Privacy Policy

Effective August 13, 2026

This policy explains what personal information Kayty (“we”, “us”) collects when you use kayty.kr (the “Service”), how we use it, and the choices you have. We keep it short on purpose — if anything is unclear, contact us at kayty.dev@gmail.com.

1. What we collect

• Account. Email address, nickname, and password (stored only as a cryptographic hash). If you sign in with Google, we receive your email, name, and Google account ID instead of a password. Optionally, a profile photo you upload.
• Skin profile (optional). Information you choose to add in My Skin Info — skin concerns, skin type, goals, ingredients or products you avoid, routine notes, and country. You can edit or remove these at any time.
• Content and activity. Routines you create, saves, reactions, votes, poll answers, comments, and takes.
• Usage data. Which content you view, save, share, or click through to buy, and what you search for. This is linked to a random session identifier (cookie) and, while you are signed in, to your account. We use it internally for statistics and personalization; it is never published or shared in a form that identifies you. Your IP address is used transiently to derive your country and for security; we do not store raw IP addresses with your profile.
• Technical data. Basic device/browser information and error reports (via Sentry) so we can fix problems. Error reports are configured to exclude personal data.

2. How we use it

• Operate the Service — accounts, sign-in, showing your content, saved items, and notifications.
• Personalize — for example, matching polls or debates to the concerns in your profile.
• Email you — sign-in and password-reset codes, and occasional service notifications (for example, when a poll you voted in closes). You can turn notification emails off in the My page; codes cannot be turned off because signing in depends on them.
• Keep the Service safe — moderation, abuse and fraud prevention, rate limiting.
• Understand usage in aggregate to improve the Service.

We do not sell your personal information, and we do not share it for targeted advertising. Where laws such as the GDPR apply, we process your data to provide the Service you signed up for, with your consent (optional profile fields, analytics cookies), and for our legitimate interests in keeping the Service safe and improving it.

3. Cookies and similar storage

Analytics (optional). Google Analytics and Microsoft Clarity (which captures how pages are used, including heatmaps and session replays) load only if you choose “Accept” in the cookie banner. Declining does not limit the Service. To change your choice at any time, use Cookie preferences (also available at the bottom of My page). The kayty_sid cookie powers our own first-party statistics only; it is set regardless of your banner choice and is never shared with third parties.

4. Who we share it with

We share personal information only with service providers that help us run Kayty:

• Amazon Web Services — hosting and storage (servers in Seoul, Republic of Korea), and email delivery (verification codes and service notifications).
• Vercel (US) — serving the website.
• Google (US) — sign-in with Google; Google Analytics only with your consent.
• Microsoft Clarity (US) — usage analytics including session replay, only with your consent.
• Sentry (US) — error monitoring (configured not to collect personal data).
• Anthropic (US) — AI processing for AI-assisted features. We do not send your name, email, or account identity to the AI provider.

Providers marked (US) process data in the United States for the purposes shown above, for as long as needed for those purposes. Where required, these transfers rely on recognized safeguards such as the EU–U.S. Data Privacy Framework or standard contractual clauses. We may also disclose information if required by law, and if Kayty is part of a merger, acquisition, or asset sale, your information may be transferred with it — this policy would continue to apply.

5. How long we keep it

• Account and profile data — until you delete your account.
• Usage events and search logs — raw logs are deleted after about 90 days; only aggregate statistics remain.
• Verification codes — up to 60 minutes. Session (refresh) tokens — up to 30 days.

When you delete your account, your personal data is erased or irreversibly anonymized, and your published routines are switched to private. Comments and takes you chose not to delete beforehand may remain in de-identified form, no longer linked to you. Remixes other users made from your public routines keep the routine content, but your author attribution is removed.

6. Your choices and rights

• View and edit your profile, skin info, and content directly in the My page.
• Delete individual comments, takes, or routines — or your whole account — at any time.
• Turn notification emails off in the My page.
• Decline (or never grant) analytics cookies.
• Depending on where you live, you may also have rights to access, correct, delete, or receive a copy of your data, or to object to certain processing. Email us and we will respond within a reasonable time. If you are in the EEA or UK, you can also lodge a complaint with your local data-protection authority.

7. Children

Kayty is not directed to children under 14 (or the higher minimum age that applies where you live), and we do not knowingly collect personal information from them. If you believe a child has an account, contact us and we will delete it.

8. Security

We protect your data with encryption in transit (HTTPS), hashed passwords, httpOnly session cookies, and access controls. No online service can guarantee absolute security, but we work to keep risks low and will notify you as required by law if a breach affects you.

9. Changes and contact

We may update this policy as the Service evolves; material changes will be announced on the Service. Continued use after a change means the updated policy applies. Questions, requests, and our privacy officer can be reached at kayty.dev@gmail.com. See also our Terms of Service.