Privacy Policy
Last Updated: April 25, 2026
Ongi ("Company," "we," "us," or "our") is deeply committed to protecting your privacy. We comply with the world's most stringent data protection laws, including the Republic of Korea's Personal Information Protection Act (PIPA) and Act on Promotion of Information and Communications Network Utilization and Information Protection, the California Consumer Privacy Act (CCPA/CPRA), and the UAE Personal Data Protection Law (PDPL), as well as global children's safety regulations.
This Service complies with the Korean Ministry of Health and Welfare's "Non-Medical Health Management Service Guidelines" and does not provide any medical services (such as diagnosis, prescription, or treatment of diseases) as defined by Article 27 of the Medical Service Act. Ongi is a general emotional support service only.
1. Information We Collect
We collect the minimum information necessary to provide our services, including "Sensitive Personal Information" as defined by global health privacy standards:
- •Account Information (Required): Email address, name, device information, IP address, service usage logs, occupation (optional, if provided in settings).
- •Sensitive Neural & Emotional Data: Emotion scores, emotion tags, journal notes, AI chat messages, prompts, and conversation history (only information voluntarily provided by the user).
- •Payment Information (Not Collected): All transactions are securely processed through authorized payment providers (e.g., Apple App Store, Google Play, or Stripe). We do not directly collect, process, or store your credit card details or any sensitive financial information on our servers.
2. How We Use Your Information
We process your personal information only for the following purposes:
- •Account registration, identity verification, and responding to user inquiries.
- •Providing and personalizing our AI emotional conversation service and emotion record features.
- •Service quality improvement and statistical analysis.
- •Automated Decision-Making Technology (ADMT) for Crisis Detection: We utilize AI to analyze user input in real-time to detect severe crisis situations such as self-harm. You may opt out of ADMT processing by contacting us at our email below, subject to system limitations.
3. Data Sharing and International Cross-Border Transfers
Due to the cloud architecture and AI processing nature of the Service, your data is securely transferred to and processed by external infrastructure providers located in the United States.
| Provider | Purpose | Notes |
|---|---|---|
| Google Firebase (US) | Cloud storage and account authentication | Deleted upon account closure |
| Anthropic (US) | AI conversational model | Zero-Training Guarantee — chats are never used to train AI; permanently deleted within 30 days |
| Vercel (US) | Global web/app hosting and traffic routing | Logs retained then deleted |
※ If you do not wish your data to be transferred internationally, you may discontinue use of the Service and delete your account.
4. Data Retention and Deletion
We adhere to data minimization principles. Upon account deletion, all account information, emotional records, and chat data are immediately and permanently destroyed using irrecoverable methods, except where retention is legally mandated.
In accordance with the Korean Protection of Communications Secrets Act and other applicable laws, communication logs are retained for 3 months before destruction.
5. User Rights
You have the right to access, correct, or delete your personal data at any time.
HEALTH DATA STATEMENT RIGHT
UNDER GLOBAL HEALTHCARE PRIVACY STANDARDS (INCLUDING CCPA), IF A REQUEST TO CORRECT YOUR EMOTIONAL/HEALTH DATA IS DENIED DUE TO TECHNICAL LIMITATIONS, YOU HAVE THE RIGHT TO SUBMIT A STATEMENT OF DISAGREEMENT (UP TO 250 WORDS). WE WILL ATTACH THIS STATEMENT TO YOUR RECORDS AND INCLUDE IT IN ANY FUTURE PERMITTED DISCLOSURES.
6. Cookies and Tracking Technologies
A "Cookie" is a small data file stored on a user's browser by a website, utilized for maintaining login status, analyzing visitor statistics, and improving service quality.
Purposes of Collection
- •Maintaining login authentication status (Firebase)
- •Analyzing visitor statistics (Google Analytics 4)
- •Analyzing user behavior (Microsoft Clarity)
- •Security and abuse prevention (Google reCAPTCHA)
Current Cookie Usage
| Provider | Purpose | Retention Period |
|---|---|---|
| Google Analytics | Analyzing visitor statistics | Up to 2 years |
| Microsoft Clarity | Analyzing user behavior | Up to 1 year |
| Google reCAPTCHA | Security and abuse prevention | Until session ends |
| Firebase (Google) | Maintaining login authentication | Until session ends |
How to Refuse Cookies (Opt-out)
- •Chrome: Settings → Privacy and security → Cookies and other site data
- •Safari: Preferences → Privacy → Block all cookies
- •Edge: Settings → Cookies and site permissions → Manage and delete cookies and site data
- •Global Privacy Control (GPC): We legally recognize and honor GPC signals transmitted by your browser as a valid opt-out request for tracking.
Note: If you refuse essential cookies, some services, such as maintaining your login, may be restricted.
7. Children's Privacy
Our service requires users to be at least 14 years old (or older in specific jurisdictions as described below).
Republic of Korea
We restrict registration by children under the age of 14 and do not collect personal information from children without verifiable consent from a legal guardian, in accordance with PIPA. If a user under this age is identified, their account will be immediately restricted and all collected personal information will be promptly deleted.
United States (COPPA & CCPA)
We do not knowingly collect data from children under 13 without verifiable parental consent. Data of users under 16 is treated strictly as sensitive and is blocked from any third-party sharing.
UAE (PDPL / Child Digital Safety Law)
Users must be at least 18 years old to use the Service in the UAE. We do not knowingly collect data from UAE users under 18.
8. Jurisdiction-Specific Notices
Republic of Korea
This Service complies with the Personal Information Protection Act (PIPA) and the Act on Promotion of Information and Communications Network Utilization and Information Protection. Communication logs are retained for 3 months in accordance with the Protection of Communications Secrets Act before destruction.
United States (CCPA/CPRA and Applicable State Laws)
WE DO NOT "SELL" OR "SHARE" YOUR PERSONAL INFORMATION FOR CROSS-CONTEXT BEHAVIORAL ADVERTISING. YOU HAVE THE RIGHT TO LIMIT THE USE AND DISCLOSURE OF YOUR SENSITIVE PERSONAL INFORMATION. You will not face discrimination for exercising these rights.
UAE Residents (PDPL) — Explicit Consent for Cross-Border Data Transfer
UNDER UAE FEDERAL DECREE-LAW NO. 45 OF 2021 (PDPL), BY USING THIS SERVICE, YOU EXPLICITLY CONSENT TO THE TRANSFER, PROCESSING, AND STORAGE OF YOUR PERSONAL DATA ON SECURE SERVERS LOCATED OUTSIDE THE UAE (INCLUDING THE UNITED STATES AND SOUTH KOREA).
We guarantee top-tier technical safeguards, including AES-256 database encryption and TLS 1.2+ network encryption.
9. HIPAA and FDA Non-Applicability Disclaimer
NOT A HIPAA COVERED ENTITY
ONGI IS A DIRECT-TO-CONSUMER GENERAL WELLNESS APPLICATION. WE ARE NOT A "COVERED ENTITY" OR A "BUSINESS ASSOCIATE" AS DEFINED BY THE HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT (HIPAA) OF 1996. WHILE WE IMPLEMENT STRICT SECURITY MEASURES TO PROTECT YOUR SENSITIVE EMOTIONAL DATA UNDER THE CCPA AND OTHER APPLICABLE LAWS, YOUR DATA IS NOT PROTECTED BY HIPAA PRIVACY AND SECURITY RULES. DO NOT USE THIS SERVICE TO STORE OR TRANSMIT MEDICAL RECORDS OR INFORMATION INTENDED FOR YOUR HEALTHCARE PROVIDERS.
NOT AN FDA-CLEARED MEDICAL DEVICE
THE SERVICE IS DESIGNED FOR GENERAL WELLNESS, EMOTIONAL SUPPORT, AND SELF-REFLECTION. IT HAS NOT BEEN EVALUATED, CLEARED, OR APPROVED BY THE U.S. FOOD AND DRUG ADMINISTRATION (FDA) AS A MEDICAL DEVICE. ONGI IS NOT INTENDED TO DIAGNOSE, TREAT, CURE, OR PREVENT ANY DISEASE, PSYCHIATRIC DISORDER, OR MEDICAL CONDITION.
10. Contact Our Data Protection Officer (DPO)
For privacy-related inquiries, please contact us at:
founder.ongi@gmail.com