Privacy Policy

Version v2 · Effective September 29, 2026

Path2Way ("Company", "we") processes the personal information of users of Haru-pic (Gwangju Photo Pass, the "Service") in accordance with the Personal Information Protection Act of Korea ("PIPA") and other applicable laws. This policy explains what information we process, why, for how long, how we delete it, and what rights you have.

Note: The Korean version is the governing text. This English version is a translation for convenience.

Article 1 (Scope)

This policy applies to the Haru-pic mobile app (iOS and Android) and the servers the app uses.
It applies to both members and non-members (guests). Items that apply to guests are marked separately.

Article 2 (Personal Information We Process and How We Collect It)

We process only the minimum information needed for the Service. We do not collect your resident registration number or payment information (card, bank account, etc.). The only names we process are a mail-delivery recipient's name and the account name Google sends when you sign in with Google. Haru-pic has no cash payments and runs on points only.

1. Sign-up and login (required)

Social login type (Google or Apple) and that account's unique identifier
Social account email address (for Apple login, this may be a private relay address provided by Apple)
If you sign in with Google: the account name and profile photo URL that Google sends with it (not shown in the app)
Internal account number and username
Sign-up and most recent login method, and the operating system of the device used
Nickname and preferred language
Age group (14-18 / 19 or older), time of age check, re-check deadline, and the age policy version applied
Date of birth: used only on our server at sign-up to check that you are 14 or older, and destroyed immediately after the check. It is not stored and is not written to logs or analytics.
Time onboarding was completed

2. Profile and travel preferences (optional)

Bio
Travel preferences (length of stay, photo preferences, trip style) and interests

3. Consent records (required)

Type and version of each agreement, whether you agreed (including withdrawals), time, and language of consent
Portrait and commercial-use consent records when you share externally or print a result that shows people: the result, share or print, subject consent, commercial-use consent, consent regarding minor subjects, language, and time

4. Photos and AI results (when you use these features)

Photos you take or pick from your album (originals)
The capture location (latitude and longitude), capture time, description, and size attached to a photo
AI-enhanced photos, AI preview results, and AI generation request records (type, status, request and completion time, free or extra quota)
N-cut and photo card results, their slot layout, and crop information
Journey records: journey title, start and end time, places visited and their order, photos, and notes

5. Photo missions and points (when you use these features)

Mission participation records: mission, status, the photo taken, AI verdict, score and reasoning, entry path (notification, place screen, or manual upload), time of the on-site alert, completion time, and whether the photo is public
Requests to review an AI verdict: the photo at the time of the request, the verdict reasoning, the outcome and reason, and the time handled
Points earned and spent

6. Public visit photos (optional)

If you choose to make a mission photo public, other users can see it. We never publish the original. We publish only a copy with the photo's metadata (such as EXIF, including the exact capture location) removed. The location shown is the tourist place tied to the mission.

7. Print orders (when you use this feature)

Order records: pickup method (in person or by mail), order status, order lookup code, quantity, the result ordered, tracking number, and cancellation reason
If you choose delivery by mail (required): recipient name, mobile phone number, address, and postal code
If you choose in-person pickup: we do not collect an address or postal code. We issue a personal pickup QR code for on-site checks, valid for 24 hours.

8. Reports and blocks (when you use these features)

What you reported, the reason, details, and handling status
The list of users you blocked
The number of reports your account has received

9. Notifications and settings

Notification settings by type (recommendations, missions, results, marketing, translation notices) and in-app notification history
Places, photo spots, heritage sites, and courses you saved

10. AI heritage guide chat (when you use this feature)

Account identifier, the questions you enter, and the language used

11. Location (if you grant permission) — explained in Article 13.

12. Service usage records (signed-in members who give optional consent)

Features used and when: viewing places, directions, the AR photo guide, opening the camera and taking photos, AI enhancement and previews, starting heritage guides, creating, saving, sharing and ordering prints of results, tapping recommended places, and search (search terms and number of results)
Also recorded: account identifier, an identifier for each app launch, app version, display language, and internal numbers of places, photo spots, heritage sites, photos and results
Not recorded: exact location coordinates, photo files or their addresses, date of birth or age group, advertising identifiers, device IDs, or the content of AI heritage-guide conversations

13. Non-members (guests)

A device identifier used to count the one free trial. We do not store the original value. We store only a value transformed on our server (an HMAC hash).
Your connection IP address, used to prevent abuse of the trial. We do not store the original value. We store only a value transformed on our server (an HMAC hash).
The photo and AI preview result used in the trial, and the version and time of the AI photo transfer consent
An internal account number for the trial

14. Inquiries

Your email address and the content of your message when you contact us by email

15. How we collect information

You enter or select it in the app
We receive it from Google or Apple during login
It is created as you use the Service, for example by taking photos, uploading, or joining missions
It is collected from your device when you grant location, camera, or photo permissions

Information we do not collect: legal name (other than a mail-delivery recipient's name and your Google account name), resident registration number, payment information, advertising identifiers, push notification tokens (app notifications are shown only on your device), or microphone data (there is no recording or video feature).

Article 3 (Purposes of Processing)

Sign-up and login, identifying your account, and preventing misuse
Confirming that users are 14 or older, and restricting public posting and commercial use for users aged 14 to 18
Maps, place recommendations, directions, and nearby photo mission alerts
Taking and saving photos, AI photo enhancement and previews, and making N-cuts and photo cards
Using AI to check whether a mission photo meets the mission's conditions, and earning and spending points
Journey records and your library
Publishing photos you choose to share, and running community safety features such as reports and blocks
Producing prints and handling in-person pickup or delivery by mail
AI heritage guide chat
Showing screens and content in your preferred language
Sending notifications, and marketing news if you agreed
Keeping consent records, responding to inquiries, and handling disputes
Finding and fixing service errors
If you consent, producing usage statistics (analyzing usage flows) to improve the Service

Article 4 (Retention Periods)

As a rule, we destroy information without delay once its purpose is achieved. Retention periods by item are as follows.

Member account information: until you delete your account. When you request deletion, use stops immediately, and the account is permanently deleted after a 30-day grace period. During the grace period you can restore the account in the app. After it ends, the account cannot be restored.
Date of birth: destroyed right after the age check (not stored)
Age group and check records: until the account is permanently deleted. Users aged 14 to 18 are re-checked one year after the check.
Original photos: 90 days from the completion of the last result made from that photo. If you choose "Keep original", we keep it. We do not destroy an original if no result was ever made from it, or while a mission, N-cut, journey, or similar item still uses it.
AI-enhanced photos, N-cut and photo card results, and journeys: while your account is active. After account deletion, they are permanently deleted after the 30-day grace period.
Photos you delete in the app: hidden immediately, and the files are destroyed in the next scheduled purge.
Copies of public photos: deleted immediately when you unpublish or delete your account. A copy may remain in the delivery network cache for up to 5 minutes (300 seconds).
Mail delivery information (recipient name, mobile phone number, address, postal code): destroyed immediately once shipping, pickup, or cancellation is confirmed. For orders left unfinished, it is destroyed 90 days after the order.
Print order records: deleted together with the account at permanent deletion. Because we do not take payments, these records are not subject to the payment and transaction record retention requirements of the Korean Act on Consumer Protection in Electronic Commerce.
Personal pickup QR code: valid for 24 hours after issue. Reissuing it immediately invalidates the previous one.
Consent records: destroyed together with the account at permanent deletion.
Account deletion records (internal account number and request and deletion times, with no name or contact details): 1 year after permanent deletion
Guest device identifier and connection IP address (hash): 1 year after collection
AI heritage guide chat: deleted immediately when you tap "New chat". Otherwise, 30 days after your last use.
Report records: 1 year after the report is resolved
Block list: until you unblock the user or delete your account
Point history: while your account is active (destroyed when you delete your account)
In-app notification history: 90 days
Directions server request logs: up to 30 days, for error analysis
Service usage records (optional consent): destroyed when you withdraw consent or your account is permanently deleted. Search terms among them are erased 3 years after collection.
Long-inactive (dormant) accounts: if you do not sign in for 12 months, we notify you 30 days in advance. If you do not sign in for 24 months, the account becomes dormant and its information is stored separately from other users' information.

If another law requires us to keep information, we keep it separately for that period and then destroy it.

Article 5 (Destruction Procedure and Method)

Procedure: an automatic batch runs once a day (4:00 a.m. Korea time) to select and destroy information whose retention period has ended or whose purpose has been achieved. The same batch permanently deletes accounts whose grace period has ended.
When an original photo is destroyed because its retention period ended, we delete the photo file together with its capture location, capture time, and description.
Electronic files are deleted in a way that cannot be recovered.
Paper documents created during printing and shipping, such as shipping labels, are shredded.
Photos uploaded by our operators as tourism content remain as service content even if the uploading account is deleted. Only the link to that account is removed.

Article 6 (Provision to Third Parties)

We do not provide your personal information to third parties.
Exceptions apply if you agreed in advance or if the law specifically requires it.
Mission photos you choose to make public can be seen by other users. These are copies with metadata removed, and you can unpublish them at any time.
When you share a result to an external social network, you are the one sending it.

Article 7 (Outsourcing of Processing)

We entrust the following work to service providers and oversee them so that personal information is processed securely in accordance with applicable laws. We produce prints ourselves.

Supabase, Inc.: user authentication, database and photo storage, and running server functions
Google LLC (Google Cloud / Vertex AI): AI photo enhancement and previews, mission photo checks, content translation, and the hosting environment for the directions and heritage guide servers
Google LLC (Google Maps): showing maps in the app
Google LLC (ARCore): recognizing your current position and heading in the AR photo guide
Upstage: converting heritage guide questions for search (embeddings)
Korea Post Parcel (Korea Post): delivery by mail. Data provided: recipient name, mobile phone number, address, postal code

Google and Apple login are sign-in methods you choose. We receive your account identifier and email address from them as the login result. Google login also sends your account name and profile photo URL.

Article 8 (Overseas Transfer of Personal Information)

Under Article 28-8(1)(3) of PIPA, we process personal information overseas as outsourcing and storage necessary to perform our contract with you, and we disclose the following in this policy.

1. Google LLC (AI photo processing)

Recipient: Google LLC
Contact: Privacy Matters c/o Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA / googlekrsupport@google.com / Korean contact: Google Korea LLC, 152 Teheran-ro, Gangnam-gu, Seoul (06236)
Countries: the Google Cloud processing location set by the Company (Google data centers in the United States and elsewhere)
Items: photos you submit for AI enhancement or preview, and photos you take for photo mission checks
When and how: sent over encrypted connections when you request an enhancement or preview, or submit a mission photo
Purpose: AI photo enhancement and previews, and mission photo checks
Retention: processed only for as long as needed to handle the request. Under the Company's settings, photos sent are not used for AI training.
How to refuse, and the effect: if you do not consent to AI photo transfer, or withdraw that consent, we do not send your photos. In that case you cannot use AI enhancement, previews, or AI checks of mission photos. Results you already made remain in your library. You can withdraw consent in Settings ▸ Privacy and consent management, or by email (pathtoway@path2way.com).

2. Google LLC (map display)

Recipient and contact: same as item 1 above
Countries: Google data centers in the United States and elsewhere
Items: map requests needed to display maps (the area shown, and device and app information)
When and how: sent over encrypted connections when you view a map in the app
Purpose: showing maps in the app
Retention: according to Google's operating policies for its map service
How to refuse, and the effect: nothing is sent if you do not use map screens. In that case you cannot use the map or directions features.

3. Google LLC (AR positioning)

Recipient and contact: same as item 1 above
Countries: Google data centers in the United States and elsewhere
Items: visual information derived from the camera feed and sensor information such as location and heading while you use the AR photo guide
When and how: sent over encrypted connections while the AR photo guide screen is open
Purpose: precisely recognizing your current position and heading to show AR guidance
Retention: according to the Google Privacy Policy (https://policies.google.com/privacy) and how Google Play Services for AR handles your data (https://support.google.com/ar?p=how-google-play-services-for-ar-handles-your-data)
How to refuse, and the effect: nothing is sent if you do not use the AR photo guide. You can still use map directions.

Member and photo data stored with Supabase is kept in the Seoul region (Republic of Korea).

Article 9 (Criteria for Additional Use or Provision)

When we use or provide information for purposes reasonably related to the original purpose, we decide based on the criteria in the PIPA Enforcement Decree: relevance to the original purpose, whether you could expect it given how it was collected, whether it unfairly harms your interests, and whether safeguards such as pseudonymization are in place.

Article 10 (Pseudonymized Information)

We do not process pseudonymized information.

Article 11 (Sensitive Information)

We do not process sensitive information such as health information, ideology, or beliefs. Photos may show faces, but we do not create or process biometric information that identifies a specific person from their face.

Article 12 (Children Under 14)

Only users aged 14 or older can sign up for Haru-pic. Children under 14 are blocked from signing up, and we do not offer sign-up with a legal guardian's consent.
Users aged 14 to 18 cannot make photos public to other users, or share or print results externally. They can save privately, use the Service personally, and join missions.

Article 13 (Location Information)

Location while using the app: used to recommend nearby photo spots and places, for directions, to check whether you are within a mission place's radius, and to record where a photo was taken. Our server calculates radius checks and nearby recommendations, and the current location sent for these checks is used for the check and not stored. The capture location is stored as part of the photo.
Directions: route coordinates such as your start and destination are sent to the directions server we operate. Request logs are kept for up to 30 days for error analysis.
AR photo guide: while the screen is open, Google (ARCore) processes the camera feed and location and sensor information to recognize your current position and heading (Article 8, item 3).
"Always" (background) location: used only to let you know when you arrive near a mission place. This check and the alert happen on your device, and missions are never completed automatically.
If you do not allow location, you can still view the map at a default Gwangju location and search manually. You can change the permission in your device settings at any time.
Public photos do not include your exact capture location (Article 2, item 6).
We process location information in compliance with the Act on the Protection, Use, etc. of Location Information and other applicable laws.

Article 14 (Automatic Collection Tools and How to Refuse)

Cookies: Haru-pic is a mobile app and does not use web cookies. We do not use third-party cookies.
Advertising identifiers: the app has no advertising features, so we do not collect advertising identifiers (IDFA or AAID). If we add rewarded ads, we will update this policy and notify you first.
On-device storage: we store login credentials (in your device's secure storage), settings such as your preferred language, records of mission alerts sent, and an offline task queue on your device.
Service usage records (analytics events): created only for signed-in members who give optional consent. Records are briefly held on your device (up to 500 entries) and sent together to our server (Supabase, Seoul region) every 30 seconds or when you close the app. If you have not consented or use the app as a guest, no records are created. These records do not include advertising identifiers, device IDs, date of birth or age group, exact location coordinates, or photos.
Refusing or withdrawing usage analytics: do not give the optional consent at sign-up, or turn off "Service Usage Analytics" in My ▸ Settings ▸ Privacy & consent. When you turn it off, we stop collecting and delete the records already collected. Declining does not limit your use of the Service.
How to refuse: deleting the app removes on-device data. However, the value used to recognize a guest trial may remain in the iOS Keychain.

Article 15 (Automated Decisions)

AI decides whether a photo mission photo meets the mission's conditions. The mission is completed and points are earned only if it passes.
If you disagree with the verdict, you can tap "Request review" in the app, and an operator will check it again in person. If the request is rejected, we tell you the reason. You can also retake the photo as many times as you like.
You can ask for an explanation of this decision or for human review. Use "Request review" in the app or email us (pathtoway@path2way.com), and we will respond within the period required by law.
Place recommendations are sorted only by the interests you chose, scores set by our operators, and distance. They do not evaluate you.

Article 16 (Your Rights and How to Exercise Them)

You can ask at any time to access, correct, delete, or stop processing your personal information, or to withdraw consent.
What you can do directly in the app:
- My ▸ Settings ▸ view terms and policies
- Consent management: turn consent to AI retraining, marketing, and service usage analytics on or off, and view your consent history
- Photo deletion: delete all original photos, or all enhanced photos and results, at once
- Delete your account, and restore it within 30 days
- Unpublish photos, turn off notification types, and turn "Keep original" on or off
You can request withdrawal of other consents (location, AI photo transfer, portrait rights, etc.) in Settings ▸ Privacy and consent management, or by email (pathtoway@path2way.com). You can also turn off location permission in your device settings.
Request by email: pathtoway@path2way.com
We will handle your request within the period required by law and tell you the result.
A result that is being printed cannot be deleted until printing finishes, because the print file is still needed.
A legal representative or an authorized person can also exercise these rights. In that case, we may ask for a power of attorney or similar document.

Article 17 (Security Measures)

Administrative measures

We establish and carry out an internal management plan, keep the number of staff handling personal information to a minimum, and train them regularly.

Technical measures

Encryption in transit (HTTPS)
User photo storage is private, and photos are served only to authenticated requests or through short-lived links
Row-level access control in the database (RLS) and server functions enforce permission boundaries
Administrator keys are kept only on the server and never shipped in the app
Access to systems that process personal information is granted only to those who need it, and access logs are kept and reviewed
Login credentials are kept in your device's secure storage
Guest device identifiers and connection IP addresses are stored only as a hash mixed with a server secret, not as the original value
Only copies with metadata removed are published for public photos

Article 18 (Privacy Officer)

Privacy officer: 김태균 (Representative)
Email: pathtoway@path2way.com
Website: https://www.path2way.com
Please send privacy questions, complaints, and requests for remedies to the contact above. We will respond and act without delay.

Article 19 (Domestic Representative)

We are a Korean business and therefore do not appoint a domestic representative.

Article 20 (Remedies for Infringement)

You can request dispute mediation or counseling from the following Korean agencies.

Personal Information Dispute Mediation Committee: 1833-6972
Personal Information Infringement Report Center: 118
Korean National Police Agency Cyber Investigation Bureau: 182
Supreme Prosecutors' Office: 1301

Article 21 (Video Surveillance Devices)

We do not operate fixed or mobile video surveillance devices.

Article 22 (Changes to This Policy)

If we change this policy, we will announce the changes and the effective date in the app and on our website (https://www.path2way.com) at least 7 days before they take effect. For changes that significantly affect your rights, such as adding new items or purposes, we will notify you 30 days in advance and ask for consent again if needed.

Addendum

This policy takes effect on September 29, 2026.

The previous policy (v1) applied from September 28, 2026.