Privacy Policy
Effective date: October 30, 2026
In accordance with the Personal Information Protection Act and other applicable laws of the Republic of Korea, molio (the “Company”) establishes and discloses this Privacy Policy as follows in order to protect data subjects’ personal information and to handle related grievances smoothly.
Article 1 (Purposes of Processing Personal Information)
The Company processes personal information for the following purposes, and if a purpose changes, it takes the measures required by the Personal Information Protection Act.
- Member management: identifying Members and verifying identity, verifying age, managing accounts, preventing fraudulent use, and giving notices and notifications
- Providing the Service: automatically organizing photos and building the travel map, granting badges and titles, travel plans and expense settlement, messages between Members, translating Posts, and sending notifications
- Providing personalized content: adjusting the order in which Posts appear in the feed and elsewhere
- Operating the Flyver program: reviewing applications and contacting applicants, calculating and paying earnings, and withholding tax and submitting payment statements
- Improving the Service: analyzing usage statistics, analyzing how users find the Service and measuring the effect of invitations and shares, opening the shared screen right after the app is installed, analyzing errors, and developing new features
- Marketing and advertising: sending advertising information such as events (only to Members who have consented to receive it), and measuring advertising performance
- Fulfilling legal obligations and responding to disputes
Article 2 (Items of Personal Information Processed)
(1) The Company processes the following personal information.
| Category | Items processed |
|---|---|
| Sign-up (required) | Email address, password, date of birth, and, for social login, the identifier and profile information provided (nickname, profile image, etc.) |
| Profile (optional) | Display name, username, bio, profile and cover images, links, gender, region of residence, language, travel interests and places you want to visit |
| Posts | Photos and videos and the metadata they contain (capture location, capture date and time, device information, etc.), audio in videos, text and comments |
| Travel plans | The title, dates, cities, places, notes and photos of a plan, the list of companions, and expense records and participant names for settlement (including the names of companions who do not use the app) |
| Messages | The contents of messages between Members and records of sending and receiving |
| Flyver (participating Members) | Region of activity, field, introduction, channel address (optional), records of consent to the terms, and, for paying earnings, the account holder, bank, account number and resident registration number (alien registration number for foreign nationals), and payment history |
| Automatically generated or collected information | Service usage records, access logs, IP address, device identifier (a per-browser identifier on the web version), device, operating system and browser information, push notification token (browser push subscription information on the web version), notification and marketing preferences, content impression and view records, link usage records, sign-up source (referring link and campaign), share and invitation link open records, and cookies |
(2) The Company processes Flyvers’ resident registration numbers only where the Income Tax Act or other applicable laws require it (Article 24-2 of the Personal Information Protection Act) and does not use them for any other purpose.
(3) Where needed to provide a feature, the Service requests access to the device’s photos (album), camera, location and notifications. The web version requests location and other necessary permissions through the browser, reads only the photo and video files the Member chooses, and reads the capture location, date and time and similar data of photos in the Member’s browser before uploading. All permissions are optional, and even if you do not allow them, you can use the Service other than the relevant feature.
(4) The Company collects information that Members enter or upload themselves when signing up or using the Service, information received from social login providers, and information generated automatically in the course of using the Service.
Article 3 (Processing and Retention Periods)
(1) The Company destroys personal information without delay once the purpose of processing has been achieved or the Member withdraws. However, the following information is retained for the periods stated.
| Item | Retention period | Basis |
|---|---|---|
| Service usage records and access logs | 3 months | Protection of Communications Secrets Act |
| Identification information of withdrawn Members, to prevent fraudulent sign-up and use | 30 days after withdrawal | Prevention of fraudulent use |
| Content impression records | 90 days after collection | Providing personalized content |
| Link usage records | 3 months after collection | Calculating earnings and preventing fraudulent use |
| Flyver application information | 1 year from the date the review ends | Reviewing re-applications |
| Records relating to the payment of earnings (including resident registration numbers, etc.) | The period prescribed by applicable laws (kept separately even after withdrawal) | Framework Act on National Taxes; Income Tax Act |
(2) The information of a Flyver who still has earnings to be paid is retained until payment is completed.
Article 4 (Personal Information of Children under 14)
The Service does not accept sign-ups from children under 14 years of age, and the Company does not knowingly collect personal information of children under 14. If the Company becomes aware that personal information of a child under 14 has been collected, it destroys that information without delay.
Article 5 (Procedures and Methods for Destroying Personal Information)
(1) The Company destroys personal information without delay once its retention period has expired or the purpose of processing has been achieved. Information retained under applicable laws is stored separately from other information.
(2) Information in electronic files is deleted by methods that make it unrecoverable, and information recorded on paper is shredded or incinerated.
Article 6 (Provision of Personal Information to Third Parties)
(1) The Company does not provide personal information to third parties except in the cases set out in Articles 17 and 18 of the Personal Information Protection Act, such as where the data subject has consented or a law specifically provides for it.
(2) In accordance with applicable laws, the Company submits Flyvers’ payment statements and similar documents to the competent tax authorities.
(3) Posts that a Member has made public, and information contained in them such as the capture location, are information disclosed to other users at the Member’s choice, not information the Company provides to third parties.
Article 7 (Criteria for Additional Use and Provision)
Where the Company uses or provides personal information additionally without the data subject’s consent under Article 15(3) and Article 17(4) of the Personal Information Protection Act, it considers whether the use or provision is related to the original purpose of collection, whether it is foreseeable in light of the circumstances of collection and processing practices, whether it unduly infringes the data subject’s interests, and whether measures necessary to ensure security, such as pseudonymization, have been taken.
Article 8 (Outsourcing of Personal Information Processing)
(1) To provide the Service, the Company outsources the processing of personal information as follows.
| Processor | Outsourced tasks |
|---|---|
| Google LLC | Operating the service infrastructure and database, translating Posts, and looking up place information |
| Cloudflare, Inc. | Storing and delivering photo and video files |
| BunnyWay d.o.o. (Bunny CDN) | Delivering public photos and videos (files with capture location and other metadata removed) |
| Resend | Sending verification emails |
| Expo Application Services | Sending push notifications |
| Functional Software, Inc. (Sentry) | Error analysis |
| Amplitude, Inc. | Usage statistics analysis |
| Vercel Inc. | Hosting the website and the web version, and handling sign-in on the web version |
(2) When entering into an outsourcing contract, the Company specifies the matters necessary to ensure that personal information is managed securely and supervises the processor. If the outsourced tasks or the processor change, the Company will give notice through this Policy.
(3) The Company uses the services of Kakao, Google and OpenStreetMap to look up place information, and the authentication services of Apple, Google, Kakao and LINE for social login.
(4) The Company uses the map services of Google Maps Platform and OpenFreeMap to display maps on the web version, and the map service of Esri to display satellite imagery on the globe. When a map loads, the user’s browser sends the IP address, browser information, the area shown on the map and similar data directly to these providers, and this information is processed under each provider’s privacy policy.
(5) If the Company provides browser push notifications on the web version, notifications are delivered through the push service operated by the maker of the Member’s browser (Google, Apple, Mozilla, etc.), and for this purpose the Company keeps the push subscription information issued by the browser until the Member revokes notification permission or withdraws.
Article 9 (Transfer of Personal Information Overseas)
(1) Under Article 28-8(1)(iii) of the Personal Information Protection Act, the Company discloses in this Policy the outsourcing of processing and storage of personal information necessary to perform the service contract, and transfers personal information overseas as follows. Transfers take place over information and communications networks each time the Service is used.
| Recipient (contact) | Country | Items transferred | Purpose of use | Retention and use period |
|---|---|---|---|---|
| Google LLC (policies.google.com/privacy) | United States and others (including the Republic of Korea region) | The information in Article 2 | Operating the service infrastructure, translation, and looking up place information | Until the Member withdraws or the outsourcing contract ends |
| Cloudflare, Inc. (privacyquestions@cloudflare.com) | United States and others | Photo and video files and metadata | Storing and delivering files | Until the Post is deleted or the Member withdraws |
| BunnyWay d.o.o. (bunny.net/privacy) | Slovenia (delivery points in Korea and elsewhere) | Public photo and video files (with capture location and other metadata removed) | Delivering public files | Until the Post is deleted or the Member withdraws |
| Resend (resend.com/legal/privacy-policy) | United States | Email address | Sending verification emails | Until the purpose of sending is achieved |
| Expo Application Services (expo.dev/privacy) | United States | Push notification token and notification contents | Sending push notifications | Until the token is discarded or the Member withdraws |
| Functional Software, Inc. (Sentry) (sentry.io/privacy) | United States | Device, operating system and browser information, usage records at the time of an error, and Member identifier | Error analysis | 90 days |
| Amplitude, Inc. (amplitude.com/privacy) | United States | Member identifier, usage records, and device, operating system and browser information | Usage statistics analysis | Until the Member withdraws or the outsourcing contract ends |
| Vercel Inc. (privacy@vercel.com) | United States and others (including the Republic of Korea region) | IP address, browser information, access records, and sign-in information for the web version (encrypted) | Hosting the website and the web version, and handling sign-in on the web version | Destroyed without delay after the request is handled (access records follow Vercel’s retention policy) |
| Meta Platforms, Inc. (facebook.com/privacy/policy) | United States | Pseudonymized Member identifier and event information | Measuring advertising performance | In accordance with Meta’s policies |
(2) Members may refuse the overseas transfer. To stop the transfer to Meta, send your objection together with the email address you signed up with to help@flyve.kr; the transfer will stop after your identity is verified, and refusing does not restrict your use of the Service. The other transfers are processing essential to providing the Service; if you do not want them, you can stop the processing by withdrawing your membership.
Article 10 (Measures to Ensure the Security of Personal Information)
The Company takes the following measures to ensure the security of personal information.
- Administrative measures: establishing and implementing an internal management plan, and minimizing and training personnel who handle personal information
- Technical measures: managing access rights and controlling access, encrypting unique identification information and the like, retaining and reviewing access records, and operating security programs
- Physical measures: using the data centers of cloud providers with secured facilities
Article 11 (Installation, Operation and Refusal of Automatic Collection Devices)
(1) The Company’s website (flyve.kr) uses automatic collection devices such as cookies for visit statistics, view counts and measuring advertising performance. A cookie is a small piece of information that a website sends to the user’s browser and that is stored on the user’s device.
(2) The web version of the Service (app.flyve.kr) uses cookies and browser storage (local storage and session storage) as follows to keep Members signed in, for security and for convenience, and does not use cookies for advertising. Information in browser storage is stored only in the Member’s browser.
| Category | Purpose | Retention period |
|---|---|---|
| Sign-in cookie | Keeping the Member signed in and renewing sign-in (stored encrypted) | 1 year from the last use. Until the browser closes if the Member marks the device as a shared computer when signing in; deleted immediately on sign-out |
| Browser identification cookie | Identifying the browser, managing signed-in devices and preventing misuse | 1 year |
| Social login verification cookie | Preventing forged social login requests | 10 minutes (deleted when sign-in completes) |
| Browser storage | Theme and language, the sign-in method used last, recent searches and recently chosen places, layout preferences and whether guidance has been shown, temporary copies of posts and applications being written, a marker that tells other tabs a sign-in renewal is in progress, and the date of birth entered during sign-up | Until the Member deletes it in the browser. The sign-in renewal marker is deleted as soon as the renewal finishes, and the date of birth entered during sign-up is kept until sign-up completes or the browser tab closes |
(3) Users can refuse or delete cookies and browser storage in their web browser settings. If you refuse cookies on the website, some features may be restricted; if you refuse the sign-in, browser identification or social login verification cookies on the web version, you cannot use services that require signing in.
(4) The mobile app processes device identifiers to provide the Service and compile usage statistics, and does not collect advertising identifiers (IDFA/ADID).
Article 12 (Collection, Use, Provision and Refusal of Behavioral Information)
(1) The Company processes behavioral information as follows to measure advertising performance.
| Category | Details |
|---|---|
| Items collected | Website visit records, event information such as sign-ups, Post uploads and shares, cookies, and pseudonymized Member identifiers |
| Collection method | Automatically collected when the website is visited; events sent from the server when the app is used |
| Purpose of collection | Measuring advertising performance and optimizing advertising campaigns |
| Retention period | Until the Member withdraws |
| Advertising business that collects and processes behavioral information | Meta Platforms, Inc. |
(2) Users can refuse the collection of behavioral information through their web browser’s cookie settings or Meta’s ad settings (facebook.com/adpreferences), and can refuse the transfer of app usage information by the method in Article 9(2).
(3) The Company does not collect sensitive behavioral information, and inquiries about behavioral information can be made to the contact in Article 16.
Article 13 (Processing of Personal Location Information)
(1) The Company uses the capture location recorded in photos and videos uploaded by Members to organize Posts and build the travel map, and the capture location of Posts made public may be shown to other users on the map, in the feed and elsewhere.
(2) If a Member allows location access, the Company uses the device’s current location to the extent necessary to provide nearby content and similar features, and destroys it without delay once the purpose is achieved.
(3) Members can delete their Posts or switch their account to a private account at any time, and can withdraw their location consent in the settings within the Service or revoke location access permission in the device or browser settings.
(4) The Company keeps records confirming the collection, use and provision of location information for 6 months under the Act on the Protection, Use, etc. of Location Information, and then destroys them.
(5) The Location Information Manager is Lee Heesoo (Representative), who can be reached at help@flyve.kr or 0507-1490-3470.
(6) Details of the processing of personal location information are governed by the Location-Based Services Terms.
Article 14 (Rights and Obligations of Data Subjects and Legal Representatives, and How to Exercise Them)
(1) Data subjects may at any time request access to, correction or deletion of, or suspension of processing of their personal information, and may withdraw their consent.
(2) These rights may be exercised in the settings within the Service or by contacting help@flyve.kr, and may also be exercised through a legal representative or an authorized agent.
(3) The Company may restrict or refuse a data subject’s request in accordance with the Personal Information Protection Act or other applicable laws, in which case it will give the reasons.
(4) Data subjects must not, in violation of applicable laws, infringe their own or another person’s personal information or privacy being processed by the Company.
Article 15 (Automated Decisions)
The Company does not make fully automated decisions that materially affect the rights or obligations of data subjects. Adjusting the order of the feed does not constitute such a decision, and if the Company begins to make such decisions, it will give advance notice through this Policy.
Article 16 (Chief Privacy Officer and Grievance Department)
The Company designates the following Chief Privacy Officer to oversee the processing of personal information and to handle related grievances.
| Category | Details |
|---|---|
| Chief Privacy Officer | Lee Heesoo (Representative) |
| Contact | help@flyve.kr, 0507-1490-3470 |
Article 17 (Remedies for Infringement of Data Subjects’ Rights)
To obtain remedies for infringement of personal information, data subjects may apply for dispute mediation or consultation to the following bodies.
| Organization | Contact |
|---|---|
| Personal Information Dispute Mediation Committee | 1833-6972, www.kopico.go.kr |
| Personal Information Infringement Report Center (Korea Internet & Security Agency) | 118, privacy.kisa.or.kr |
| Supreme Prosecutors’ Office | 1301, www.spo.go.kr |
| Korean National Police Agency | 182, ecrm.police.go.kr |
Article 18 (Changes to This Privacy Policy)
(1) This Privacy Policy applies from the effective date shown at the top. If any content is added, deleted or modified, the Company announces the changes and the effective date within the Service in advance.
(2) The revision history of this Policy is as follows.
| Effective date | Main changes |
|---|---|
| October 30, 2026 | Added, with the launch of curations and Flyvers, the information needed for Flyver settlement (identity verification, payout account and similar) and the processing of behavioral information for personalized advertising; added the processor BunnyWay d.o.o. (Articles 8 and 9) and the retention period of location information records the Location Information Manager’s contact and how to withdraw location consent (Article 13); and reorganized the Policy |
| October 20, 2026 | Added notices for the launch of the web version (app.flyve.kr): cookies and browser storage on the web version (Article 11), map services and browser push notifications (Article 8), the processor Vercel Inc. (Articles 8 and 9), browser information (Article 2), and location access in the browser (Article 13) |
(3) Notwithstanding paragraph (1), the provisions of this Policy concerning the web version apply from October 20, 2026.