Stelleaf Privacy Policy

20 September 2026

Stelleaf by SSAMOK SOFT stores records and photos on your device first.

1. Controller information

The following sole proprietorship processes personal data as the controller (within the meaning of the GDPR).

• Business name: SSAMOK SOFT
• Owner: Dae-hoon Kang
• Privacy officer: Dae-hoon Kang
• Contact: ssamoksoft@gmail.com

2. Local-first design

Stelleaf by SSAMOK SOFT stores records and photos on your device first. Account sign-in and cloud backup/sync are optional. Maps, search, cover images and subscription checks can nevertheless contact external services before sign-in. Local-first does not mean that no information leaves the device.

3. Data we collect

We process the following data according to the features you use. Signed-in account backups and sync data use Supabase's primary storage in Seoul, South Korea.

• Account: email address, internal user ID, and sign-in provider identifier — you choose one of email+password, Google sign-in, or Apple sign-in (authentication infrastructure: Supabase Auth)
• Content: categories, item names/notes/barcodes/selected location coordinates, ratings, dates, detailed scores, context tags, tags, ranking boards, analysis settings, photos and creation/modification times
• Subscriptions: RevenueCat receives a random anonymous app ID before sign-in and the internal user ID after sign-in, plus subscription status, receipts or purchase tokens, and app/device information. We do not receive payment card numbers.
• Maps: Naver is preferred in South Korea; Google Maps is used elsewhere or when Naver is unavailable. Map requests, the viewed area, IP and SDK device information may be processed. The device's current location is requested when you allow permission and use the current-location feature.
• Search/images: queries, coordinates, barcodes and ISBNs are processed. Naver place, Kakao book and MFDS food searches pass through Supabase functions. The app can directly contact Open Food Facts, Open Beauty Facts, OpenLibrary and image providers. Connections also disclose IP/technical information. Signed-in server requests contain account authentication; our search proxy does not forward that authentication to search providers.

4. Photos and location data

Attached photos are re-encoded on-device; copies without EXIF, including GPS, are stored and backed up. On supported devices, original GPS can be used temporarily for a location suggestion. Only coordinates you select from a suggestion or confirm on the map are saved to a record. Cloud photos are limited to 200 for free accounts, with no photo-count limit for Stelleaf Premium. The app imposes no local photo-count limit.

5. Purposes and legal bases

The purposes and legal bases (GDPR Article 6) for each processing activity are:

• Account management, backup, and cross-device sync — performance of a contract (GDPR 6(1)(b))
• Payment and management of the paid subscription — performance of a contract (GDPR 6(1)(b))
• Compliance with legal obligations (e.g. retention of payment records) — legal obligation (GDPR 6(1)(c))
• There is currently no processing based on separate consent

6. Processors and recipients

We use the following processors and recipients to provide the service.

• Supabase — primary account, database and photo storage in Seoul, South Korea; search, deletion and subscription-check functions may run in global regions near the requester
• Naver Cloud — maps and place search (Republic of Korea)
• Kakao — book search and Daum SMTP delivery of sign-up confirmation/password recovery emails, processing recipient addresses and email content such as verification links (South Korea)
• Korean Ministry of Food and Drug Safety — food barcode lookup (Republic of Korea, via server proxy)
• RevenueCat — subscription management (United States)
• Apple — sign-in and payments (United States)
• Google — sign-in, payments, and maps (United States)
• Open Food Facts, Open Beauty Facts, OpenLibrary and image providers — barcode, ISBN and image requests, plus connection information such as IP addresses

7. International transfers

Locating the primary database and photo storage in Seoul does not restrict all processing to South Korea. Information needed for the online features below is transmitted over encrypted connections. International processing needed to provide services uses the providers' data processing terms and applicable transfer safeguards. You may stop using the relevant online feature or contact ssamoksoft@gmail.com to object; this may prevent use of that feature.

• Supabase (Singapore entity) — account authentication, search requests and user IDs for deletion/subscription checks; global function processing outside primary Seoul storage is possible. Regions/subprocessors: https://supabase.com/docs/guides/functions/regional-invocation and https://supabase.com/legal/customer-resources/subprocessor-list . Account retention follows section 8; operational logs follow provider terms.
• RevenueCat (United States) — anonymous/account app IDs, purchase and device information for subscription management. On account deletion we request erasure of the linked customer; processing is asynchronous. https://www.revenuecat.com/privacy
• Apple and Google (United States and global facilities) — identifiers/transactions for the sign-in or payment feature you choose; map requests, IP/device information for Google Maps. Processing lasts as needed for those services and legal duties. https://www.apple.com/legal/privacy/ and https://policies.google.com/privacy
• Open Food Facts, Open Beauty Facts, OpenLibrary and image providers — direct requests disclose barcodes, ISBNs, image addresses and connection/IP information to overseas servers for search, content delivery and operational logs. https://world.openfoodfacts.org/privacy and https://archive.org/about/terms.php

8. Retention and deletion

We retain and delete personal data as follows.

• Account deletion: we remove server photos, request erasure of the linked RevenueCat customer, then delete the account and database records. These are sequential operations across systems, not one atomic deletion. Failed steps require retry; the app clears the selected device data only after server confirmation. RevenueCat processes erasure asynchronously. Store subscriptions and statutory transaction records are separate.
• Individual deletion: once synced, daily server cleanup clears content (names, notes, scores, locations, etc.) more than 30 days after the recorded deletion time. Deleted rows retaining IDs, relationships and timestamps needed for sync are removed by daily cleanup after 365 days. Server photo files are cleaned separately during app sync and may be delayed by offline use or failure. These periods do not automatically erase deleted records on your device.
• Deletion confirmation: request/user IDs and timestamps used to recover lost responses or retries are removed by daily cleanup more than 30 days after completion. Incomplete requests remain so processing can resume.
• Statutory retention: under the Korean e-commerce act and related laws, records of contracts and withdrawals are kept 5 years, payment and supply records 5 years, and consumer complaint/dispute records 3 years, then destroyed

9. Your rights

You may request access, rectification, erasure, restriction and portability. Settings > Data > Export records creates a ZIP of records and photos actually held on this device; it does not fetch every photo held only in the cloud or on another device. Contact ssamoksoft@gmail.com; we normally respond within one month. Complex requests may take two additional months, with reasons notified within the first month (GDPR Art. 12(3)). EU/UK users may also contact the representative in section 10.

• The file includes this device's categories, items, ratings, tags, boards, analysis settings and timestamps, plus non-deleted photo files actually present on the device.
• It also contains records that are marked for deletion but not yet fully purged — the export reads the data stored on this device, so a record whose content has already been erased on the server may still be included if it remains on this device
• A file exported while signed in records your account identifier (UUID)
• The export file is not encrypted — take care not to share it with others
• Complaints: EU residents may lodge a complaint with their national supervisory authority; in Korea, with the Privacy Infringement Report Centre (privacy.kr, 118)

10. EU & UK representative

For users in the EU/EEA and the United Kingdom, we have appointed representatives pursuant to Article 27 of the EU GDPR and Article 27 of the UK GDPR. EU representative: Prighter EU Rep GmbH, Schellinggasse 3/10, 1010 Vienna, Austria. UK representative: Prighter Ltd, 20 Mortlake High Street, London, SW14 8JN, United Kingdom. You can contact our representatives and exercise your rights via https://app.prighter.com/portal/19708232400.

11. Children

Stelleaf may only be used by people aged 14 or older (in some EU countries, the applicable consent age of up to 16). We do not knowingly collect personal data from children below these ages, and we delete such data without delay if we become aware of it.

12. What we do not do

Stelleaf does not do any of the following.

• No ads, and no collection of advertising identifiers
• No selling of personal data
• Advertising profiling or automated decisions with legal or similarly significant effects — personal taste statistics are calculated on-device
• No marketing messages
• No intentional collection of data from children under 14

13. Security

We use HTTPS/TLS, account-based access control, limited permissions and private photo storage. Secret search and administration keys stay on the server. Public map SDK keys use provider safeguards such as app restrictions.

14. Changes to this policy

If this policy changes, we will post the update on this page, and material changes will also be announced in the app. The revised policy takes effect when posted.

Stelleaf · 2026-10-10