Privacy Policy

1. Who is responsible for your data

tokkipaw decides how the personal data described here is handled, and is the controller for the purposes of the UK and EU GDPR.

• Email: help@tokkipaw.com
• tokkipaw · Representative: Myunghwa Park · Business registration number: 786-04-03749
• Bldg. 313, 128-29 Yusuampyeonghwa-gil, Aewol-eup, Jeju-si, Jeju-do, Republic of Korea

If you are in the UK or the EU and want to reach us about your data, write to help@tokkipaw.com. We answer in English.

2. What we collect

What you give us:

• Your email address — this is the only thing we ask you for.

What we collect automatically when you use the service:

• A device identifier we generate, so one email stays active on one browser at a time
• Your IP address and basic browser and device information, to keep the service secure and to catch abuse
• Usage records — which paw, when, how many uses you have left, and whether a purchase was used
• Your chosen language, and your time zone if you turn on reminders

When you buy something:

• The order reference, amount, currency and payment reference, plus the receipt we email you
• We never receive your card number. The payment is handled by our payment provider (section 6).

3. What never leaves your device

Most paws keep your content in your browser only. It is not sent to us, it is not on our servers, and we cannot read it.

• Diary entries and notes
• Ledger and split records
• Grocery lists and expiry dates
• Habit streaks, focus and breathing sessions
• Growth logs and countdowns

Because it never reaches us, we cannot back it up or restore it. Clearing your browser data or switching device deletes it permanently — use the export inside each paw if you want a copy.

4. AI readings

Some paws — saju.paw, couple.paw, moment.paw, tarot.paw, haemong.paw and style.paw — send what you enter to Anthropic, which generates the reading for us. birth.paw and health.paw work the same way for anyone who already owns them.

• Sent: only what you entered for that reading — for example a birth date and time, a question, a description of a dream, or the weather and occasion you picked — together with our instructions for how to answer.
• Not sent: your email address, your device identifier and your IP address.
• Kept by us: the answer, for 7 days, so that a retried request returns it instead of charging twice; a one-way fingerprint of your input rather than the input itself; and a usage record with your email and the size of the request, which is how we account for cost.
• birth.paw and health.paw handle health information. We ask for your separate consent the first time you use them, and you can withdraw it on the same screen at any time — we then delete the stored answers straight away.

Anthropic processes these requests on our behalf under its commercial terms, which do not allow customer content to be used to train models. We use the paid API, not a consumer plan.

5. Why we use it

We use your data for these purposes, on these legal bases:

• Running the service, giving you access to what you bought, and counting uses — to perform our contract with you
• Verifying your email and keeping one device active — to perform our contract, and for security
• Taking payment, issuing receipts and handling refunds — to perform our contract, and to meet legal record-keeping duties
• Answering your support messages — to perform our contract
• Preventing abuse, fraud and automated attacks — our legitimate interest in keeping the service usable
• Counting how often paws are used, in aggregate — our legitimate interest in improving them

We do not use your data for advertising, and we do not profile you.

6. Who else handles it

We do not sell your personal information and we do not share it for advertising. We do not sell or share personal information as those terms are defined under California law. We rely on these providers:

• Dodo Payments — merchant of record and payment processing for purchases outside Korea. Receives your order and payment details.
• Supabase — our database. Holds the data in section 2.
• Vercel — hosting. Processes requests to the site.
• Cloudflare — content delivery, protection and email routing. Processes IP and request data.
• Resend — sends our emails. Receives your address and the message.
• Anthropic — generates AI readings. Receives only what section 4 describes.
• Discord — our internal alert channel for support, refunds and errors. Receives your email address and the content of messages you send us.

We also disclose data where the law requires it, for example a valid order from an authority.

7. Where your data goes

We are in Korea and our providers are in the United States, so your data is transferred across borders.

• Transfers from the UK or the EU to us in Korea: Korea has been recognised as providing an adequate level of protection, so no additional safeguard is needed.
• Transfers to our providers in the United States: we rely on the EU–US Data Privacy Framework and its UK extension where a provider is certified under it, and on Standard Contractual Clauses (with the UK Addendum where relevant) otherwise.

Write to us if you would like details of the safeguard that applies to a particular provider.

8. How long we keep it

• Email address and device record — until you ask us to delete them
• Payment records and receipts — 5 years, as Korean law requires of sellers
• AI reading records — 7 days, then deleted (straight away if you withdraw consent for birth.paw or health.paw)
• Challenge scores — kept while you use the service; ask us and we will delete them
• Security, abuse and error records — kept only as long as we need them to keep the service safe
• Aggregate usage counts — kept, but they no longer identify you

9. Cookies and local storage

We set two cookies. Neither is for advertising, and we do not use third-party analytics.

• One remembers that you have verified, so pages do not flicker while loading — 180 days
• One remembers the language you chose — 1 year

Your browser's local storage holds your device identifier, which paws you own, how many tries you have left, and each paw's own content (section 3).

Clearing this signs you out on that browser and deletes the paw content stored there.

10. Your rights

Depending on where you live, you can ask us to:

• Give you a copy of your data, or tell you what we hold
• Correct anything that is wrong
• Delete your data
• Restrict or object to how we use it
• Send your data to you or another provider in a portable form
• Withdraw consent, where we relied on it

Write to help@tokkipaw.com. We reply within one month and there is no charge. You can also complain to your data protection authority — the ICO in the UK, your national authority in the EU, the OAIC in Australia, or Korea's Personal Information Protection Commission.

11. Children

tokkipaw is not intended for children. You must be at least 14 to use it, or older where the country you live in sets a higher minimum age for online services (usually 13 to 16 in the EU). We do not knowingly collect data from anyone younger. If you believe a child has given us data, write to us and we will delete it.

12. How we protect it

• Everything is served over HTTPS, with HSTS
• No passwords to steal — sign-in is a one-time 6-digit code
• One active device per email, so a lost session cannot be reused
• Database access is restricted row by row
• Administrative access is logged, and the log is kept only as long as we need it
• We have a written procedure for handling a breach

No service can promise perfect security, but we keep what we collect small on purpose — that is the best protection we can offer you.

13. Changes to this policy

If we change this policy we post the new version here at least 7 days before it takes effect. If a change materially affects you we post it at least 30 days ahead, and we also email you when we hold your address.

14. Contact

help@tokkipaw.com tokkipaw · Representative: Myunghwa Park Bldg. 313, 128-29 Yusuampyeonghwa-gil, Aewol-eup, Jeju-si, Jeju-do, Republic of Korea