Tididi Privacy Policy

한국어 · English · 日本語

Effective date: November 6, 2026

This English version is a translation of the Korean Privacy Policy. If there is any difference in meaning, the Korean version prevails. For users in Japan, the Japanese version and its "Additional Provisions for Users in Japan" apply. For users in the United States and Australia, this English version, including the "Additional Provisions for Users in the United States" or the "Additional Provisions for Users in Australia" at the end, applies, and the English version prevails.

Tididi (the "Service") is operated by an individual operator (the "Operator"). The Operator complies with the Personal Information Protection Act of the Republic of Korea and other applicable laws, and publishes this Privacy Policy to protect users' personal information and to handle related concerns promptly and smoothly.

1. Purposes of Processing Personal Information

The Operator processes personal information for the following purposes. Personal information is not used for any other purpose, and if the purpose changes, the Operator will take the necessary steps, such as obtaining separate consent, as required by Article 18 of the Personal Information Protection Act.

• Confirming the intention to sign up, identifying and authenticating members, and preventing misuse
• Account security: showing the list of signed-in devices, signing out other devices, and signing out other devices when the password is changed
• Providing the Service, including saving running records, creating and sharing posts, following, likes (Fire), saves, and messages
• Handling inquiries and reports, operating the community, and managing inappropriate content
• Sending push notifications for service information, announcements, and error fixes
• Analyzing service usage statistics and improving service quality
• Importing running records from a health app the user has connected (Health Connect / Apple Health): creating running cards and showing records in I Did It (running calendar and statistics)

2. Personal Information Collected and How It Is Collected

(1) Information collected

At sign-up

• Required: email address, password, username (nickname), date of birth, gender, mobile phone number (identity verification)

Information created while using the Service

• Profile photo, cover photo, bio (optional)
• Posts (photos, videos, text captions)
• Running records (distance, time, pace, average heart rate, cadence, calories, elevation, etc.)
• Health app data (only if the user agrees to connect via "Import records"): start and end time of running workouts, distance, calories burned, average heart rate, and the name of the app that recorded it
• Race certification records, My Collection items (personal goals/records)
• Follow and block relationships, and interaction records such as likes (Fire), saves, and comments
• Content of messages exchanged with other members
• Reports and customer inquiries
• Information generated automatically while using the Service: access logs, device information (OS, device model, app version), error (crash) information, service usage records
• Signed-in device records: device model, OS and version, app version, first sign-in time, last access time, whether signed out (location is not collected)
• Device token for sending push notifications
• App language setting (the language used for the app screens and push notifications)
• App usage statistics: usage records such as screen views and button taps, an app installation identifier, and approximate country/region (Google Analytics for Firebase)
• Translation feature data: the text the user chose to translate with "See translation" (post captions, comments, messages), the translation result, and the daily number of uses

(2) How it is collected

• Entered directly by the user who agrees to the processing of personal information at sign-up or while using the Service
• Generated and collected automatically while using the Service (error logs, device information, signed-in device records, etc.)
• If the user agrees to connect a health app within the app and allows it in the phone's permission screen, read from Health Connect (Android) or Apple Health (iOS)

(3) Processing of health app (Health Connect / Apple Health) data

1. What is read: running workouts (including treadmill) from the last 30 days, and the distance, calories burned, heart rate, and steps during those workouts. On Android, steps are requested together because the permission is required to read workouts, but steps are not stored. Other health information such as location/route, sleep, or weight is not read.
2. Purpose: creating running cards and showing records in I Did It (running calendar and statistics). It is not used for any other purpose.
3. Storage and visibility: imported running records are stored on the server (Google Firebase) as running records of the user's account and are visible only to the user until posted ("Only me"). Only records the user posts are visible to other users.
4. Limited use: information received from health apps is not used for advertising or marketing, sold, provided to third parties, or used for credit, insurance, or similar assessments. Tididi only reads health app information and does not write to or change it. Use of this information follows the Health Connect permissions policy and the Apple HealthKit guidelines.
5. Retention: kept until the user deletes their account or deletes the record in I Did It, and then destroyed without delay.
6. Disconnecting: the user can unlink at any time in the app (Settings › Health app sync) and turn off the permission in the phone's settings (Android: Health Connect › App permissions › Tididi / iPhone: Health app › Sharing › Apps › Tididi). Records already stored remain until deleted, even after the permission is turned off.
7. Right to refuse: even without connecting a health app, the user can create running cards by importing a screenshot or entering records manually, and there is no restriction on other parts of the Service.

(4) Processing for the "See translation" feature

1. Only when the user taps "See translation" is the text (post caption, comment, or message) sent to the Google Cloud Translation API to translate it into the user's app language. Text the user does not tap is not sent.
2. Translations of post captions and comments are stored on the server (Google Firebase) so the same text is not translated again, and are deleted together when the original is deleted. If the original is edited, the previous translation is not reused.
3. Translations of messages are not stored on the server and are kept only temporarily on the screen of the device that translated them.
4. To prevent misuse, the number of translations and characters per user per day is recorded, and this record is used only to operate the Service.

3. Retention Period

1. The Operator processes and retains personal information within the retention period required by law or the period agreed to by the data subject at collection.
2. In principle, a user's personal information is destroyed without delay when the account is deleted. However, the following information is kept for the stated reasons and periods:
• Misuse records: kept for up to 1 year after account deletion to prevent misuse
• Where retention is required by law, for the period set by that law (e.g., communication confirmation data under the Protection of Communications Secrets Act: 3 months)
3. Signed-in device records are kept until the account is deleted and then destroyed without delay. Records of devices signed out via "Sign out of all other devices" are deleted when the sign-out is processed on that device, and devices not accessed for 90 days are not shown in the list.

4. Provision to Third Parties

The Operator processes personal information only within the scope stated in the purposes above, and provides it to third parties only in cases under Articles 17 and 18 of the Personal Information Protection Act, such as with the data subject's consent or as specifically provided by law. The Operator currently does not provide users' personal information to any third party.

5. Entrustment of Processing

To provide the Service, the Operator entrusts personal information processing to the following company and uses its cloud infrastructure.

When entering into the entrustment contract, the Operator specifies, in accordance with Article 26 of the Personal Information Protection Act, the prohibition of processing outside the entrusted purpose, technical and managerial protection measures, restrictions on re-entrustment, and management and supervision of the entrusted company.

6. Transfer of Personal Information Abroad

The servers of Google Firebase / Google Cloud Platform used by the Operator may be located outside Korea, so users' personal information may be transferred abroad and stored and processed there. This is done only to the extent necessary to provide the Service (data storage and processing) and is protected under Google's own security standards.

7. Rights of Data Subjects and How to Exercise Them

1. Data subjects may exercise the following rights against the Operator at any time:
• Request access to personal information
• Request correction if there is an error
• Request deletion
• Request suspension of processing
2. These rights may be exercised through the settings menu in the app or by writing or emailing tididiapp@gmail.com, and the Operator will take action without delay.
3. If a data subject requests correction or deletion of an error, the Operator will not use or provide the personal information until the correction or deletion is completed.
4. The legal guardian of a child under 14 may request access to, correction or deletion of, or suspension of processing of the child's personal information.

8. Destruction of Personal Information

1. When personal information is no longer needed, such as when the retention period has passed or the purpose has been achieved, the Operator destroys it without delay.
2. Personal information stored in electronic files is deleted using technical methods that make the records unrecoverable, and personal information recorded on paper is shredded or incinerated.

9. Security Measures

The Operator takes the following measures to keep personal information safe:

• Encrypted storage of passwords and separate access control for personal information (date of birth, gender, email, phone number, etc.)
• Limiting access rights to personal information to the minimum necessary
• Blocking others' access to sensitive information except for the user and authorized cases, through the security rules (Security Rules) of the cloud infrastructure (Firebase)
• Installing and updating security programs against hacking (using Firebase security features)

10. Protection of Children's Personal Information

1. In principle, the Service does not collect the personal information of children under 14 without the consent of their legal guardian.
2. If it is found that a child under 14 tried to sign up without the consent of a legal guardian, the Operator may restrict use of the account or destroy the related information.
3. Users who live in the United States or Australia must be at least 18. If it is found that such a user is under 18, the Operator may restrict use of the account or destroy the related information.

11. Automatic Collection Tools

To improve service quality and fix errors, the Operator automatically collects app error information and device information through Firebase Crashlytics, and app usage statistics (usage records such as screen views and button taps, an app installation identifier, and approximate country/region) through Google Analytics for Firebase. This information is used only to keep the Service stable and to analyze usage statistics, and is not used for advertising or marketing.

12. Privacy Officer

The Operator is responsible for personal information processing and has designated the following privacy officer to handle complaints and remedies of data subjects related to personal information processing.

• Privacy officer: Tididi Operator
• Contact (email): tididiapp@gmail.com

Data subjects may contact the privacy officer about any inquiries, complaints, or remedies related to personal information protection that arise while using the Service.

13. Remedies for Infringement

To seek remedies for infringement of personal information, data subjects may apply for dispute resolution or consultation to the Personal Information Dispute Mediation Committee, the Korea Internet & Security Agency's Personal Information Infringement Report Center, and others (Korean services):

• Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
• Personal Information Infringement Report Center: 118 (privacy.kisa.or.kr)
• Supreme Prosecutors' Office: 1301 (www.spo.go.kr)
• Korean National Police Agency: 182 (ecrm.police.go.kr)

14. Changes to This Privacy Policy

If this Privacy Policy is added to, deleted, or modified due to changes in laws, policies, or security technology, the Operator will announce it through in-app notices before it takes effect.

Addendum

This Privacy Policy applies from November 6, 2026.

Previous versions (effective October 26, 2026, October 23, 2026, October 11, 2026, and July 27, 2026) are available on request at tididiapp@gmail.com.

Additional Provisions for Users in the United States

These provisions apply to users who live in the United States. If they differ from the main text of this Privacy Policy, these provisions prevail for those users. Some U.S. state privacy laws apply only to businesses above certain size thresholds; whether or not a particular law applies to us, we offer the rights described below to all users in the United States.

US-1. Who We Are

The Service is operated by LEE SEUNGHWAN, an individual doing business as "Tididi," located in Nowon-gu, Seoul, Republic of Korea. Contact: tididiapp@gmail.com.

US-2. Personal Information We Collect, Sources, and Purposes

The table below summarizes the categories of personal information we have collected in the past 12 months, using the categories in California law. The details are in Section 2 and the purposes are in Section 1.

We do not collect precise geolocation, and we do not create profiles that infer your characteristics.

US-3. No Sale or Sharing of Personal Information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising (targeted advertising). We do not show targeted advertising in the Service. We have not sold or shared personal information in the past 12 months, including that of consumers under 16. We use sensitive personal information only to provide the Service you request, keep it safe, and as otherwise permitted by law, and not to infer characteristics about you.

US-4. Retention

We keep each category of personal information for the periods described in Section 3 and Section 2-(3)-5: in general, until you delete your account (or, for health app data, until you delete the record in I Did It or delete your account), plus up to 1 year for misuse-prevention records.

US-5. Your Rights

You have the right to:

• Know and access the personal information we have collected about you, including the categories of sources, purposes, and recipients, and receive a copy in a portable format
• Correct inaccurate personal information
• Delete your personal information
• Opt out of the sale or sharing of personal information, targeted advertising, and certain profiling (we do not do any of these)
• Not be discriminated against for exercising your rights

You can exercise most of these rights directly in the app (edit your profile, delete posts, delete records in I Did It, or delete your account in Settings). You can also email tididiapp@gmail.com. To protect your account, we will verify your request by confirming it comes from the email or phone number of your account. You may use an authorized agent; we may ask the agent for proof of your written permission and ask you to verify your identity directly. We will respond within 45 days, and may extend this by another 45 days when reasonably necessary, in which case we will tell you.

US-6. Appeals

If we decline to act on your request, you may appeal by emailing tididiapp@gmail.com with the subject line "Privacy Appeal." We will respond to your appeal within 60 days and explain the reasons for our decision. If you are not satisfied with the result, you may contact the Attorney General of your state.

US-7. Do Not Track and Global Privacy Control

We do not track users across third-party websites or apps, and we do not sell or share personal information for targeted advertising, so there is nothing for a "Do Not Track" or Global Privacy Control signal to opt you out of. Google Analytics for Firebase collects usage data on our behalf; we do not allow third parties to collect your personal information across other apps or websites over time for their own purposes. If we ever start such activities, we will treat a Global Privacy Control signal as a valid opt-out request.

US-8. California "Shine the Light"

We do not disclose personal information to third parties for their own direct marketing purposes.

US-9. Consumer Health Data

Our Consumer Health Data Privacy Policy explains how we handle consumer health data under the laws of Washington, Nevada, Connecticut, and other states. It is available at https://tididi-db733.web.app/health-data-en.html and at the end of this Privacy Policy.

US-10. Children

The Service is not directed to children, and users who live in the United States must be at least 18. We do not knowingly collect personal information from children under 13. If you believe a child has given us personal information, contact tididiapp@gmail.com and we will delete it.

US-11. Data Security and International Transfers

We protect personal information with the measures in Section 9. Your information is stored and processed by Google in the United States and other countries, and is accessed by the Operator in Korea. If a security breach affects your personal information, we will notify you as required by applicable law.

Additional Provisions for Users in Australia

These provisions apply to users who live in Australia. If they differ from the main text of this Privacy Policy, these provisions prevail for those users. We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

AU-1. Who We Are

The Service is operated by LEE SEUNGHWAN, an individual doing business as "Tididi," located in Nowon-gu, Seoul, Republic of Korea. Contact: tididiapp@gmail.com.

AU-2. What We Collect and Why

The kinds of personal information we collect, how we collect them, and why are described in Section 1 and Section 2. Health information (including running records and data from a health app you connect) is sensitive information; we collect health app data only with your consent, given in the "Health data consent" screen before the connection, and you can still use the Service without connecting a health app.

AU-3. Anonymity and Pseudonymity

You can use the Service under a username of your choice, and you do not need to show your real name to other users. We need your mobile phone number to verify your account and your date of birth to check your age, so we cannot offer accounts that are fully anonymous.

AU-4. Disclosure Overseas

We do not sell personal information. To provide the Service, your personal information is disclosed to and stored by Google (Firebase / Google Cloud Platform), which may store it in the United States and other countries, and it is accessed by the Operator in the Republic of Korea. We take reasonable steps so that these recipients handle your information consistently with the APPs, including using Google's contractual data protection terms.

AU-5. Access and Correction

You can see and correct most of your information directly in the app. You can also ask us for access to, or correction of, the personal information we hold about you by emailing tididiapp@gmail.com. We will respond within 30 days and will not charge you for making a request. If we refuse, we will tell you why and how to complain.

AU-6. Complaints

If you have a complaint about how we handle your personal information, email tididiapp@gmail.com. We will respond within 30 days. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or 1300 363 992.

AU-7. Data Breaches

If a data breach involving your personal information is likely to result in serious harm, we will notify you and the OAIC as required by the Notifiable Data Breaches scheme.

AU-8. Minimum Age and Age Checks

Users who live in Australia must be at least 18. We ask for your date of birth at sign-up to check that you meet the minimum age; we also use it to protect younger users under our policies and for the other purposes in Section 1. If you give us other information so we can confirm your age (for example, during a review of an account restriction), we use it only for that purpose, we will not require a government-issued ID as the only option, and we destroy it once the check is finished, keeping only the result, the method used, and the date.

AU-9. Automated Decisions

We use the date of birth you enter to automatically decide whether you can create an account or change your date of birth. If you think such a decision is wrong, contact tididiapp@gmail.com and a person will review it.

Tididi Consumer Health Data Privacy Policy

Effective date: November 6, 2026

This Consumer Health Data Privacy Policy explains how Tididi handles "consumer health data" as defined in the Washington My Health My Data Act, Nevada Senate Bill 370, the Connecticut Data Privacy Act, and similar laws. It applies to users who live in the United States and supplements the Tididi Privacy Policy (https://tididi-db733.web.app/privacy-en.html).

HD-1. Who We Are

The Service is operated by LEE SEUNGHWAN, an individual doing business as "Tididi," located in Nowon-gu, Seoul, Republic of Korea. Contact: tididiapp@gmail.com.

HD-2. Consumer Health Data We Collect

• Running records you save in the Service: date and time, distance, duration, pace, average heart rate, cadence, calories, and elevation
• Data read from a health app you connect (Health Connect on Android or Apple Health on iPhone), only after you agree on the "Health data consent" screen and allow it in your phone's permission screen: start and end time of running workouts (including treadmill), distance, calories burned, average heart rate during the run, and the name of the app that recorded the workout. On Android, steps are read together with workouts because the permission is required to read workouts, but steps are not stored.
• Running records shown in posts you choose to publish

We do not collect precise location or running routes, sleep, weight, or other health information, and we do not create inferences about your health status.

HD-3. Sources

• You, when you enter or edit a running record or create a post
• The health app you connect (Health Connect or Apple Health), with your consent

HD-4. How We Use Consumer Health Data

• To create running cards and show your runs in I Did It (your running calendar and statistics)
• To show running records in posts you choose to publish
• To keep the Service secure and to comply with law

We do not use consumer health data for advertising or marketing, and we do not use it to make decisions about credit, insurance, employment, or similar matters.

HD-5. Sharing

• We do not sell consumer health data, and we do not share it with third parties or affiliates.
• Google LLC (Firebase / Google Cloud Platform) stores and processes the data on our behalf as our processor (service provider), only to provide the Service.
• Running records in posts you publish are visible to other users as you choose. Imported records are visible only to you until you post them.
• We may disclose consumer health data if required by law, such as in response to a valid legal order.

HD-6. Consent and Withdrawing Consent

We ask for your consent on the "Health data consent" screen before reading any data from a health app. You can withdraw consent at any time in the app (Settings › Health app sync › unlink) and by turning off Tididi's permission in your phone (Android: Health Connect › App permissions › Tididi; iPhone: Health app › Sharing › Apps › Tididi). After you withdraw consent, we stop reading data from the health app. Records already imported stay in your account until you delete them in I Did It or delete your account.

HD-7. Your Rights

You have the right to:

• Confirm whether we collect, share, or sell your consumer health data, and access that data, including a list of all third parties and affiliates with whom we have shared it and their contact information (we do not share it with any third parties or affiliates other than our processor described in HD-5)
• Withdraw your consent
• Delete your consumer health data. You can delete records in I Did It, delete posts, or delete your account in Settings. When you ask us to delete data, we also tell our processor to delete it, and any copies in backup systems are deleted within six months.

To exercise these rights, use the app or email tididiapp@gmail.com. We will verify your request by confirming it comes from the email or phone number of your account, and respond within 45 days (we may extend this once by another 45 days when reasonably necessary and will tell you if we do). There is no charge for up to two requests in a 12-month period.

HD-8. Appeals

If we decline your request, you may appeal by emailing tididiapp@gmail.com with the subject line "Health Data Appeal." We will respond within 45 days and explain our decision. If your appeal is denied, you may contact the Attorney General of your state (for Washington: www.atg.wa.gov/file-complaint).

HD-9. Reviewing and Changing Your Data

You can view and edit your running records in I Did It, or email tididiapp@gmail.com to ask us to change them. Third parties do not collect consumer health data through the Service over time or across other websites or apps.

HD-10. Retention and Security

Consumer health data is kept until you delete the record in I Did It or delete your account, and is then deleted without delay. We protect it with the security measures described in the Privacy Policy, including access controls that let only you read your imported records before you post them.

HD-11. Geofencing

We do not use geofences around places that provide health care services.

HD-12. Changes

If we change this policy, we will post the new version and announce it in the app before it takes effect. If we want to use consumer health data in a new way that requires your consent, we will ask for it first.