PALJA CHECK Privacy Policy
Effective September 15, 2026
This English version is a translation. If it differs from the Korean version, the Korean version prevails.
PALJA CHECK (“we”) provides the PALJA CHECK service (the “Service”). This policy explains what personal information the Service processes, why, on what legal basis, for how long, who else handles it, and how you can see, correct or delete it, as required by Korea's Personal Information Protection Act (the “Act”).
At a glance
- We keep your date of birth, optional time of birth and display name to calculate your daily score.
- If you don't sign in, your records are deleted 7 days after your last visit. Signed-in records stay until you delete them.
- We don't sell your information or give it to third parties, and we don't use cookies or any third-party advertising or analytics tools. Usage records for improving the Service stay on our own server.
- Settings → “Delete my data” deletes the record you have open. For your other records or your Google account link, write to contact@otoworks.ai.
1. Why we process personal information
We process personal information only for these purposes:
- Calculating your daily score, sector scores, 30-day chart and tomorrow preview from your date and time of birth.
- Keeping your records and streak when you sign in with Google, so the Service opens where you left off.
- Sending the daily reminder you turned on.
- Making the share cards and compatibility scores you ask for.
- Limiting how many new records one network can create in a short time, to prevent abuse.
- Counting how the Service is used, such as how many results were opened, to fix problems and improve it.
2. What we collect and on what legal basis
| Kind | Items | When | Legal basis |
|---|---|---|---|
| Required | Date of birth (solar calendar), display name | When you ask for a score | Performance of the service contract (Art. 15(1)4 of the Act) |
| Optional | Time of birth | If you enter it | Performance of the service contract (Art. 15(1)4 of the Act) |
| Optional | Another person's date of birth, time of birth and name | If you run a compatibility check | Performance of the service contract (Art. 15(1)4 of the Act) |
| Optional | Google account identifier, email address and whether Google verified it | If you sign in with Google | Performance of the service contract (Art. 15(1)4 of the Act) |
| Optional | Push subscription (a delivery address issued by your browser, with its encryption keys) and your reminder hour | If you turn on reminders | Performance of the service contract (Art. 15(1)4 of the Act) |
| Created automatically | Record key issued to your browser, sign-in token (stored only as a hash), share cards (names and scores, no date of birth) | While you use the Service | Performance of the service contract (Art. 15(1)4 of the Act) |
| Created automatically | Usage records (which screens and actions, and when) | While you use the Service | Our legitimate interests (Art. 15(1)6 of the Act) |
We don't process any of these items on the basis of consent.
We don't collect your real name, phone number, location, contacts or payment details. Your IP address is not stored in the service database. To limit how many records one network can create, we keep a value converted from your IP address and the current hour, on the basis of our legitimate interests (Art. 15(1)6 of the Act); a daily job deletes it once it is older than 2 hours.
3. How long we keep it
| Information | Kept until |
|---|---|
| Records made without signing in (date and time of birth, name, scores, compatibility checks, share cards, reminders) | 7 days after your last visit, then deleted automatically. If a signed-in user's compatibility check includes the record, it is kept while that check exists. |
| Records of a signed-in account | You delete them (section 9) |
| Google account identifier and email address | You ask us to delete the link to your Google account (section 9) |
| Sign-in token | 30 days after it is issued, or when you sign out |
| Usage records | Every record tied to the same record key has been deleted |
| Push subscription | The record it belongs to is deleted. If the push service reports the subscription as gone, we stop sending at once. |
| Converted IP value used to limit abuse | Deleted by the daily job once it is older than 2 hours |
| Administrator access records | Kept for security audits, currently without a set deletion date |
If a law requires us to keep something longer, we keep only what that law requires, for that period, stored separately from other data.
4. How we delete it
When a retention period ends or you ask for deletion, we delete the data without delay. A job runs every day for expired records, and deletions you make in Settings are applied when you make them. Data is deleted from the database. We don't keep personal information on paper.
5. Sharing with third parties
We don't give your personal information to third parties, except where the law allows it, such as a lawful request from an investigative agency.
A share card you create can be seen by anyone who has its link. A personal card shows your name and scores; a compatibility card shows both people's names and the match score. No card shows a date of birth.
If someone who received your card enters their own date of birth to see their match with you, you both see both names and the match score. If you are signed in, that match and their record are kept while the match exists.
6. Outsourcing and transfers abroad
The Service runs on server infrastructure operated for us. Any provider that processes personal information on our behalf is listed in this section.
Reminders are delivered through companies outside Korea. As Article 28-8 of the Act requires, the details are:
| Recipient | Country | Information | When and how | Purpose and retention | How to refuse |
|---|---|---|---|---|---|
| The push service run by your browser's maker: Google (policies.google.com/privacy), Apple (www.apple.com/legal/privacy), Microsoft (privacy.microsoft.com), Mozilla (www.mozilla.org/privacy) | Where that company runs it (for example the United States) | Your push subscription address and the encrypted reminder | At the reminder hour you chose; encrypted HTTPS using the Web Push protocol | Delivering the reminder only. The reminder is encrypted, so the push service can't read it. | Turn reminders off in Settings. Reminders then stop. |
Signing in with Google: when you sign in on Google's page, Google sends us a token with your Google account identifier, email address, whether the email is verified, your name and your profile photo. We store only the first three, not the name or photo. We don't send personal information to Google.
7. Information about other people you enter
A compatibility check asks for another person's date of birth, time of birth and name. Tell that person and get their agreement before you enter it, and before you share a card that shows their name.
If you enter a child's date of birth as the other person, you are responsible for telling the child's parent or legal guardian and getting their agreement.
When you delete your own record, the other people's records you entered go with it, unless another compatibility check still uses them. You or the person whose information was entered can also ask us to delete it at contact@otoworks.ai.
8. Children under 14
You must be 14 or older to use the Service. You can't create your own record with a date of birth that shows you are under 14. Both the form and our server refuse it. If a child's information was entered as another person, the child's parent or legal guardian can ask us to delete it at contact@otoworks.ai, and we delete it without delay.
9. Your rights and duties, and how to exercise your rights
You can ask to see, correct or delete your personal information, or to stop its processing, at any time.
- Delete the record you have open, with its scores, matches, share cards and reminders: Settings → “Delete my data”.
- Delete your other records, the link to your Google account or your sign-in tokens, or make any other request: write to contact@otoworks.ai.
- Someone can act for you, such as a legal guardian or a person you authorize. We will ask for proof of that authority.
- We reply within 10 days. If we can't do what you ask, we tell you why and how to object.
- Your duty: before you enter someone else's information, tell them and get their agreement (section 7).
10. How we protect it
- All traffic is encrypted with HTTPS.
- Sign-in tokens are stored only as hashes, and IP addresses aren't stored in the service database.
- Only the people who run the Service can open its admin screen, and opening, changing or deleting an individual record there is logged.
- We collect only the items listed in section 2.
11. Cookies and browser storage
The Service doesn't use cookies, and runs no third-party advertising or analytics tools.
It keeps a few items in your browser's own storage so it works without asking the server each time:
- Your session: record key, record ID, display name and, if you signed in, the sign-in token and email address.
- Your settings: theme, color-vision option, language and reminder choice.
- Your streak, and a copy of today's score for the open tab.
- Whether you've already seen the reminder prompt.
- Which animations and tips you've already seen, so they aren't shown again.
- Your account email, kept in the tab briefly after you sign in until your record is created.
Signing out removes the session. To remove everything, clear this site's data in your browser:
- Chrome and Edge: open site settings from the icon left of the address bar, then delete this site's data.
- Safari: Settings → Privacy → Manage Website Data, then remove this site.
- Firefox: open the padlock menu left of the address bar, then clear cookies and site data.
12. Sensitive information, pseudonymized information and automated decisions
The Service doesn't process sensitive information as defined in the Act, such as health information or political views, and doesn't create or use pseudonymized information.
Scores are calculated automatically, but they are for entertainment and have no significant effect on your rights or obligations, so they aren't automated decisions under Article 37-2 of the Act.
13. Privacy officer
- Privacy officer: Privacy team (contact@otoworks.ai)
- Privacy questions, requests and other questions: contact@otoworks.ai
14. Where else to get help
If you have a concern about how we handle your information, you can also contact these organizations:
| Organization | Website | Phone |
|---|---|---|
| Personal Information Infringement Report Center (KISA) | privacy. | 118 |
| Personal Information Dispute Mediation Committee | www. | 1833-6972 |
| Supreme Prosecutors' Office | www. | 1301 |
| Korean National Police Agency | ecrm. | 182 |
15. Changes to this policy
We announce changes on this page at least 7 days before they take effect, and at least 30 days before for changes that affect your rights.
- September 15, 2026: Set out in full how the Service already processes personal information, including usage records, transfers abroad, information about other people, children under 14 and browser storage. No item or purpose changed, so this version took effect when it was posted.