Privacy Policy – Badapong 한국어

Effective Date: May 3, 2026  |  Last Updated (effective): October 4, 2026

Browniebase ("we" or the "operator") values the privacy of users of Badapong (the "App") and complies with Korea's Personal Information Protection Act (the "PIPA") and other applicable laws. Badapong can be used anonymously without sign-up and collects only minimal information. Optional social sign-in is available for certain features such as writing reviews. This English version is a translation; if it differs from the Korean version, the Korean version prevails.

1. Information We Collect

1-1. App users

• Anonymous device identifier – A random UUID auto-generated by Supabase on first launch. It does not identify individuals and is unrelated to advertising IDs.
• Account information (optional) – Only if you sign in with Apple, Google or Kakao: your email address (Apple's relay address if "Hide My Email" is used). The name the sign-in provider sends along (your Google account name, Kakao nickname, or your name if you chose to share it with Apple) and a profile photo URL are also stored in the sign-in record, but they are not used in any app screen or feature (the name shown in the app is a nickname you choose). All core features such as viewing forecasts work without signing in.
• Location (optional) – Precise location (latitude/longitude) collected once, only when "Find nearby spots" is used. It is not stored on servers and is discarded immediately. Spot-proximity checks for visit-review notifications are also performed on-device only; coordinates are never transmitted or stored.
• User-generated content (optional) – Spot reviews (text, rating, photos), condition feedback (responses comparing the forecast with what you actually experienced), and facility information reports. Stored only when you submit them.
• User preferences – Display language, preferred activity (snorkeling, scuba, etc.), favorite spots list.
• Map viewport coordinates – Sent to Mapbox to load map tiles (no user identifiers).
• App usage statistics – Usage records such as daily active use (DAU), screen views and button taps, together with app version, device type and OS. Aggregated in PostHog by anonymous device identifier; no names or contact details are included.
• Error records – Error details, app version, device type and OS when the App crashes or an error occurs. Sent to Sentry, configured not to send personally identifying information such as name, email or IP address.
• Meetups and chat (optional) – Meetup listings (title, description, meeting point, time slots), participation records, chat messages and photos, display name, and report/block records. Meetups are available only after social sign-in; chat message content is deleted about 30 days after a meetup ends.
• Push notification token (optional) – Device token (Firebase Cloud Messaging) used to send meetup chat, cancellation and forecast-deterioration alerts. Deleted when notifications are turned off.
• Booking request details (only users who book a partner shop's listing) – The name, phone number, party size and requests you enter when requesting a booking for a partner shop's session or tour in the App. Provided only to that shop (partner account) to confirm the booking and contact you (see 4-1); other participants of the same listing cannot see it. Deleted on the same basis as meetup chat (about 30 days after cancellation or the end of the listing).
• Course requests and messages to a shop (only users who send them) – The name, phone number, preferred date, party size and message you enter when requesting a partner shop's course or messaging the shop in the App. Provided only to that shop (partner account) so it can reply and contact you (see 4-1), and deleted one year after it was sent.
• Inquiries to our official Instagram/Threads accounts (only senders) – The text of DMs and comments received by the official Badapong accounts and the sender's account ID. Used only to classify and reply to inquiries.

1-2. Partners (businesses)

• Partner verification information – Korean businesses: business registration number, representative name, opening date and trade name (used for verification with the Korean National Tax Service), and business address (the location on the business registration certificate — stored privately and not shown in the App). Overseas businesses: country of business registration, local trade name, registration number, representative name, registered address, and an image or PDF of the local business registration document (business registration certificate, business license, sole-proprietor registration, etc.). The operator checks these manually, and the registered address is not shown in the App. Instructor certification and liability insurance policy images, numbers and expiry dates. Used only for verification; other users see only whether a badge is verified. We do not accept copies of identity documents, and partners are asked to mask any personal ID numbers that appear on documents before uploading.
• Shop location – the address and map position where the partner meets customers, entered and edited by the partner in the portal; published in the App and on the web shop page. Partners are asked not to enter a home address.
• Partner public contact (only if the partner turns it on) – A phone number and calling hours that a business-verified partner owner account enters in the partner portal and sets to "public". Within the scope the partner consented to, it is displayed in the Badapong app and on the partner's web shop page, and display stops immediately when the partner turns it off or business verification lapses. Phone-button taps by users are counted per device identifier and provided only to that partner.
• Membership payment records – Order number, amount, payment method type, approval time, receipt link and refund records. Card numbers and other payment details are processed by the payment gateway (Toss Payments); the operator does not store them.
• Conversations with the operator (partners who use it) – Messages and timestamps exchanged in "Contact operator" in the partner portal, and notices sent by the operator such as verification approvals or rejections.
• Auto-fill from materials (optional, partners who use it) – Text and photos (price lists, notices, screenshots) that a partner uploads to create a draft of shop information, a website address and the text of its front page, the draft created from them, and request records (request time, material type, consent time). The draft is not published until the partner reviews it and taps [Save].
• Partner application information (applicants only) – Shop name, contact (phone number or messenger ID) and area of activity entered in the partner application or correction request form on our website. Used only to review applications and inform applicants of the result.
• Sign-up source (only if you create a partner account) – The ad source and campaign name attached to the address when you arrived at the partner introduction page or portal, and when you first arrived. Recorded once on your partner account when you create it, and used only to measure the effectiveness of our partner recruitment ads. It contains no information that identifies you. (Visits to the partner pages are counted only as anonymous totals by date, page and source and do not identify anyone.)

We do NOT collect: financial or unique identifiers such as credit card numbers, resident registration numbers or copies of identity documents. An app user's phone number is kept only when you enter it yourself to request a booking or a course from a partner shop, and only for that request; participants in personal meetups contact each other only through in-app chat. Otherwise, a phone number is kept as a contact only when you submit the partner application on our website. Name and email are collected only if you use optional social sign-in.

2. Purpose of Collection and Use

• Provide underwater visibility grades (A–E) and marine weather forecasts
• Recommend nearby spots based on location (only when location permission is granted)
• Maintain user preferences such as favorites, language and activity
• Analyze usage statistics, diagnose errors and improve quality
• Provide community features such as reviews and facility reports, and moderate inappropriate content
• Validate and improve forecast accuracy — anonymous condition feedback is used for per-spot calibration of the forecast model (de-identified, aggregated/statistical use)
• Provide value-added services by linking to an external tour booking platform (Klook)
• Publish meetup listings, manage participation, provide chat, and take safety measures such as reports and blocks
• Forward booking and course requests to partner shops, and handle complaints and disputes between users and partners
• Measure the effectiveness of partner recruitment ads (sign-up source)
• Verify partner eligibility (business, instructor certification, liability insurance) and review and respond to partner applications
• Process partner membership payments and refunds, and keep records as required by law
• Respond to partner inquiries and send operational notices such as verification results and membership expiry
• Create partner shop information drafts (auto-fill from materials) — only when the partner requests it
• Classify and reply to inquiries sent to our official Instagram/Threads accounts
• Display advertising (Google AdMob banners)
• Provide anonymous statistics at region/spot level (view counts, activity mix, usage patterns by forecast grade, etc.) to business-verified partners (dive shops, surf shops, lodging, etc.) — de-identified aggregates only; small-sample items are excluded

3. Retention Period

As a rule, personal information is destroyed without delay once its purpose has been achieved (Article 21 of the PIPA). Retention periods by item are as follows.

• Anonymous device identifier: destroyed when the App is deleted or upon user request
• Location: used immediately after collection and then discarded (not stored on servers)
• User preferences: until changed by the user
• Account information: deleted upon account deletion (Account Deletion Guide)
• User-generated content: deleted or de-identified upon deletion request or account deletion
• Meetup chat messages: deleted about 30 days after the meetup ends
• Shop booking request details (name, phone number, requests): deleted about 30 days after the listing ends or 30 days after cancellation
• Course requests and messages to a shop: one year from the date sent
• Inquiries to official Instagram/Threads accounts: one year from the date received
• Partner verification information and supporting documents (business documents, certification and insurance images, etc.): one year after verification expires or the partnership ends
• Partner application information: one year after the review is completed
• Sign-up source: until the partner account is deleted
• Business address and shop location: until the partner account is deleted
• Partner conversations with the operator: three years after the last message (kept in the same way as records of consumer complaints and dispute resolution)
• Auto-fill from materials: uploaded photos are deleted as soon as the draft is created. Pasted text and website text are not stored. Only if automatic processing fails, the photos and a copy of the text with phone numbers, account numbers and email addresses masked are kept until staff create the draft, and are deleted within 30 days at most. Drafts and request records are kept for one year.

Retention required by law: Where relevant laws require it, the following records are kept for the periods below, and are kept separately until the end of that period even if a partner account is deleted.

• Records of payment and supply of goods or services (partner membership payments and refunds): 5 years — Act on the Consumer Protection in Electronic Commerce
• Records of consumer complaints or dispute resolution: 3 years — same Act
• Transaction evidence such as tax invoices and receipts: 5 years — Framework Act on National Taxes

4. Provision to Third Parties, Entrustment and Overseas Transfer

The operator does not sell user information to third parties or share it for marketing purposes.

4-1. Provision to third parties (Article 17 of the PIPA)

Overseas partner shops: When a user books with or sends a request to a shop located outside Korea (e.g. Japan, Indonesia, Thailand, the Philippines, Guam, Saipan), the information above is delivered to the shop in that country (provision of personal information overseas). In this case, the booking or request screen informs you of the country, shop name, contact details, purpose and retention period, and obtains your separate consent (Article 28-8(1)(1) of the PIPA). If you do not consent, you cannot book with or send a request to that shop through the App; there is no other disadvantage.

Partner statistics: We may provide business-verified partners with aggregated, anonymous statistics at region/spot level (viewers per period, activity mix, favorite/directions rates by forecast grade, distribution of when forecasts are checked, etc.). These statistics contain no user identifiers (account, device identifier, location, contact details), and any item with a small sample (fewer than 5 users) that could reveal a specific individual is not provided. This is a disclosure of de-identified statistics, not a provision of personal information to a third party.

4-2. Entrustment of processing (Article 26 of the PIPA)

We entrust the processing of personal information to the following companies to operate the service.

We also use the following services.

• National Tax Service business registration status check – For Korean partner verification only; only the business registration number, representative name and opening date are sent for verification.
• Open-Meteo / ECMWF / NOAA – Marine and weather forecast data sources. No user information is sent; only grid coordinates (lat/lon) are used.
• Klook Travel Technology Limited – Dive and snorkel tour booking platform. When a user taps a "Book" button in the App, they are taken to the Klook website, from which point Klook's privacy policy applies. Badapong does not share user information directly with Klook. (Klook Privacy Policy)
• Apple · Google · Kakao – Social sign-in. If the user chooses to sign in, we receive the email address and display name from that company.

4-3. Overseas transfer of personal information (Article 28-8 of the PIPA)

Pursuant to Article 28-8 of the Personal Information Protection Act, personal information is processed and stored overseas as follows, as necessary to perform the contract for providing the service. Transfers take place over encrypted connections (HTTPS) when each feature is used.

5. Location Data Handling

When you use "Find nearby spots", the App collects your precise location once. It is used for the single purpose of sorting nearby dive spots by distance, is never stored on servers, and is discarded from device memory immediately after use. Location permission can be revoked at any time in system settings, and all forecast features work normally without it.

6. Camera and Photo Handling

The App requests camera or gallery access only when you attach photos to a spot review. Uploaded review photos are stored as content visible to other users, and are deleted together with the review or upon account deletion. Without this permission you can still write reviews without photos and use all forecast features.

7. External Payments and Affiliate Links

Badapong provides links to an external tour booking platform (Klook). If a user follows such a link and completes a booking, the operator may receive a commission. This does not impose any additional cost on the user, and Klook's payment and refund policies apply. No payments take place within the Badapong app. Partner memberships are paid through Toss Payments in the web partner portal.

8. Advertising

Badapong displays Google AdMob banner ads at the bottom of the home screen and spot detail screens. The advertising identifier is processed by Google, and personalized ads can be turned off in your device's ad settings. The operator does not sell user information to third parties for advertising purposes.

9. Security Measures

• All network communications are encrypted via HTTPS (TLS)
• Anonymous authentication tokens are stored in secure device storage
• Location data is used in memory only and discarded immediately (never stored on servers)
• Partner verification documents are kept in private storage that only the partner and the operator can open
• Booking and request contact details are access-restricted so that only the relevant partner account can view them
• We never collect passwords (social sign-in only)

Phishing warning: Badapong never sends links by email, text or messenger asking you to sign in or to enter a password, payment or refund details. If you receive such a message, do not click the link and let us know at support@browniebase.com.

10. User Rights

You may exercise the following rights at any time:

• Revoke location permission (system settings)
• Delete all anonymous data by uninstalling the App
• Delete your account information and content through in-app account deletion (Account Deletion Guide)
• Request access to, correction or deletion of, or suspension of processing of your personal information (Articles 35 to 37 of the PIPA; by email) — however, records under "Retention required by law" in section 3 cannot be deleted during the applicable period

When the App is deleted, the anonymous user_id and related settings stored on Supabase servers are destroyed upon user request or automatically after a period of inactivity.

11. Children's Privacy

The App is not intended for children under 14 years of age. Diving, snorkeling and similar activities should, for safety reasons, be done by qualified adults or with a guardian present.

12. Privacy Officer and Contact (Article 31 of the PIPA)

For privacy-related inquiries or complaints, please contact:
Privacy officer: Representative (name and phone number are as shown in the business information below)
Email: support@browniebase.com

13. Changes to This Policy

This policy may be amended to reflect changes in law or the service. Material changes will be announced in the App or on this page from 7 days before they take effect.