Privacy policy.

One policy for ipe() websites and mobile apps. Per-service differences are in Appendix A (web) and Appendix B (apps). pawstcard is not covered by this common policy (own policy separately — on hold).

Effective 2026-07-26 · Version v1.0

ipe() (“we”) respects your privacy and follows applicable law, including Korea’s Personal Information Protection Act. This policy explains what information our websites and mobile apps handle and how.

The short version: services covered by this policy do not ask for accounts, names or phone numbers. Our websites measure visits with Google Analytics 4 (some sites also with Cloudflare Web Analytics), and we currently show no ads. Our apps mostly keep data on your device, and the apps covered today use no advertising SDK; exceptions are in Appendix B. We do not sell personal information.

1. Who is responsible

2. Where this policy applies

• Websites: ipe.rest and every *.ipe.rest subdomain (play, idle, draft, still, iltonggi, inkisle, sunmeld, claimball, tilttower, mossgarden, blockfit, marblebottle and any added later). pawstcard is excluded.
• Mobile apps: apps ipe() distributes through the App Store and Google Play: still, draft, idle, Ilton (일통기), Inkisle (잉크아일), Patchland, Tottertop, Moss Garden, Blockfit, etc. (checked in repos 2026-11-13; apps added later included). pawstcard is covered by its own policy and is outside this common policy.
• Services differ in what they handle. The tables in Appendices A and B state the facts per service; to the extent we have checked, a service does not collect what its row does not list (parts not fully audited, such as third-party native code, are noted at the end of Appendix B). If the body and a table differ, the more specific table controls.
• If a service shows a more specific notice (for example an in-app permission prompt), read it together with this policy.

3. What we collect, why, and how long

Records we must keep by law (e.g. e-commerce payment/contract records) are kept for the statutory period (Korea’s E-Commerce Act: contract/withdrawal records 5 years, payment and supply records 5 years, consumer complaint/dispute records 3 years). In-app purchases are processed by the stores, so we may hold no payment records ourselves; the periods apply only if we do.

What we do not collect: services covered by this policy do not ask for names, phone numbers, national ID numbers or account passwords, and create no accounts. We do not collect precise location or contacts. Apps that use device features such as camera, photos or microphone are listed in Appendix B; we do not send that content to our servers (voice input in still may be passed to Apple/Google, see section 6).

4. Cookies, analytics and advertising

1. Google Analytics 4 sets cookies (_ga, up to two years) to count visits. We do not put directly identifying information such as names or emails into analytics. Google may nevertheless process cookie identifiers and IP-based data.
2. Cloudflare Web Analytics measures in aggregate without cookies (on the sites marked in Appendix A).
3. Google AdSense is not served on any site at present (no ad code in site source, checked 2026-11-13). Before we serve ads we update this policy and Appendix A first; at that point third-party vendors, including Google, may use cookies to serve ads based on a user’s prior visits to our site or other websites. You can then turn off personalised ads at Google Ads Settings or opt out at aboutads.info (Europe: youronlinechoices.eu). How Google uses data from partner sites: policies.google.com/technologies/partner-sites.
4. Consent and choice: Korean visitors are not shown a cookie consent banner; we have decided to apply a consent approach only to visitors in the EEA, UK and Switzerland. However, a consent notice (CMP / Consent Mode) has not yet been introduced. Until it is, we do not serve personalised ads in those regions, and we introduce the consent notice before starting any service that uses advertising cookies. We will also describe the consent notice for analytics cookies (GA4) here when it is introduced. You can block or delete cookies in your browser or use Google’s Analytics opt-out add-on; the site works the same without them.
5. Apps: the apps covered by this policy currently use no advertising SDK (Appendix B, pubspec checked 2026-11-13). If this changes we update this policy and the store disclosures first.
6. Google Fonts and other external resources: still, draft (and some language pages of iltonggi) load fonts from Google’s servers, so your IP address may be passed to Google when you visit. Other sites serve fonts themselves or we have not yet checked (Appendix A).

5. Sharing with third parties

We do not sell personal information and do not provide it to third parties, except where the law requires. In some features, such as voice input, data may however pass to companies such as Apple or Google; see section 6.

6. Processors and transfers abroad

The following providers handle data as needed to run the services and may process it on servers outside Korea (e.g. the United States). Only providers we actually use are listed.

How to refuse the transfer, and the procedure

• Method: web — block cookies in your browser or use the Analytics opt-out add-on. Apps — do not use still’s voice input or the model download.
• Procedure: apply the method yourself, or ask at the contact in section 1 (privacy@ipe.rest).
• If you refuse: that function (visit statistics, voice input, model download, etc.) is unavailable. A transfer that is essential to providing the service, such as web hosting, cannot be refused; in that case please stop using that service.

7. Deletion

When the purpose is fulfilled or retention ends, we delete data without delay, by methods that prevent recovery. Data stored only on your device disappears when you delete the app.

8. Your rights

You may at any time request access, correction, deletion or suspension of processing, and withdraw consent.

• How to ask: write to the contact in section 1 (privacy@ipe.rest); we tell you the outcome within 10 days.
• Representatives: a legal guardian or an authorised representative may make the request, and we may ask for proof of the authority (e.g. a power of attorney).
• If we decline: we tell you the reason and how to object. Analytics (GA4) data is not tied to your name or email, so in some cases we cannot locate an individual’s records; in that case it may be impractical to act, and we may decline and tell you why. Email correspondence we can locate and delete.
• Objection: if you disagree with the outcome you may ask again at the same address and apply for relief to the bodies in section 11.
• If you are in the EEA, UK or Switzerland you also have GDPR rights (objection, portability, complaint to a supervisory authority).

9. Children

Our services are not directed to children under 14 in Korea (or under 13 in the US under COPPA, under the age set by your country within 13–16 in the EU under GDPR, or the minimum age in your region), and we do not knowingly collect their personal information or knowingly show them personalised ads. If we learn we have, we delete it promptly. Our apps are rated for users aged 16 and over, and we do not apply to Google Play’s “Designed for Families” program.

10. Security

We design the services to collect almost no personal information and take the basic measures below.

11. Complaints

KISA Privacy Infringement Report Center (privacy.kisa.or.kr, 118), Personal Information Dispute Mediation Committee (kopico.go.kr, 1833-6972), Supreme Prosecutors’ Office (spo.go.kr, 1301), National Police Agency Cyber Bureau (ecrm.police.go.kr, 182).

12. Changes

If this policy changes, we announce it at the canonical address (https://ipe.rest/legal) and in the app or site 7 days before it takes effect. For changes that disadvantage you or materially affect your rights we give 30 days’ notice. Past versions are available on request (privacy@ipe.rest).

---

Appendix A — Websites (checked in repos 2026-11-13; [unverified] = deployed page not checked)

No ad code was found in the source of any other site either (2026-11-13).

pawstcard (app and landing site) is outside this common policy — own policy separately (on hold).

Appendix B — Apps (checked in pubspec/source 2026-11-13; Info.plist and code checked for still and draft)

Apps not in this table (no repo yet, or not yet released) are added here first, before release.

pawstcard (F-016) is not in this table — own policy separately (on hold).

Note: “none” means pubspec dependencies and URLs under lib/ were checked; a full audit of third-party native code, merged AndroidManifest and iOS settings was not done [unverified]. “Ads: none” means no advertising SDK dependency.

Match the store forms to this table: Apple “App Privacy” (nutrition labels) and Google Play “Data safety” are to be filled from the table above. Permissions (camera, photos, microphone, speech recognition) are declared to match actual code use.