions are optional, except the basic permissions Android grants automatically when you install the app (see the last three items below). If you say no, everything else in the app still works, and you can change permissions at any time in your device settings. On Android, before first asking for the calendar, camera, microphone, or saving to photos, the app explains what it is used for and that it is optional.

• Calendar: to show events from calendars on your device (Google, iCloud, and others) in the app, and to add or edit events. Calendar events are read and written only on your device and are not sent to us. They are not put in backup files, iCloud sync, or the Nalbom server, and widgets read them straight from the device calendar. The app explains this before asking for permission, and if you don't allow it, everything else still works. Syncing between calendar accounts follows each calendar provider's policy. When you move an event to another calendar, the app creates it in the new calendar and deletes it from the original one (for repeating events, only the range you choose: this day or this and following). This also happens only on your device. For Google and iCloud invitations, the app also reads attendees (names, email addresses, and replies) from the device calendar only to show them; it does not change or send them.
• Photo library and camera: to attach photos to events, notes, D-days, and trip expense receipts, and to take or pick a photo for A Photo a Day. Only the photos you pick are copied into the app's storage. Only photos on a D-day in a shared space and memory photos are encrypted on your device and uploaded, as described in section 4. If you turn on iCloud sync, photos are also stored in your iCloud, as described in section 6.
• Add photos (save to album): to save the event photos and D-day share cards you choose to your photo album. On Android 12 or earlier, this uses the storage permission, only for saving to the album.
• Microphone: to record voice memos and attach them to events and notes.
• Face ID and fingerprint (biometric authentication, or your device passcode): used only to confirm it's you when opening a locked note (Nalbom Lifetime). Your face and fingerprint data are handled by the device's operating system; Nalbom only receives whether the check succeeded and does not store or send it (Android permissions: USE_BIOMETRIC, USE_FINGERPRINT). Locking a note hides its text on screen; it does not encrypt the note. Locked notes are still included as-is in backup files and iCloud sync, and locks don't sync to your other devices via iCloud; restoring a backup brings the locks back too.
• Notifications: to remind you of events, D-days, anniversaries, the day before a shift or trip, the day before a fixed cost is due, a clock-out reminder (an hour after your set end time if you clocked in but not out), note due-date reminders (that morning, 1 hour before or 1 day before), a reminder on the 25th at 8 PM to add next month's roster, and so on. These reminders are all scheduled on your device. On iPhone, iPad, and Mac, if you use sharing and allow notifications, only the notice that someone changed what you share comes as a server push notification (section 4). Android does not use server push; shared items sync when you open the app. Notification buttons (Mark as done, Snooze 10 min, Move to tomorrow, Clock out now, Clock out at end time) change records only on this device and send nothing. "Clock out at end time" closes a forgotten shift at your set end time. Clock-out buttons work only after you unlock the device (on Android, tapping one opens the app to record it). The shortcuts shown when you long-press the app icon (New, Today's log, Clock in/out, Make a D-day, and Start n-min focus with Lifetime) also work only on the device.
• Lock Screen live updates: Of what you choose in Settings › Lock Screen live updates (clock-out countdown, next event, today's to-dos, anniversaries and payday on the day, trip transport from 3 hours before departure; the clock-out countdown needs Nalbom Lifetime), Nalbom shows the one that applies now on the iPhone or iPad Lock Screen (Live Activities; on iPhone, also the Dynamic Island) and in the Smart Stack of an Apple Watch paired with the iPhone (iOS 18 or later), or in Android notifications (on Android 16 and later, in the status bar and at the top of the lock screen). It's made on this device when you open Nalbom, sends nothing, and disappears when done. The iPhone shows it on the watch directly through the operating system; nothing is sent to the Nalbom server or to us. When you swipe a card away on the Lock Screen, the type of card and the time are remembered on this device (in storage shared by the app and its widgets; the last 40, not sent) so the same card isn't shown again. If you swipe away the same type twice within 14 days, Nalbom asks once whether to turn that type off. Done and Clock out on the Lock Screen are merged into your records when you open the app. When you start the focus timer (Nalbom Lifetime), the end-time notification is scheduled on this device, and study time is kept on your device and in backups you make. While you focus, the time left with Pause and End appears on the Lock Screen and in notifications (on the device only).
• Exact alarms (Android): so that notifications arrive at the exact time you set. Android grants this automatically when you install the app, so you are not asked. No information is collected through this permission.
• Promoted notifications (Android, POST_PROMOTED_NOTIFICATIONS): on Android 16 and later, shows Lock Screen live updates in the status bar and at the top of the lock screen. It is a normal permission, so you are not asked, and no information is collected through it.
• Basic permissions (Android): internet (to confirm purchases, download holiday tables, use sharing and D-day web links, link previews, crash reports (if allowed), and review code check), in-app payments, scheduling reminders again after the device restarts, vibration (light feedback when you switch dates or check off a to-do), and similar. Android grants these automatically when you install the app, and no information is collected through them.

4. Network connections, payments, and service providers

The app connects to the internet only in the cases below. When it does, your IP address may be recorded in the access logs of the service it connects to.

• Holiday tables: once a day, when you open or return to the app, it downloads the public holiday tables for all countries at once from the Nalbom server (Supabase, Seoul region). It does not sign in or send personal information or records, and sends no device information beyond the app and OS version that are automatically part of the connection. Because every country is downloaded together, the server cannot tell which country you use. If the download fails, the tables built into the app are used. App notices come with the holiday tables (the same request, so nothing more is sent and no personal information is involved). Dismissed notices are recorded only on this device, and notice links open only www.junixion.com addresses.
• Review code (Android): if you enter a review code (for Google Play review) in Settings › Support & about on Android, only the text you typed is sent to the Nalbom server (Supabase, Seoul) to check it. No login or device information is sent, and the text is not stored.
• Sharing (couple connection and Family, Friends, and Trip spaces) and D-day web links: only if you turn these on does the app sign in to the Nalbom server anonymously, with no account or email; the server creates a random anonymous ID. The server stores the space type and number of members, members' anonymous IDs, a value used to check invitations (a hash of the join token) and when it expires, update times, and the shared records (Our lists and shared lists, D-days, member names, space names, shift schedules, shared events (title, date, time, place, notes), anniversaries you add, list section names and order, and memories (date, a line, and who added it) with hearts and comments on them) only as data encrypted on your device with AES-256-GCM. If you add another of your devices, we keep a marker that its anonymous ID belongs to the same person, and a value used to confirm the pairing (a hash of a one-time secret). The confirmation value expires after 10 minutes and is deleted as soon as it is used, or within a day if unused. Other members of the space still see you as one person. Photos on a D-day in a shared space (background, profile, Couple widget background) and memory photos are resized on your device so the long side is 1280 pixels, encrypted with the space key, and kept in private storage on the Nalbom server (Supabase Storage, Seoul region) that only members of that space can download (up to 1 MB each and 200 per space). The key to unlock them is only after the # in invite links and D-day links and is never sent to the server, so we cannot read your shared records. Someone who receives a D-day web link gets the encrypted data by the link's ID without signing in, and unlocks it in their own browser or app. The server cannot read the contents, but it can see what it needs to work: the space type (couple, family, friends, trip) and member limit, the type of each item (for example list, event, memory, or comment), the anonymous ID of the member who added or changed each record and when, who created the space, when each member joined, the space key number (which key generation is current), anonymous sign-in records (sign-in times, the IP address used, and connection details showing the app and OS version (User-Agent)), the last-active date (date only), deletion marks, the number and size of photos, when notifications were sent, and the item types of notifications not yet sent. When a member leaves or is removed from a Family, Friends, or Trip space, a new space key is made. To pass the new key to members, each device keeps a public key on the server; the public key is also encrypted with the space key, so the server cannot read it, and the private key never leaves the device. Old keys are encrypted with the new key and kept on the server, so remaining and new members can read earlier records. Someone who has left cannot read records added after they left.
• Sharing notifications (iPhone, iPad, and Mac only): if you allow notifications, this device gets a push token from Expo. To do so, it sends Expo the device push token from Apple, a random installation ID Expo creates for each install, and the app identifier. The Expo push token is stored on the Nalbom server with the device type (iOS) and app language, and when someone changes what you share, a notification is sent through the Expo push service to the Apple Push Notification service (APNs). Notifications only say the type of space (for example, Family or Trip) and what type of item changed (for example, a new memory), never its contents or anyone's name. Several changes in a short time are combined into one notification every 10 minutes. You can turn these off with the sharing notifications switch in the app's Settings, which deletes your push token from the server. Android does not use server push.
• Crash reports (optional): only on devices where you allowed it, when the app crashes or hits an error we send the error type and message (with anything that looks like text you wrote masked), code location, app version and build, device model and OS version, app language, the app's state at the time (storage, memory size, battery, and connection type are removed from app error reports, but crash records from when the app closes suddenly may include memory and storage sizes), and the time of the error. We never send advertising identifiers, location, events, notes, photos or names. A random install ID or device hash the crash tool adds to sudden-crash reports is removed when Sentry receives them and is not stored. Your IP address reaches Sentry in transit but is not stored, and no location is derived from it. We ask on first launch, and you can turn it off anytime in Settings › Privacy & internet › Send crash reports; once off, nothing is sent.
• Link previews: titles and images for links in your event notes, an event's “Link” field, notes, and lists (the “Link or place” field in Our lists and shared space lists) are fetched by your device directly from those sites, not through Nalbom servers. The site can see your device's IP address and the usual connection details, such as device type and language, as when you open the link in a browser. Fetched previews stay on your device and are not included in backups or sent to the Nalbom server. You can turn this off in Settings › Privacy & internet, under "Link previews in notes, lists and events" (on by default); when it's off, the app doesn't connect to the site and shows only a button to open the link. When you paste just a link into a list, the item is named with the fetched page title if previews are on, or with the site name (without connecting) if they're off. That name is saved like any name you type, and in a shared space it's stored on the server as an encrypted shared record like other items. The map chip on a place in a list only opens the map app you choose (or its web address) when you tap it; the app doesn't connect to map services in advance. Previews only start from links that look like public web addresses. If a site redirects, the app follows but reads nothing from a private or on-device address. If the image is on another site, that site can also see your IP address. Links made of an IP address get no preview.
• Nalbom Lifetime is a one-time purchase (₩9,900 on the Korean store), not an auto-renewing subscription. Payment is made through Apple (App Store) or Google (Google Play) in-app purchase. We never receive or keep your card number or other payment details. Personal information in payment and refunds is handled under each app store's policy.
• We use RevenueCat, Inc. to confirm and restore purchases. The app connects to RevenueCat only when you open the Lifetime screen, buy, or restore a purchase; when you start the app on a device with a purchase history; and for 14 days after a payment is left pending or slow to confirm, when you start the app on that device. It does not connect while you use only free features. RevenueCat handles a random anonymous app user ID created on the first connection (shown as "Support ID" in Settings › Support & about), your purchase history (product, time of purchase or restore, app store transaction details), language and currency settings, app and operating system version, and the IP address used for the connection. This information does not tell us your name or contact details, and it is not used for advertising or tracking. For purchases made on Android, Google Play reports purchase status changes such as purchases and refunds to RevenueCat through our Google Cloud project (Pub/Sub). These notices contain only the purchase token, product, and purchase status, with no name or contact details.
• Service provider: RevenueCat, Inc. — confirming and restoring Nalbom Lifetime purchases, keeping purchase records
• Service provider: Supabase, Inc. — running the Nalbom server (holiday tables, anonymous sign-in, keeping the encrypted data and push tokens for sharing and D-day web links, and keeping encrypted photos). Data is stored in the Republic of Korea (Seoul region, Amazon Web Services).
• Service provider: 650 Industries, Inc. (Expo) — delivering sharing notifications (iPhone, iPad, and Mac), passed on to devices through Apple (APNs)
• Service provider: Google LLC and its affiliates (Google Workspace) — keeping question and refund emails
• Service provider: Google LLC and its affiliates (Google Cloud Pub/Sub) — relaying Android purchase status notices to RevenueCat
• Service provider: Functional Software, Inc. (Sentry) — crash report collection and storage (only from devices that allowed it)
• RevenueCat's subprocessors: all in the United States — cloud servers (Amazon Web Services) and other services RevenueCat uses to run its service. As of June 2026: Amazon Web Services, Google, Snowflake, Cloudflare, Fastly, Elastic, Sentry, Honeycomb, ScyllaDB, Hex, ClickHouse, OpenAI, Anthropic. See the current list in RevenueCat's Data Processing Addendum.

We do not give your personal information to third parties, except when a law enforcement or other authority requests it through a lawful procedure. Shared records are encrypted data we cannot read, so we cannot hand over what they say.

5. Transfers to other countries

• Legal basis: outsourced processing and storage needed to enter into and perform our contract with you (buying and using Nalbom Lifetime), disclosed in this policy under the Korean Personal Information Protection Act, Article 28-8(1)(3)
• Who receives it: RevenueCat, Inc. (United States). Privacy contact: compliance@revenuecat.com
• Where: United States (data centers of Amazon Web Services and the other providers in section 4)
• What: the anonymous app user ID, purchase history, language and currency settings, app and operating system version, and IP address described in section 4
• When and how: when you open the Lifetime screen, buy, or restore a purchase; when you start the app if you have a purchase history, or for 14 days after a payment is left pending or slow to confirm. Sent over an encrypted connection (HTTPS).
• Why and how long: to confirm and restore Nalbom Lifetime. Kept until we stop using RevenueCat or you ask us to delete it. Purchase records we must keep by law are kept for the period in section 7.
• If you do not want this: you can ask us to delete it. Because this information is needed to confirm purchases, you will not be able to buy or restore Nalbom Lifetime without it. Free features are not affected.

If you allow sharing notifications (iPhone, iPad, and Mac), information is also transferred as follows.

• Legal basis: Korean Personal Information Protection Act, Article 28-8(1)(3) (entrusting and storing to perform our contract with you, disclosed in this policy)
• Who receives it: 650 Industries, Inc. (Expo, United States). Privacy contact: Expo contact form
• Where: United States
• What: your Expo push token, the Apple device push token, the Expo installation ID (a random value created for each install), the app identifier, the notification text (a notice in your app language naming only the type of space and the type of item changed, without its contents or anyone's name), the ID of the space to open when you tap the notification (a random ID), and the IP address used for the connection
• When and how: when a device that allowed notifications gets or renews its token (when you open the app), and when someone changes what you share. Sent over an encrypted connection (HTTPS).
• Why and how long: to deliver sharing notifications. Processed as long as needed to deliver them; delivery records are kept for the period set in the Expo privacy policy.
• If you do not want this: don't allow notifications, or turn them off in your device settings. Sharing still syncs when you open the app.

If you use sharing or D-day web links, information on the Nalbom server may be accessed from abroad as follows.

• Legal basis: Korean Personal Information Protection Act, Article 28-8(1)(3) (entrusting and storing to perform our contract with you, disclosed in this policy)
• Who receives it: Supabase, Inc. (United States). Privacy contact: privacy@supabase.com
• Where: United States (access to run the service; data is stored in the Republic of Korea, Seoul region)
• What: the anonymous IDs, encrypted data, push tokens, and connection IP addresses described in section 4
• When and how: when you use sharing or D-day web links. Sent over an encrypted connection (HTTPS).
• Why and how long: to run the Nalbom server, until the deletion times in section 7.
• If you do not want this: if you don't use sharing or D-day web links, no anonymous ID, encrypted data, or push token is transferred. The IP address in connection records from holiday-table downloads may still be accessed from abroad for the period in section 1. To prevent this, turn off the device's network connection; the app then uses the table it last downloaded, or its built-in table if it has never downloaded one.

If you email us a question or a refund request, information is transferred as follows.

• Legal basis: Korean Personal Information Protection Act, Article 28-8(1)(3) (entrusting and storing to perform our contract with you, disclosed in this policy)
• Who receives it: Google LLC and its affiliates (Google Workspace, United States). Privacy contact: Google privacy contact form
• Where: the United States and other countries where Google has data centers (list of data centers)
• What: the information in section 7-2
• When and how: when you send the email, over an encrypted connection.
• Why and how long: as described in section 7-2.
• If you do not want this: use the options in the app instead (such as the refund screen on iPhone, iPad, and Mac), and nothing is transferred.

If you buy Nalbom Lifetime on Android, purchase status notices are transferred as follows.

• Legal basis: Korean Personal Information Protection Act, Article 28-8(1)(3) (entrusting and storing to perform our contract with you, disclosed in this policy)
• Who receives it: Google LLC and its affiliates (Google Cloud Pub/Sub, United States). Privacy contact: Google privacy contact form
• Where: the United States and other countries where Google has data centers (list of data centers)
• What: the purchase token, product, and purchase status
• When and how: when a purchase status changes on Android, such as a purchase or refund, over an encrypted connection
• Why and how long: to deliver the notice to RevenueCat, held only until delivered to RevenueCat, at most 7 days
• If you do not want this: you will not be able to buy Nalbom Lifetime on Android. Free features are not affected.

If you allow crash reports, information is transferred as follows.

• Legal basis: your consent (Korean Personal Information Protection Act, Article 28-8(1)(1)). On first launch the app shows who receives it (Sentry, Functional Software, Inc., United States, compliance@sentry.io), what, how long it is kept (30 days), and how to refuse, asks users under 14 to choose Don't send, and links to this policy.
• Who receives it: Functional Software, Inc. (Sentry, United States). Privacy contact: compliance@sentry.io
• Where: United States
• What: the crash report items in section 4, and the IP address used for the connection (not stored)
• When and how: when an error occurs on a device that allowed crash reports (after a sudden crash, on the next launch), over an encrypted connection (HTTPS)
• Why and how long: to find and fix app errors. Deleted 30 days after receipt.
• If you do not want this: choose Don't send when asked, or turn it off in Settings. Nothing is transferred, and there is no disadvantage.

If you live in the European Union, the European Economic Area, or the United Kingdom: information transferred to or handled by RevenueCat, Supabase, Expo, and Google in the United States is protected by each company's data processing agreement, which includes the European Commission's Standard Contractual Clauses (and the UK addendum). We and the Nalbom server are in the Republic of Korea, which the European Commission and the United Kingdom recognize as giving adequate protection to personal information. Transfers to Functional Software (Sentry) rely on the EU-U.S. Data Privacy Framework, and on the Standard Contractual Clauses where it does not apply (Sentry DPA 5.1.0).

6. Information you choose to send

• Backup: when you make a backup, the app creates a backup file (.nalbom) with your records, photos, voice memos, attached files, and settings, and saves it where you choose (iCloud Drive, Google Drive, a messenger, and so on). Backup files are not encrypted, so please keep them somewhere safe. We never receive your backup files (for a data file you attach to an email yourself, see section 7-2). Restoring a backup file replaces the records on that device with the backup's contents. D-days and lists from shared spaces that aren't on this device are not restored; you get them again when you reconnect to the space.
• Automatic iCloud Drive backup (iPhone, iPad, and Mac): on by default. Every week the app makes a backup file in your own iCloud Drive › Nalbom folder and keeps the latest 4. The files are kept under Apple's iCloud policies, and we never receive them. You can turn this off in Settings › Backup & transfer. On Android, the app only shows information about the device's own automatic backup.
• iCloud sync (Nalbom Lifetime, iOS 17 or later): if you turn it on in Settings › Backup & transfer, your Nalbom records (D-days, anniversaries and Our lists; events and notes with attachments; leave, work hours, shift schedules, and work journals; business trips, expenses, and bookings; the gift ledger; spending; moods; and A Photo a Day) are stored in your own Apple iCloud (CloudKit private database) and stay the same across devices signed in to the same Apple Account. They do not go through the Nalbom server, and JUNIXION cannot read them. Events in your device calendar, records in shared spaces, deleted notes, and study time (focus timer) are not included. When you turn it off, nothing more is sent; records and photos already in iCloud stay there, and you can delete them in Settings › Apple Account › iCloud › Manage Storage. Deleting something on one synced device deletes it on the others too. Photos, voice memos, and attached files also sync through your iCloud, but only on Wi-Fi. Photos, voice memos, and attached files from your other devices download ahead of time for nearby dates (the last 60 days and days ahead), and older ones download when you open them. If downloaded files go over 300 MB, the oldest are cleared from this device only; they stay in iCloud and can download again. Photos, voice memos, and attached files no longer used on any device are deleted from iCloud the next time Nalbom is opened on the device that uploaded them, at least 3 days later. If you don't turn on iCloud sync, photos, voice memos, and attached files stay only on this device and in your backup files. This feature is not available on Android. The first time you turn it on, Nalbom saves a backup file from before syncing so you can go back (not encrypted). It keeps the latest 2 in your iCloud Drive › Nalbom, or on the device for 30 days if iCloud Drive is not available.
• Invite links and D-day web links: the link goes to the app you choose (a messenger, text messages, and so on). When the person who receives it opens the web page (www.junixion.com/nalbom/c or /nalbom/d, including /nalbom/en/… and /nalbom/ja/… sent when the app is in English or Japanese), the page never sends or saves the key after the # in the link; it uses the key only inside that browser. These pages have no analytics or advertising tools. Connection records for these pages (such as IP addresses) are kept by our hosting provider (Vercel) as described in the website privacy policy.
• Requesting a refund: on iPhone, iPad, and Mac, Request a refund in Settings › Support & about opens Apple's refund window; Apple handles it and we do not receive its contents (we do not use the RevenueCat feature that sends usage information to Apple). On Android it opens an email to us; if you send it, we receive the Support ID, Google Play order number, reason, and app version written in it and use them to process the refund. We refund through the Google Play order and never ask for bank details.
• Receiving shared text (including booking messages): the app does not read your text messages, messenger, or email on its own, and does not ask for permission to read text messages. It only receives text that you share to Nalbom from another app or paste in yourself. Shared text is read only on your device. For booking messages, only the details we read are saved; other text is saved on your device as a note when you tap Save. Nothing is sent to our server. Before saving, please remove anything you do not need from the fields the app read.
• Sharing: D-day share cards, shift calendar images, weekly report text, Week in review and Your Nalbom Year images (PNG made on this device; Your Nalbom Year can include your moods for the year), note text (plain text or Markdown), exported CSV files, and the A Photo a Day "Share as one image" picture (this month's view made into one PNG on your device) go to the app you choose, and that app's policy applies from then on. We do not receive these files.
• Posting as text to X or Threads: if you tap Post as text (X or Threads) on the D-day share screen, a compose link with the D-day title and days left (and Nalbom's name and address if the Nalbom mark is on) opens in the X or Threads app or website. You decide whether to post there; we never receive the text.
• Exporting memories: when you tap it on the Memories screen of a shared space (couple, family, friends, or trip), the app makes one ZIP file on your device. It contains a cover image, photo cards (if you choose them), the original photos on your device (up to 1280 px on the long side), and a text list (date, name, and the line); hearts and comments are not included. The file goes only where you choose through your operating system's share sheet (Files, a messenger, cloud storage, and so on). We never receive or keep it, and once sent, the destination's policy applies. The exported ZIP is not encrypted and includes photos and text added by other members of the space.
• Sending an event as text: long-press an event and choose Send as text. Nalbom writes the date, time, title, place, link, and note as text and opens your phone's share sheet (messengers, text messages, and so on). It does not go through the Nalbom server, and Nalbom does not receive or store what you send. When you share an event text to Nalbom or paste it, it is read only on your device to fill in a new event, which you save yourself.
• Sending a list (couple D-day): when you tap Send lists, the list text goes to the app you choose (a messenger, text messages, and so on). Lists sent as text do not go through the Nalbom server, and Nalbom does not receive or store what you send.
• Merging a list you received (couple D-day): list text you receive through Share → Nalbom or copy is read only on your device. The app reads the clipboard only when you tap Merge a received list or the button to paste a couple invite, or when you paste an event text that starts with [Nalbom] into Quick add.
• Maps and links: when you open a place or link, that place name or address is passed to the map app or website you choose (Apple Maps, Google Maps, KakaoMap, Naver Map, and others). When you tap a booking, hotel, or weather shortcut in Business trips, that website opens. Google Flights, Rome2Rio, Booking.com, Airbnb, and Naver and Google search, among others, get the destination and dates as search words; Korail, SRT, express and intercity buses, Skyscanner, Naver flights, Yanolja, and Yeogi Eottae only open their start page. We do not receive any of this. Those apps and websites handle it under their own privacy policies.
• Place search (iPhone, iPad, and Mac): on iPhone, iPad, and Mac, when you type two or more characters in an event's location field, the app sends those characters to Apple Maps search (Apple MapKit) to find places. Apple handles the search; Nalbom does not receive or store your search words or results. Your device location and location permission are not used. On Android, nothing is sent; the app only suggests locations already saved on your device.
• Store rating: the app may show the App Store or Google Play rating prompt. Ratings and reviews are handled by Apple or Google; Nalbom does not receive them (Android uses the Google Play In-App Review library).

7. How long we keep information

You manage the information on your device, and it is gone when you delete it in the app or delete the app. We do not keep it. A Photo a Day photos are gone from the device when you remove them or delete the app (no server copy; if iCloud sync is on, the iCloud copy is deleted at least 3 days later, when Nalbom is next opened on the device that uploaded it), and restoring a backup file replaces them with the photos in the backup. We have no copy, so we cannot recover them for you. Records on the Nalbom server are deleted as follows. When you disconnect a couple connection, its server records are deleted right away. When a Family, Friends, or Trip space with other members is deleted for everyone, its encrypted records are kept for 7 days so any member can restore the space, and then deleted from the server. Photos of shared spaces deleted more than 7 days ago, or left by their last member, are deleted from the server automatically every day (by the next day at the latest). During those 7 days, no new records or photos can be added to the space and no notifications are sent. If you delete a space where you are the only member, it is deleted from the server right away. When you turn off a D-day link, its encrypted data is deleted. When you leave a space someone else created, your membership is deleted, and what you added stays for the remaining members until the space is deleted (the whole space is deleted when the last person leaves). When the person who created a Family, Friends, or Trip space leaves it, the space passes to the member who joined first and only the creator's membership is deleted. When you change a photo, the old one is deleted from the server; when you delete a D-day or take it out of a space, its photos are deleted; when you delete a memory, its photo and the hearts and comments on it are deleted; and when you disconnect or a space is deleted from the server, all photos for it are deleted. Comments can be deleted by the person who wrote them, and in Family, Friends, and Trip spaces also by the space creator; a deleted comment is removed from the server right away. Tapping "Delete all my records on the server" in Settings › Privacy & internet (or Backup & transfer) deletes your anonymous account, your memberships, your D-day links, and your push tokens. If you delete from the device that first joined the space, the member records of your other devices are deleted too; deleting from another device removes only that device's records. You can also remove devices one by one in the space's Manage › My devices. Family, Friends, and Trip spaces you created pass to the member who joined first if there is one, and couple spaces and spaces with only you in them are deleted with their photos. What you added to a space with other people, photos included, stays for the remaining members until that space is deleted. Use this button before you delete the app. This button does not delete the purchase records handled by RevenueCat or records synced to your iCloud. You can ask us to delete purchase records as described in section 9, and you can delete iCloud records in your device settings as described in section 6. Even after you stop all sharing and D-day links, your anonymous account (anonymous ID and sign-in records) stays on the server until you use "Delete all my records on the server" or it is deleted automatically as follows. Anonymous accounts that haven't connected to the Nalbom server for over a year are deleted automatically. When an app that uses the Nalbom server opens, it records the last-active date (date only) once a day, and every day we delete anonymous accounts whose last activity (or, if none, last sign-in) is more than a year ago, the same way as that button: Family, Friends, and Trip spaces you created pass to the member who joined first; your account, couple spaces, memberships, D-day links, push tokens, keys, pending device-pairing requests, and last-active date are deleted; and photos whose space is gone are removed by the daily photo cleanup. Records on your device stay as they are. Crash reports: Sentry keeps them for 30 days from receipt, then deletes them automatically. Because nothing that identifies you is sent, we cannot pick out and delete one user's reports; turning it off in Settings › Privacy & internet stops sending from then on. Invitations can't be used 24 hours after they are made. For information handled by RevenueCat, we delete the records through RevenueCat's tools without delay when the keeping period ends or when you ask us to; deleted information cannot be recovered. However, as a Korean business, we keep records of purchases, cancellations, and payments (product, time, transaction number) for 5 years, and records of complaints and disputes for 3 years, as required by the Korean Act on Consumer Protection in Electronic Commerce. Electronic files are deleted so they cannot be recovered, and we make no paper records.

7-2. Questions and refunds

If you email contact@junixion.com or privacy@junixion.com with a question or a refund request, we receive and handle the following.

• What we receive: your email address, what you write (including holiday corrections sent with Report a wrong date in the app), and the Support ID, purchase receipt (order number, purchase date, amount), and screenshots you send, and emails sent with 'Report a problem' in a shared space (your email address, what you write and attach, the space ID, and the app version; the space's records are not included). When you open an email from the app, your mail app is pre-filled with the app version, OS type and version, and your holiday country and region (plus the schema number when you report a data update error); you can delete these before sending. Google Play purchases are refunded through the order, so we don't ask for bank details; we ask for the account holder's name, bank name, and account number only in other cases where we must refund you directly. If you attach a Nalbom data file exported from the data update error screen to your email, we receive that file too. It is not encrypted and contains all your records, so whether to send it is up to you; we use it only to handle your question and delete it once we are done.
• Why: to answer you, confirm purchases, handle cancellations and refunds, and deal with disputes.
• How long: records of complaints and disputes for 3 years, and of cancellations and payments for 5 years (Enforcement Decree of the Korean Act on Consumer Protection in Electronic Commerce, Article 6). Refund request emails (including the email address) are kept for 5 years as refund records. Account numbers are deleted without delay once the refund is done; only the fact, amount, and date of the refund are kept for those periods. Other questions are deleted 3 years after we answer them.
• Emails are kept in our email service (Google Workspace, Google LLC).

8. Children

The app has no sign-up and does not collect names or contact details. We process no personal data other than what sections 4 and 7-2 describe (anonymous identifiers and IDs, push tokens, purchases, crash reports from devices that allowed them, inquiry emails, etc.). We do not process the personal information of children under 14 on the basis of consent. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has given us personal information, contact us and we will delete it. Purchases made without a parent's or guardian's consent can be cancelled. Purchases by children also follow each app store's parental approval settings (such as Ask to Buy on Apple and purchase approval on Google Play). See also Article 6 of the Nalbom Terms of Use. Under Article 9-2 of the Terms, users under 14 (or under the minimum age set by the law where they live) need a parent's or guardian's consent to use shared spaces and D-day web links. Crash reports are sent on the basis of consent, so the consent screen asks users under 14 to choose Don't send; nothing that identifies the user is sent. The app asks once, when sharing or a D-day web link is first used, whether the user is 14 or older or has decided to use it together with a parent or guardian, and stores only that the question was answered on the device (not the age).

9. Your choices and rights

You can view, change, or delete the information on your device in the app at any time, and you can delete records on the Nalbom server right in the app as described in section 7. To see or delete information handled by RevenueCat, email us at the address below with your Support ID from Settings › Support & about. Because the app does not store anything that identifies you, we may ask for your purchase receipt to confirm the request. Depending on where you live, you may have other rights under local law, such as to object to processing or to complain to your data protection authority. We will respond to these requests as the law requires. You can ask us to view, correct, delete, or stop processing the personal information we handle, or withdraw your consent, and we will tell you the result within 10 days of receiving your request. If we refuse or delay a request, we will tell you why and how to object. We do not use your information for automated decisions (Korean Personal Information Protection Act, Article 37-2) or profiling. You can also exercise these rights through an authorized representative, such as a legal guardian; we may ask for proof of authorization. In Korea, you can also report or seek help from the Personal Information Infringement Report Center (privacy.kisa.or.kr, 118), the Personal Information Dispute Mediation Committee (kopico.go.kr, 1833-6972), the Supreme Prosecutors' Office Cyber Investigation Division (www.spo.go.kr, 1301), or the Korean National Police Agency Cyber Investigation Bureau (ecrm.police.go.kr, 182).

If you live in the European Union, the European Economic Area, or the United Kingdom:

• We handle the anonymous ID and purchase history in section 4 because they are needed to provide Nalbom Lifetime you bought (performance of a contract, GDPR Article 6(1)(b)). We handle the anonymous ID, encrypted data, and push token for sharing and D-day web links to provide the features you turned on (performance of a contract, the same point). We keep purchase records for the period in section 7 because Korean law requires it (legal obligation, GDPR Article 6(1)(c)). Crash reports from devices that allowed them are processed on the basis of consent (GDPR Article 6(1)(a)); you can withdraw it anytime in Settings. Connection records (such as IP addresses) and general question emails are processed for our legitimate interests in keeping the service secure and answering you (GDPR Article 6(1)(f)).
• You have the right to access, correct, or delete your information, to restrict or object to its use, and to receive it in a portable form. Use the contact details in section 11.
• You can complain to the data protection authority where you live or work.
• If you live in Switzerland, you have the same rights under the Swiss Federal Act on Data Protection and can complain to the Federal Data Protection and Information Commissioner (FDPIC).

If you live in Japan, the Act on the Protection of Personal Information (APPI) also applies.

• Purposes of use: providing the features you turn on (shared spaces, D-day web links, push notices), confirming and restoring purchases, answering inquiries and refunds, and keeping records required by law.
• Provision to third parties in foreign countries: we entrust the anonymous IDs, encrypted data, push tokens, and purchase records described in section 4 to RevenueCat, Expo, Supabase, and Google in the United States. Each has a data processing agreement with us that requires measures equivalent to those under the APPI (a system conforming to the standards). On request, we will tell you about these measures and how we check them. Crash reports are separate: they are sent to Sentry (United States) only with your consent, given after the app shows you the recipient, the items, and how long they are kept on first launch. As described in section 5, Sentry protects personal information under the EU-U.S. Data Privacy Framework (DPF) and its data processing addendum.
• Where your data is kept: the Nalbom server is in the Republic of Korea (Seoul). Korea has a comprehensive personal information protection law (PIPA) and is recognized by the EU as providing adequate protection. The United States, where our service providers are, has no single comprehensive federal privacy law like the APPI and applies state and other laws; we require each provider, under the agreements above, to take measures equivalent to those under the APPI.
• Security measures: records stay on your device by default; shared records are encrypted on your device before upload; access to the server is limited to the members of each space; communications use HTTPS; staff access is limited to the minimum needed.
• Requests: to ask for disclosure, correction, suspension of use, deletion, or records of provision to third parties, email privacy@junixion.com with your Support ID. We charge no fee, and we disclose by email (electronic records) or another method you prefer. Complaints go to the same address. Business operator: JUNIXION, representative Junyeong Song, address in Article 15 of the Terms of Use.

10. How we protect information

• Your records stay on your device by default. What is kept on the server for sharing and D-day web links is only data encrypted on your device. The keys exist only on your devices (Keychain/Keystore) and in the links you share, and the server holds only re-encrypted copies of the keys, so the contents can't be read even if the server's data were leaked.
• Every table on the Nalbom server has access rules (row-level security), so only the members of a space can read and write that space's encrypted data.
• All connections are encrypted (HTTPS), and payment details are handled by the app stores.
• Only one person, our representative (the privacy officer), handles the personal information we process. The Nalbom server is in the Amazon Web Services Seoul region run by Supabase; we keep no servers or paper records of our own.
• Setting a screen lock on your device helps keep the records on it safe.
• If we learn of a personal information breach, we will tell you within 72 hours on this page and through other channels we can use, such as the app update notes in the stores, and report it to the Personal Information Protection Commission of Korea where the law requires.

11. Contact

• Privacy officer: Junyeong Song (Representative)
• Privacy email: privacy@junixion.com
• Phone: +82-10-3321-9974
• App support: contact@junixion.com
• Business: JUNIXION, 201, 159 Jayang-ro, Gwangjin-gu, Seoul, Republic of Korea

12. Changes to this policy

If we change this policy, we will let you know on this page and in the notice at the top of the app's Today tab (or the app update notes) at least 7 days before the change takes effect. Changes that are less favorable to you, such as collecting new kinds of information, will be announced 30 days in advance and recorded in the change history below.

Change history

• the day the Nalbom app is released — Takes effect
• 2026-11-13 — Section 3 notifications: on Android too, clock-out buttons work only after unlocking, and tapping one opens the app to record it (nalbom bbd3046); notification button names matched to the app
• 2026-11-12 — Section 4: link previews now also cover an event's Link field (nalbom b74b751; same conditions: not through the Nalbom server, public addresses only, can be turned off in Settings under “Link previews in notes, lists and events”, nalbom 45c4a88)
• 2026-11-12 — Wording fixes (no change in practice): the language versions are Korean, English, and Japanese; Android Google device backup does not include events, memos, or photos; app names matched (Lock Screen live updates, Snooze 10 min, Merge a received list, Manage › My devices, Our lists); deleting a space where you are the only member
• 2026-11-12 — Section 5 contacts: Supabase privacy contact corrected to privacy@supabase.com; Expo now points to its contact form (expo.dev/contact), since its policy lists no email
• 2026-11-11 — Fifth check against the app (nalbom 4a0cb0b, 1ec978d): Section 4: crash records from sudden app closes may include memory and storage sizes. Section 2: if a photo can't be resized, the original is saved. Section 7-2: a data file you attach to an email yourself (not encrypted) is used only to handle your question and then deleted (linked from section 6). Section 6: restoring a backup doesn't restore shared-space D-days and lists that aren't on the device
• 2026-11-10 — Second check against the app (nalbom a3e43ff): Section 4: crash reports remove storage, memory size, battery, and connection type before sending; sharing notifications also name the type of space and can be turned off in Settings, which deletes your push token from the server; link preview sites can also see usual connection details such as device type and language. Section 2: the anonymous sign-in is encrypted with a key in secure storage and kept in the app's storage (it can't be decrypted on another device). Section 6: a pre-sync backup when you first turn on iCloud sync (not encrypted; latest 2 in iCloud Drive or 30 days on the device). Section 7-2: values pre-filled in support emails
• 2026-11-10 — Wording matched to the app: A Photo a Day is kept in the app's storage and included in backups (no longer “only”), iCloud sync replaces Sync with iCloud, Apple Account replaces Apple ID, and menu paths use ›. No change in how Nalbom works
• 2026-11-10 — Sections 4 and 5: RevenueCat also connects for 14 days after a payment is left pending or slow to confirm. Section 5: Supabase transfer now covers connection-record IP addresses and how to refuse. Section 4: link previews. Section 2: key storage fallback. Section 8: children under 14. Crash reports: install ID and device hash are removed on receipt
• 2026-11-07 — English wording clarified (no change in meaning): “same provision,” couple D-day, Sync with iCloud, space ID, device-pairing requests
• 2026-11-07 — Section 2: added the Couple widget background photo (app storage and the widget folder; not sent to the server when used on your own; synced to your iCloud if Sync with iCloud is on). Section 4: added it to D-day photos in a shared space (handled like the other photos)
• 2026-11-06 — Section 7: anonymous accounts that haven't connected to the Nalbom server for over a year are deleted automatically every day (same as deleting server records; records on your device stay); section 4 adds the last-active date (date only) to what the server can see
• 2026-11-06 — Section 1: connection records are kept only for Supabase's default log retention for our plan (1 day Free, 7 days Pro), and no sign-in audit records are kept
• 2026-11-06 — Build 53: the quoted crash-report consent text and section 8 now ask users under 14 to choose Don't send; section 3 adds that Android explains permissions before first asking; section 7-2 adds that refund request emails (including the address) are kept 5 years
• 2026-11-06 — Legal review: section 1 adds a list of purposes with items, legal basis, and retention, that we use no device location or location permission (places are only names you type), and that we collect no behavioral information for advertising; section 2 notes app storage on devices without secure storage; section 4 adds the app and OS version sent with holiday table requests and connection details (User-Agent) in anonymous sign-in records; section 5 names Google and its affiliates with a privacy contact form and data center list, and adds the space number and delivery-record retention to the Expo transfer; section 6 adds connection records for web link pages (Vercel); section 9 adds stopping processing and withdrawing consent, answers within 10 days with reasons for refusal, no automated decisions for all users, GDPR legitimate interests, users in Switzerland, and no fee, electronic disclosure, and Sentry's safeguards for users in Japan; section 10 adds row-level security, one person handling data, server location, and breach notices; section 11 adds a phone number (no change to processing)
• 2026-11-06 — Build 53: crash reports, link previews in notes and lists, and the server-record delete button now live in the new Settings › Privacy & internet screen (including the quoted consent text); no change to processing
• 2026-11-05 — Build 52: section 6 adds the language versions of the invite and D-day web link pages (/nalbom/en/… for English, /nalbom/ja/… for Japanese); no change to processing
• 2026-11-05 — Build 52: section 2 adds the time zone name you pick for an event (such as Europe/Paris), kept with the event on your device, in backups, and in iCloud sync; no location permission or network use, since time zone data is built into the app
• 2026-11-05 — Build 52: section 2 adds files attached to events and memos (PDFs and more chosen in the Files app, copied into the app's attachment folder with their original name and size, up to 20 MB each, not put on the Nalbom server, in shared spaces, or in device calendars); section 6 adds attached files to backup files and iCloud sync (Wi-Fi only, same 3-day cleanup), what other devices download ahead of time (last 60 days and days ahead), and clearing downloaded files from this device only when they go over 300 MB
• 2026-11-05 — Build 52: section 6 extends link previews to links in lists (Our lists and shared space lists) and renames the switch to Link previews in notes and lists; adds how an item is named when you paste just a link (page title when on, site name without connecting when off) and that map chips only open a map app when tapped
• 2026-11-05 — Build 51: section 3 adds saving event photos to the uses of the Add photos (save to album) permission (Save Image from the share button in the photo viewer; no new permissions and nothing new sent)
• 2026-11-03 — Build 49: section 3 (Calendar) adds that attendees of Google and iCloud invitations (names, email addresses, and replies) are read from the device calendar only to show them, and are not changed or sent
• 2026-11-03 — Introduction links to the English website privacy policy; section 7: the note that we can't recover deleted photos is now highlighted, as in the Korean version; section 8: purchases made without a parent's or guardian's consent can be cancelled (as in the Terms of Use, Article 6)
• 2026-11-02 — Build 48: Section 3: Live on Lock Screen also appears in the Smart Stack of an Apple Watch paired with the iPhone (iOS 18 or later; the iPhone shows it on the watch through the operating system and sends nothing), and the type and time of cards you swipe away are remembered on the device (last 40, not sent; swiping away the same type twice within 14 days asks once whether to turn it off); sections 4 and 5: when you allow notifications, getting a push token sends the Apple device push token, Expo installation ID, and app identifier to Expo, and the server also stores the device type; section 6: what Sync with iCloud includes and leaves out, and which Business trips shortcuts pass the destination and dates and which only open the website's start page
• 2026-10-23 — Section 6: link previews are now turned off in Settings › Support & about, Link previews in notes; What to eat removed from the app, so its entries in sections 2 and 6 were deleted
• 2026-10-22 — Section 2: Today's top 3; section 3: focus timer study time on your device and in backups, time left on the Lock Screen while focusing, Start n-min focus shortcut, device passcode for locked notes, locks don't sync via iCloud and come back with a backup; section 6: Week in review and Your Nalbom Year images added or corrected
• 2026-10-21 — Section 3: trip transport added to Live on Lock Screen (free); focus timer (Lifetime; end-time notification scheduled on the device, study time saved only on the device); section 2: deleted notes kept on the device for 30 days (not in iCloud or backups); section 3: note due-date reminders and Face ID / fingerprint (only to open locked notes; we only receive whether it succeeded, nothing stored or sent)
• 2026-10-21 — Section 3: Live on Lock Screen added (clock-out countdown with Lifetime; next event, today's to-dos, anniversary and payday free; iPhone Live Activities, Android notification; on the device only, sends nothing); Android promoted notifications permission (POST_PROMOTED_NOTIFICATIONS, Android 16 and later)
• 2026-10-21 — Section 3: the Clock out at end time notification button added (closes a forgotten shift at your set end time, on the device only)
• 2026-10-20 — Section 2: whether the sharing age question was answered; section 3: notification buttons and Home Screen shortcuts work only on the device, photos also stored in your iCloud with iCloud sync; section 8: a one-time age question on first use (only the answer flag is stored)
• 2026-10-20 — Sections 1, 4, 5, 8, and 9 (Japan): optional crash reports added (Sentry, United States; asked on first launch, only from devices that allowed them, kept 30 days; IP reaches Sentry but is not stored; consent basis, DPF/SCC; users under 14 decide with a guardian); sections 2, 3, and 7: crash report setting, internet permission, and retention
• 2026-10-19 — Sections 1 and 10: where the keys are (your devices' Keychain/Keystore and links; the server holds only re-encrypted keys); section 4: space type and member limit; section 5: legal basis for the RevenueCat transfer; Korean store price and Korean map and booking sites added; section 7: the anonymous account stays until you delete your server records; section 8: what we process (sections 4 and 7-2); section 9: Korean reporting agencies moved out of the EU list; section 4: unused device-pairing values deleted within a day
• 2026-10-18 — Section 3: moving an event to another calendar (only on your device); section 7-2: Report a problem emails from shared spaces (the space's records are not included); section 8: guardian consent for users under 14 to use shared spaces and D-day web links; section 6: sharing note text (plain text or Markdown); sections 4 and 5: sharing notifications combined every 10 minutes and naming the type of item changed (no contents or names)
• 2026-10-18 — Section 1: no cross-app tracking, no selling or sharing for targeted advertising (Do Not Track), no sensitive or pseudonymized information; section 4: Android purchase status notices (Google Cloud Pub/Sub) and what the server can see (space creator, join times, key number, anonymous sign-in records); section 5: Pub/Sub transfer; section 7: what deleting server records does not delete (purchase records, iCloud); section 8: children under 13; section 9: exercising rights through a representative; section 9: If you live in Japan (APPI) added
• 2026-10-17 — Team dinner search replaced by What to eat (a menu picker): section 2 information on your device (recent picks, dishes turned off, dishes you add), section 6 only the picked dish name goes to the map app. This month's pay from your hourly wage added: section 2 information on your device (hourly wage, company size, allowance, overtime threshold and deduction settings). Holiday corrections added as an example in section 7-2
• 2026-10-16 — Viewing a space on your other devices (QR) added: section 2 (the space key is encrypted with the new device's public key and passed through the server), section 4 (same-person device marker, 10-minute confirmation value), and section 7 (deleting server records and removing your devices). Photos and voice memos added to Sync with iCloud (Wi-Fi only, deleted from iCloud at least 3 days after no device uses them, when the uploading device next opens Nalbom): A Photo a Day in section 2, section 6, and section 7
• 2026-10-16 — Removed Read from a photo for rosters and Google ML Kit on Android (deleted the service, transfer and analytics exception; roster reading removed from photo and camera uses). Added pasting a roster as text (read only on your device). Added question emails, legal basis, and no cookies to section 1; no giving to third parties and Google Workspace to section 4; Supabase and Google Workspace transfers with their legal basis to section 5; section 7-2, Questions and refunds; how we delete to section 7; Korean reporting agencies to section 9; and how we announce changes to section 12. Added posting as text to X or Threads from the D-day share screen to section 6.
• 2026-10-16 — Requesting a refund added (Apple handles it on iOS and we receive nothing; on Android we receive the Support ID, order number, and reason by email); Google ML Kit transfer for reading a roster photo on Android now based on your consent (asked the first time, can be withdrawn in Settings), app notices delivered with the holiday tables, calendar events kept out of backups, iCloud sync, and the server, and key points emphasized; Couple widget memory photo copies (in an on-device widget folder, latest 30 at 900 px, not in backups) added; A Photo a Day (on your device only, in backup files, never sent to the server, shared spaces, or iCloud sync) and its photo and camera use, plus exporting memories as a ZIP and the A Photo a Day share image (only to where you choose; we never receive them) added; List section names and order, memories (any day, who added them) with hearts and comments, and memories in Family, Friends, and Trip spaces added to shared records and deletion; what the server can see now includes the anonymous ID and time of the member who added or changed each record
• 2026-10-15 — When a member leaves or is removed from a Family, Friends, or Trip space, a new space key is made; per-device public keys (encrypted with the space key) and old keys encrypted with the new key are kept on the server
• 2026-10-14 — Android review code added (only the text you type is sent to the Nalbom server to check it, and it is not stored); With the 3-day free trial ended, trial details (start time, Block Store, free iOS purchase) removed, and RevenueCat on Android noted as possibly keeping an anonymous ID in Google Block Store so purchases can be restored; Text shared from other apps that isn't a booking is saved on your device as a note when you tap Save (places from map apps as name, address, and link); shared-space keys and the anonymous sign-in now noted as kept only in the device's secure storage (iPhone Keychain, Android Keystore), not in device backups or moved to a new device; deleted shared spaces' photos removed automatically every day (by the next day at the latest)
• 2026-10-13 — Deleted shared spaces kept for 7 days before deletion (no new records or notifications meanwhile; couple disconnections and spaces with one person left deleted right away), spaces pass to the member who joined first when the creator leaves or deletes their server records, link previews only connect to public addresses; Sync with iCloud for Nalbom Lifetime added (stored in your own iCloud CloudKit private database, not through the Nalbom server); pasting an event text added to when the clipboard is read, sending an event as text added, and attached photos now noted as resized before saving
• 2026-10-12 — Shared events, anniversaries you add, and memories (a line and a photo), plus shared D-day photos (made smaller and encrypted on your device, then kept in server storage), added to what is kept on the server and on your device, the photo permission, service providers, and when records are deleted; the clipboard is also read when you tap the button to paste a couple invite
• 2026-10-11 — Google ML Kit for reading a roster photo on Android (sends device and app information, performance and usage stats, and a Firebase installation ID, never the photo or its text) added as a service, transfer, and exception to no analytics tools; camera and photo library also used to read rosters; clock-out and next month's roster reminders added
• 2026-10-10 — Updated before release: sharing and D-day web links (anonymous sign-in, encrypted shared records, iPhone, iPad, and Mac notifications), holiday table downloads, automatic iCloud Drive backup, deleting server records, Supabase and Expo added as service providers, Mac (Apple silicon) added for share extension, place search, sharing notifications, and automatic iCloud Drive backup, link previews added (fetched by your device directly from the linked site, can be turned off in Settings)