Privacy Policy

1Overview

This Privacy Policy (the “Policy”) explains for what purposes and by what means the individual developer (the “Operator”) who operates Forutin (the “Service”) processes and protects users’ personal data.

The Service is a mobile application that provides vitamin and supplement intake management and reminders, and account authentication is performed solely through Apple and Google social sign-in. The Operator collects and processes only the minimum personal data necessary so that users can use the Service with confidence.

2Purposes of Processing

We process personal data for the following purposes. If a purpose changes, we will notify you in advance and obtain consent where required.

• Account management — identifying members via Apple/Google sign-in, sign-up and account closure, account security.
• Service delivery — vitamin/supplement management, intake reminders, and inventory tracking.
• Subscription billing & refunds — verifying Plus subscription status, renewals, cancellations, and refunds.
• AI routine analysis — generating AI analysis of intake timing and combinations based on the supplements you register.
• Advertising — displaying in-app ads (banner and rewarded) to free users, and serving personalized ads where you have allowed app tracking.
• Community board — handling posts, inquiries, and replies.
• Improvement & analytics — improving features, diagnosing errors, and producing usage statistics. Usage records collected for this purpose are stored and analyzed in a form linked to your account.
• Customer support — handling inquiries and complaints and replying with the outcome.

3Data We Process

The items above are processed in a form linked to your account. We do not collect your phone number, address, or payment card numbers. Payments are handled solely by the Apple App Store billing system (and the Google Play Store billing system once the Android release is available); we have no access to your card details.

4Retention Period

• As a rule, your personal data is deleted immediately upon account closure, with no grace period. Deleted data cannot be recovered.
• Upon account closure, the Operator automatically requests revocation of your Apple/Google sign-in connection (token revocation). If that request fails — for example, due to an outage at the external service — deletion of your data still proceeds. You may also review or remove the connection yourself in your device settings (iOS: Settings > Apple ID > Sign in with Apple).
• Anonymized statistical data that cannot identify an individual (for example, how many times a product was registered, or rankings and other service statistics) continues to be retained after account closure for the purpose of improving the Service.
• Where retention is required by law, data is kept for the periods below and then destroyed.

5Sharing with Third Parties

We do not share your personal data with third parties beyond the scope stated in this Policy, except:

• where you have given prior consent; or
• where required by law or by a lawful request from an investigative authority.

6Processors (Sub-processors)

To operate the Service we engage the following processors, under agreements requiring appropriate safeguards for your data.

We do not use Firebase Analytics or any other user-behavior analytics SDK; Firebase is used solely to deliver push notifications.

When sending AI analysis requests, we do not include directly identifying information (such as your email or name); only the minimum supplement and intake details needed for the analysis are transmitted.

7International Data Transfers

To provide AI routine analysis, serve in-app ads, and deliver push notifications, we transfer personal data abroad as described below.

The Service’s servers and databases are located in the Republic of Korea (NAVER Cloud Platform); your service usage data is not stored on overseas servers on an ongoing basis.

You may refuse international transfer; however, refusal may limit related features (such as AI routine analysis and push notifications). Transfers for advertising purposes can be limited by not allowing app tracking under iOS Settings > Privacy & Security > Tracking. For other objections, contact contact@routiner.app.

8Cookies & Device Identifiers

The Service does not use web browser cookies, but relies on the following on-device storage to keep you signed in:

• Authentication token (JWT) — stored encrypted in the device secure storage (expo-secure-store) to maintain your login session.
• Device identifier — used to deliver push notifications and analyze errors.
• Advertising identifier (IDFA) — used to serve personalized ads and measure ad performance, only where you have allowed app tracking. You can withdraw permission at any time under iOS Settings > Privacy & Security > Tracking; non-personalized ads will still be shown after withdrawal.

You can remove the stored authentication token by logging out or uninstalling the app.

9Advertising & Affiliate Links

(1) In-app advertising

Free users are shown in-app ads served through Google AdMob.

• Banner ads — at the bottom of the Home, Supplements, Insights, and My Page screens.
• Rewarded ads — shown only when you choose to watch one in order to add a supplement beyond the free registration limit.
• To serve ads, Google may collect and use your advertising identifier (IDFA) and device and network information.
• On iOS 14.5 and later, the app asks for tracking permission on first launch (App Tracking Transparency). Ads are shown whether or not you allow it; if you decline, they are non-personalized.
• Plus subscribers are not shown in-app ads.
• For details on how Google processes advertising data, see the Google Privacy Policy.

(2) Coupang Partners

• Clicking an affiliate link takes you to the Coupang website or app.
• Data handling and purchases on Coupang are governed by Coupang’s own privacy policy and terms.
• The Operator does not separately collect your purchase history through these links.

10Notice Regarding AI

AI routine analysis is generated using language models from Anthropic, and we do not guarantee the accuracy or completeness of the output. The Operator is not liable for decisions you make in reliance on AI-generated information.

11Your Rights

You may exercise the following rights at any time:

• Right to access your personal data
• Right to rectify inaccurate data
• Right to deletion
• Right to restrict / suspend processing

You can exercise your rights via in-app account settings or by emailing contact@routiner.app; we will act without undue delay. You can delete your account directly within the app.

12Data Deletion Procedure & Methods

Deletion procedure

When you close your account or the retention period expires, the relevant data is deleted without delay. Data that must be retained by law is moved to separate storage, kept securely for the required period, and then destroyed.

Deletion methods

• Electronic files — permanently deleted from the database so they cannot be recovered.
• Paper documents — shredded or incinerated.

13Data Protection Officer

The Operator takes overall responsibility for matters relating to the processing of personal data and has designated the following data protection officer to handle user complaints and provide remedies.

14Security Measures

• Encryption — authentication tokens (JWT) are stored encrypted in device secure storage; credentials are protected using one-way hashing such as BCrypt.
• Access control — JWT-based authentication ensures only authorized users can access their own data.
• Audit logging — administrator access and key operations are recorded in an admin audit log.
• Transport security — communication with the server is encrypted with HTTPS (TLS).

15Children’s Privacy

The Service does not collect personal data from children under the age of 14. If we learn that a user is under 14, we delete the account and related data without delay.

16Changes & Contact

If this Policy is amended, we will give notice at least 7 days in advance via in-app notice or this page (at least 30 days in advance for changes materially affecting your rights).

For questions, complaints, or remedies regarding data processing, contact:

Email · contact@routiner.app