MomentBook Privacy Policy

1. Controller and Scope

MomentBook is operated by Hansol Yoon. Questions, rights requests, or legal notices may be sent to support@momentbook.app.

This policy applies to account creation, app usage, content upload, public journey publishing, support communications, and operation of the public web surfaces controlled by MomentBook.

2. Categories of Data We Process

• Account and authentication data, such as name, email address, login provider, provider identifiers, verification information, and consent status.
• Profile data, such as biography, profile image, and information you provide in support or rights-request communications.
• Journey content and metadata, such as uploaded photos, thumbnails, titles, descriptions, impressions, photo identifiers, timestamps, local-time context, location coordinates or labels, review status, and localized translations generated for supported locales.
• Public sharing data, such as public URL, public ID, published date, public page metadata, and author display information for journeys you choose to publish.
• Device and web usage data, such as IP address, browser or device information, app or server logs, performance information, language preference cookies, and production analytics or web-vitals events when public-web analytics are enabled.
• Marketing and notification data, such as email preferences, push preferences, and device tokens where you opt in or enable notifications.

3. Why We Use Data and Legal Bases

We use data to create and secure accounts, provide the Service, display private and public journey timelines, operate moderation and safety review, respond to complaints, enforce rights, troubleshoot bugs, localize public text, improve performance, and communicate with users.

We may also use data to send operational notices and, where you opt in or another lawful basis applies, marketing messages.

Depending on your jurisdiction, we rely on one or more of the following legal bases: performance of a contract, consent, legitimate interests, compliance with legal obligations, protection of vital interests, and establishment, exercise, or defense of legal claims.

4. Public Content, Search Engines, and Analytics

Publishing a journey makes selected content public on MomentBook web pages.

At present, public home, FAQ, guides, journey archive, and individual journey pages are configured for index and follow by search engines. Individual photo pages, legal pages, and support pages are configured as noindex and nofollow.

Once a public page is crawled, search engines and other third parties may retain copies, previews, cached versions, or links outside our control.

When enabled in production, the public web may send page-view and performance events to analytics providers such as Google Analytics, and the site may store a language-preference cookie to keep your route language consistent. See our Cookie Policy for details.

5. Sharing and International Transfers

We share data only as needed with service providers, hosting and infrastructure providers, analytics providers, authentication or platform partners, moderation tools, advisors, and authorities where disclosure is reasonably necessary or legally required.

Because MomentBook operates internationally, data may be processed in the Republic of Korea and in other countries where our providers operate. Where applicable law requires it, we use transfer mechanisms and safeguards recognized by that law.

A current list of our key service providers is maintained in our Sub-processor Disclosure below.

• Hosting & Infrastructure: Vercel Inc. (US), Amazon Web Services (various regions)
• Analytics: Google LLC (US) — Google Analytics, when enabled
• Authentication: Apple Inc. (US), Google LLC (US) — sign-in providers
• Email & Notifications: As configured with your device or provider

6. Data Retention

We keep account and profile data while your account is active and for a limited period afterwards as needed for security, backups, complaint handling, legal obligations, dispute resolution, or fraud prevention.

We keep public-content records until you delete or unpublish them, subject to backup retention, rights complaints, safety investigations, and legal hold requirements.

Specific retention periods by data category:

• Account data: Active account duration + 90 days after deletion
• Journey content: Until deletion or unpublishing by user + 30 days backup
• Server logs: 90 days (rolling)
• Analytics data: As governed by the analytics provider's retention settings (typically 14-26 months)
• Support communications: 3 years after resolution

7. Data Security and Breach Notification

We use reasonable technical and organizational measures designed to protect data, including transport encryption (TLS), access controls, need-to-know access, and review controls. No system is perfectly secure.

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify affected users and relevant supervisory authorities without undue delay and, where feasible, within 72 hours of becoming aware of the breach, in accordance with applicable law.

8. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

You may also ask us to stop public display of content when you have a valid privacy, portrait, publicity, safety, or other legal basis.

To exercise these rights, contact support@momentbook.app. We may request information reasonably necessary to verify identity or authority. We will respond within the timeframe required by applicable law (generally 30 days, extendable by a further 60 days for complex requests).

You also have the right to lodge a complaint with your local data-protection supervisory authority. See our Jurisdictional Supplements for authority contact information by region.

• Right of access — request a copy of your personal data
• Right to rectification — correct inaccurate or incomplete data
• Right to erasure — request deletion of your data ("right to be forgotten")
• Right to restriction — limit how we process your data
• Right to data portability — receive your data in a structured, commonly used format
• Right to object — object to processing based on legitimate interests
• Right to withdraw consent — withdraw previously given consent at any time
• Rights related to automated decision-making — request human review of automated decisions

9. Children's Privacy

MomentBook is not intended to collect or publicly display personal data of children where parent or guardian authorization is required but has not been obtained.

The minimum age to use MomentBook without parental consent varies by jurisdiction. In most regions, you must be at least 13 years old (or 16 in certain EEA countries). If you are under the applicable age, do not create an account or publish content without verified parental consent.

If we learn that a child used the Service or published content without the consent required by applicable law, we may suspend accounts, remove public content, and delete relevant data.

10. Updates to This Policy

We may update this Policy to reflect legal, technical, or product changes. The updated version date will be posted here. For material changes, we will provide notice at least 14 days before the change takes effect. If required by law, we will obtain your consent before applying changes retroactively.

If you believe your privacy or personality rights were violated by public content, contact support@momentbook.app with the URL, the basis of complaint, and supporting details.