Privacy Policy

1. Photos and What You Type (Key Points)

• Building an ideal type: the options you pick, the text you type and any sketch you draw are sent to OpenAI to generate the image. OpenAI does not use them for training and keeps them for up to 30 days to detect abuse, then deletes them.
• Delivering the result photo: a copy is held briefly on the Company’s servers so that a photo still being made when you close or reload the page is waiting for you when you come back. This delivery copy is deleted as soon as your browser has it, and within 24 hours at the latest.
• Record of what you make: the result photo, the options you picked, the text you typed, any sketch you drew, the instructions sent to the AI, and whether the photo was made, refused or failed are kept in a private store. For 180 days from making it, the record is tied to your credit wallet so that we can check what was made when handling refunds and inquiries. After 180 days we remove the tie to the wallet and keep only the month it was made (pseudonymization); from then on we do not look up whose it is, and the record is used only for research to improve the Service (checking and fixing whether photos come out as picked), as Article 28-2 of the Personal Information Protection Act allows. We never publish or sell it.
• We do not build any facial-recognition or biometric database.

2. Information We Process and Why

• Credit wallet: a randomly generated wallet ID (cookie), your credit balance and usage history (when, where and how many credits were used), the email you entered at payment, and recovery-link records — to provide credits and restore them on another device
• Payments: email, wallet ID, payment and invoice numbers, amount and time of payment, the record of your pre-payment consent, and, if you came through an ad link, the tag on that link (e.g. tiktok) — to confirm payments, add credits, give refunds, keep legally required records and see which ads lead to purchases. Card details are handled by Dodo Payments; the Company never receives them.
• Disputed payments: if a payment is disputed with your card company (a chargeback), its email and wallet ID — to stop further purchases from that email or wallet (fraud prevention).
• Inquiries (web form and email): email, the content of your message, wallet ID (to check credit issues) — to reply
• Building an ideal type: the options you pick, the text you type, any sketch you draw, the instructions sent to the AI, the result photo, whether it was made, refused or failed, and a one-way code made from your wallet ID — to make and deliver the photo, handle refunds and inquiries, and improve the Service
• Phone app: an app user ID tied to your credit wallet; a random restore key kept on your phone (iPhone Keychain or Android app backup), of which our servers keep only a one-way code; App Store or Google Play purchase records (transaction number, product, time, price and currency, country); and photo reports you send (reason, note, the time the photo was made, phone type; no picture) — to give your credits back after you reinstall the app, add bought credits and remove refunded ones, and review reports. Photos in the app’s “My photos” stay only on your phone.
• Collected automatically: IP address, access logs, device and browser information — to block excessive requests and to run and secure the Service. If you arrive through an ad link, its tag is kept only on this device (browser storage) for 30 days and sent along with a payment; visits are counted only as daily totals per tag, without recording who visited.

3. Retention and Deletion

• Payment and order records: 7 years from payment
• Disputed-payment records (email, wallet ID): 7 years from the dispute
• Inquiries (web form and email): 3 years from receipt
• Credit wallet (including usage history and recovery-link records): 5 years from last use, or until you ask us to delete it (payment records are kept for the period above)
• Result photos held for delivery: until your browser receives them, 24 hours at most
• Record of what you make (result photo, options, text, sketch, instructions sent to the AI): tied to your credit wallet for 180 days from making; then pseudonymized as described in section 1 and kept for research to improve the Service for up to 5 years from making
• Phone app: app user ID and restore-key codes as long as the credit wallet; store purchase records 7 years from purchase; photo reports 3 years from receipt
• IP addresses and emails used for request limits: kept only in server memory and gone when the server restarts. Hosting access logs are kept for up to 1 day.

Retention required by law: under Article 6 of the E-Commerce Act and Article 6 of its Enforcement Decree, records of contracts and withdrawals and of payments and supply are kept for 5 years and records of complaints and disputes for 3 years; under Article 85-3 of the Framework Act on National Taxes, transaction books and evidence are kept for 5 years. Payment and order records are kept for 7 years, longer than those 5 years, because national tax can be assessed for 7 years in some cases, such as when no return was filed (Article 26-2 of the same Act).

How we delete: information whose retention period has ended or whose purpose has been fulfilled is deleted from the database and file storage without delay so that it cannot be recovered. We keep no paper records.

4. Processors and Transfers Abroad

To provide the Service (to perform our contract with you), we entrust processing to the companies below (Article 28-8(1)(3)(a) of the Personal Information Protection Act). Information is sent over encrypted internet connections (HTTPS) when you use the related feature, and, unless the company sets its own period, is kept until the processing contract ends.

• OpenAI, LLC (US · privacy@openai.com) — options you pick, text you type, sketches — generating ideal-type photos — deleted after up to 30 days
• Dodo Payments Inc. and its group companies (US · privacy@dodopayments.com) — email, wallet ID, payment details, pre-payment consent record — payment processing, receipts and refunds as merchant of record
• RevenueCat, Inc. (US · compliance@revenuecat.com) — app user ID, App Store and Google Play purchase records — processing purchases made in the phone app — until we stop using the service. The payment itself is made to Apple or Google under their own privacy policies, and we never receive your card details.
• Plus Five Five, Inc. (Resend) (US · support@resend.com) — email address, credit-recovery link — sending recovery emails
• ImprovMX Incorporated (US · support@improvmx.com) — emails sent to the Company’s address (sender address, content) — forwarding them to the Company’s Gmail mailbox
• Google LLC (Gmail) (US and other countries where Google has facilities · support.google.com/policies/contact/general_privacy_form) — inquiries by web form and email, and our replies (email address, content) — the Company’s mailbox — the inquiry period in section 3
• Vercel Inc. (US · privacy@vercel.com) — IP address, access logs, request content — hosting the Service — up to 1 day
• Vercel Inc. (US · privacy@vercel.com) — page path, ad-link tag, referring site, country or region, browser, operating system and device type (no cookies) — visit statistics (Vercel Web Analytics) — kept as totals for 12 months
• Supabase Pte. Ltd. (Singapore company; data stored in the US (Virginia) · privacy@supabase.com) — wallets, payment and order records, inquiries, what you make (result photos, options, text, sketches, instructions sent to the AI) and result photos held for delivery (up to 24 hours) — database and file storage — the periods in section 3

If you do not want your information transferred abroad, do not use the related features (building an ideal type, payment, recovery email, email inquiries), or ask fortressofko@kortress.com to stop processing what you already sent. These features cannot work without the transfer.

We do not provide personal information to third parties except where the law requires it or you have agreed.

5. Cookies and Browser Storage

• __Host-mytype_wallet cookie: your wallet ID, needed to use credits on this device
• mytype_app_key cookie (phone app only): the restore key, sent only to the address that restores your wallet
• mytype.locale cookie: the language you chose
• Browser storage: the options you picked and the builder step you were on (until you clear them), the last photo you made (until you make the next one), the ID of a photo still being made (until it arrives, at most a day), and payment-check state — kept only on this device. Clearing the site’s data in your browser removes them.
• Visit statistics (Vercel Web Analytics): counts page views without cookies and stores nothing on your device. Vercel receives only the page path (without payment numbers or other values in the address), the ad-link tag, the site you came from, your country or region, and your browser, operating system and device type. A visit is told apart by a code made from the request, which Vercel discards after 24 hours; the statistics are kept only as totals that cannot identify you.
• We do not use advertising or tracking cookies. You can block cookies in your browser settings, but then credits cannot be used on this device.

6. Children Under 14

The Service is for people aged 14 or older, and we do not knowingly collect information from children under 14. If we learn that we have, we delete it right away.

7. Rights of Users and Legal Guardians

You and your legal guardian may at any time ask to access, correct, delete or stop the processing of your personal information, or withdraw consent. Email fortressofko@kortress.com and we will tell you the outcome within 10 days; if you disagree with it, you can object the same way. You may also make a request through a representative. Payment records the law requires us to keep cannot be deleted during the retention period. Records of what you make can be found and deleted on request while they are tied to your wallet (180 days from making). After they are pseudonymized we no longer look up whose they are, so please ask within those 180 days.

8. Security Measures

• Encryption in transit (HTTPS) and at rest (Supabase’s AES-256 storage encryption)
• The database is reached only with a server-side key; direct outside access is blocked (row-level security)
• Access keys and passwords are kept in server environment variables, never in code
• Records of what you make are kept in a private store that only the server key can open, tied to your wallet only through a one-way code that is removed after 180 days; we collect only what we need

9. Privacy Officer

Jungbeom Ko (Representative) · fortressofko@kortress.com

10. Remedies

For help with a privacy violation, you can contact:

• Personal Information Infringement Report Center (privacy.kisa.or.kr, 118)
• Personal Information Dispute Mediation Committee (www.kopico.go.kr, 1833-6972)
• Supreme Prosecutors’ Office, Cybercrime Investigation (www.spo.go.kr, 1301)
• Korean National Police Agency, Cyber Bureau (ecrm.police.go.kr, 182)

11. Changes to This Policy

This policy applies from October 21, 2026. If it changes, we will post a notice on this page at least 7 days before the change takes effect.