Cattus Privacy Policy

oneorthree (the “Team”) operates Cattus and processes users' personal information. This Policy explains what information Cattus processes, why it is processed, who can see it, when it is deleted, and how to exercise your rights under applicable laws, including the Personal Information Protection Act of Korea.

The deletion and retention notice has been corrected based on service code and settings reviewed on October 22, 2026. The settings below do not constitute verification of their application in the actual deployment environment or external service contracts, or of completed deletion of an individual user's data. Unconfirmed processing and periods are identified separately in the text.

Airbridge processing notice corrected: November 1, 2026. App versions with the Airbridge SDK enabled are implemented to start advertising measurement at app launch and send the signed-in account’s internal user ID to Airbridge. The earlier “planned introduction” and “account IDs are not directly transmitted” statements are corrected below. This correction does not establish when collection began in every installed app or confirm that consent, withdrawal controls or external data deletion have been verified.

1. Data Controller and Contact

You may use this email address to request access to, correction or deletion of, or restriction of processing of your personal information, withdraw consent, close your membership, or submit an objection.

The designated title of the privacy officer or responsible department has not yet been confirmed. The address above is the currently available contact for privacy inquiries and exercising your rights; we do not substitute an unconfirmed person's name or department.

2. Personal Information We Process, Purposes, Legal Basis, and Retention

The Team processes the information below only to the minimum extent necessary to provide the service. We distinguish information needed to provide the service and maintain safety from information processed when you choose to use optional features.

2-1. Processing Needed to Provide the Service

When you sign in as a member, the Team does not store your email address or profile name from the social sign-in provider. Authentication tokens are used to verify sign-in and are not retained as a permanent personal information item.

The three years after consent withdrawal or account closure for consent records, and the three years after processing is completed for report and appeal records, are periods for handling disputes stated in the previous document. We have not confirmed them as uniform statutory requirements, and the basis for the decision to adopt them as internal rules also requires further confirmation. This revision does not extend the previously stated three years. The necessity and basis for retention, and actual deletion when the period expires, require confirmation.

2-2. Screen-Time and Analytics Information: Scope of Consent Handling Confirmed

In app versions offering AI focus measurement, entering the Fishing Island screen or changing a feature state may send usage information to PostHog, including measurement on/off, preview open/closed, and whether the user is before or during a focus session. Internal user and device identifiers may also be linked to these events, so we do not describe them as anonymous. Camera video or images, model detection results or scores, and verified time are not included in these analytics events. The measurement switch controls camera-based AI analysis; it does not enable or disable all general product analytics.

Stopping new collection after consent is withdrawn and deleting data already collected are separate actions. We have not confirmed that the current analytics features wait for individual consent before starting collection or stop automatically after consent is withdrawn. We therefore do not describe “starting only after separate consent” or “stopping future collection when consent is withdrawn” as guarantees of current behavior. This change does not authorize collection without consent; consent and collection-stopping functionality need to be improved (Section 7).

2-3. Information Processed Only on Your Device

The list of apps to block or allow during focus is stored only on your device and is not sent to Cattus servers. It may be lost if you delete or reinstall the app or change devices, in which case you will need to select apps again.

2-3-1. Optional Camera-Based AI Focus Measurement

The following applies to app versions offering AI focus measurement. This optional feature is available on Fishing Island. You can use the ordinary focus timer even if you decline camera permission or do not use this feature.

• Information and purpose: AI models on your device check camera frames for a hand together with a study tool such as a book, laptop, or keyboard, and use the results to estimate verified time. The feature does not authenticate you by your face or identify people. It estimates whether visible study conditions are met and does not guarantee your actual mental focus or an exact duration of concentration.
• Starting and permission: Camera measurement operates when you turn on the AI focus measurement switch and allow operating-system camera access. If you press Preview while measurement is off, the app asks you to turn on measurement; that action alone does not automatically enable it.
• Preview and periodic checks: Before starting a focus session, the preview lets you check detection feedback frequently. During focus, the app checks three camera frames approximately every 20 seconds. These periodic checks continue with the preview closed if measurement remains on. When the preview is closed, camera capture stops between checks. While the preview is open, the camera may remain on to display live video.
• Stopping and withdrawal: Turning off measurement stops AI analysis and accumulation of verified time. If the preview is open, video display alone may remain active. Camera capture and analysis for this feature stop when the app enters the background or you leave the Fishing Island screen. You can revoke camera permission in operating-system settings.
• Video and audio: Frames are processed temporarily in device memory and then released; they are not saved as photo or video files. Video and images are not shared with or transmitted to Cattus servers, other users, external AI services, or analytics services, or provided for model training. This feature does not use the microphone or record, store, or transmit audio.
• Detection and verified-time retention: Detection results and verified time are processed temporarily in memory during the current app run, and verified time is shown on that focus session's result screen. They are not separately saved to disk, focus history, or servers or disclosed to other users, and disappear when the app terminates. The statement that video and verified time are not saved or transmitted does not mean that the feature-use analytics events described in Section 2-2 are not transmitted.

2-3-2. Optional Android Return-to-Focus Feature

This section applies to Android versions that provide the return-to-focus feature. During a focus session started by the user, an accessibility service brings the existing Cattus screen to the foreground when the user opens an app outside their allowed list.

• Separate consent and permission: the app explains the information accessed and its purpose before the user chooses to agree and open accessibility settings. The user must also enable the service in Android settings. Declining does not prevent use of other app features. This permission is separate from usage access for screen-time measurement.
• Information accessed: the app identifier (package name) and Activity type from app-window transition events are compared with the allowed-app settings. The service does not read screen text, images, messages or typed input, and does not perform accessibility gestures.
• Processing and storage: detected app-transition information is compared only in device memory. It is not saved as an activity history or sent to our servers or analytics services. The allowed-app list selected by the user, consent status and the account identifier that owns the settings are stored separately in app storage to retain the configuration. Storing these settings is different from storing app-transition history. Android system backup and device transfer follow the user's OS settings and the relevant service policies.
• Scope: requests to confirm the current focus session use session and account information, without transmitting the detected package names of other apps. Existing focus records, screen-time totals and product analytics follow their respective disclosures. Local processing for this feature does not mean that the app as a whole collects no data.
• Stopping: taking a break, ending focus, signing out or withdrawing consent deactivates the return feature. It can be disabled in the app settings or Android accessibility settings. Disabling it does not delete the allowed-app list or existing focus records. Switching accounts does not carry the previous account's allowed-app settings or accessibility consent into the new account.
• Essential functions: phone calls, system settings, the home screen and essential system functions are excluded. The feature does not prevent users from disabling permissions or uninstalling the app. Availability may vary with the device manufacturer, OS, service connection and network conditions.

2-4. Airbridge Advertising Measurement

App versions with the Airbridge SDK enabled use Airbridge to measure advertising acquisition, installations and subsequent basic app activity, separately from other product-analytics and error-monitoring tools. The transmission implemented in the app is described below.

2-5. App Diagnostics and Direct Meta App Events

Sentry diagnostics: Release versions that include Sentry initialize error collection when the app starts. To diagnose crashes and JavaScript errors, the app may send error messages and stack traces, occurrence times, app version and environment, device and OS information, and breadcrumbs surrounding an error to Sentry. The app's default ingestion endpoint is in the US region. This is separate from PostHog product analytics and Airbridge advertising measurement. This feature does not implement transmission of camera video or audio; that does not mean all personal information inside an error message is automatically removed.

Meta app SDK and app Conversions API (CAPI): Android versions containing this SDK are configured to initialize Meta at app startup and log automatic app events. Within the limits of device settings and SDK availability, advertising identifiers, installation and activation events, SDK installation identifiers, and app/device information are used for advertising measurement and conversion deduplication. The first island arrival event is implemented through both the SDK and server CAPI. The server path includes the event name, time and deduplication event ID; SDK installation identifier (anon_id); request IP; advertiser-tracking and application-tracking states; and app/device information (extinfo, such as app ID/version, OS, model, language, display size and time zone). The name anon_id does not mean the information is irreversibly anonymous.

These direct app transfers are separate from Airbridge transfers to advertising channels and from the preregistration website's Meta Pixel and CAPI. Consent on that website, screen-time/accessibility permissions, and AI Focus Measurement settings do not constitute consent to app advertising tracking. iOS ATT and Android advertising-ID restrictions affect the use of the relevant identifiers; they do not automatically stop all diagnostics/app events or delete previously transmitted information.

The Sentry recipient is Functional Software, Inc. (Sentry). Meta information is received by the Meta entity providing the applicable app business tools. Transfers occur over the network during service use. Processing countries, legal entities and contractual roles depend on the applicable service agreements and transfer terms. Apart from the verified US Sentry ingestion endpoint, we do not claim to have verified every actual processing country. Project-specific retention settings, the basis for cross-border transfers and completed deletion require separate confirmation. We do not promise automatic deletion after a particular period without verifying it.

For access, processing restrictions or deletion of diagnostic/advertising information, contact our privacy support. Do not send passwords or verification codes. After verifying ownership, we identify the relevant recipients, including Sentry and Meta, distinguish requests to stop new collection from deletion of historical remote data, and explain the processing actually completed. Account closure or resetting identifiers on a device is not represented as proof that all external data has been deleted. On November 12, 2026, the Sentry organization showed the Developer plan and US region. The official Sentry retention table lists 30 days for errors on that plan. Historical events may retain the conditions of the plan at collection; this does not guarantee completed deletion of all data. Meta Business Tools Terms permit retention of Event Data for up to two years and of audiences created from it until the audience is deleted. This is not a promise that all data associated with this app is automatically deleted after two years.

See PostHog’s event retention and data storage documentation for the distinction between events and profiles. Observing a dashboard retention setting is separate from confirming deletion of an individual’s data.

3. Children Under 14

Cattus currently accepts users who are at least 14 years old. We confirm that age before an account or guest account is created. We do not allow children under 14 to sign up until we provide a process for obtaining consent from a legal guardian for those children.

4. Information Visible to Other Users

Cattus shows some information to other users so they can focus together and operate islands. We explain and confirm the visibility below before you create or join your first island.

“Always visible” means residents of the same island cannot hide this information from one another; it does not mean it is visible to the entire internet. We also remind users not to enter sensitive information in free-text fields such as to-do names and reviews.

5. Disclosure to Third Parties

The Team does not sell personal information. Personal information is transferred to the external diagnostic, analytics and advertising services described in Sections 2 and 6; we do not state that no external disclosure occurs. Required notices and consent for processing, third-party disclosure and cross-border transfers depend on each recipient’s contractual role and processing scope. Showing the information in Section 4 to a recipient you choose or residents of the same island is a core Cattus function.

If a third-party disclosure becomes necessary, we will first tell you the recipient, purpose, information, retention period, and effect of refusing consent, and obtain any consent required.

6. Entrusted Processing and Cross-Border Transfers

The Team uses the external services below to provide the service. Personal information is transferred over a network while the service is being used.

Provider privacy contacts are PostHog, Datadog, and Google/Firebase privacy inquiries. Requests concerning your Cattus account can be sent to the Team's email address in Section 1.

The applicable basis for cross-border transfers, the full list of actual destination countries, and the contractual scope of recipient entities require further confirmation. Saying that a service contract requires processing does not establish a lawful basis for every analytics or log transfer. You may email the Team to object to transfers or withdraw consent. Turning off device notification permission restricts receipt of notifications but does not delete installation IDs or records already transferred. Automatic stopping of analytics collection and the effect of refusal on service use have not yet been confirmed, so receipt of an email request is not described as completed cessation of collection.

6-1. Log Types and Retention Settings

Disclosing these settings does not establish a blanket exception allowing continued retention of records concerning users who have closed their accounts. For records that must be retained for security, fraud prevention, legal obligations, or other purposes, the information, purpose, applicable basis, period, and conditions for ending retention must each be confirmed. We do not conclude that retention of currently unverified records is justified.

6-2. FCM Tokens and Firebase Installation IDs

Deactivating a token on the notification server during account closure is not a request to delete a Firebase installation ID. We have not confirmed a call to the Firebase installation ID deletion API in the current account-closure procedure. Final deletion of the tokens and user IDs remaining on the notification server, and who will request deletion from Firebase and when, have not been established.

Google's stated maximum of 180 days concerns removal of related information from active and backup systems after the app operator or the client for that installation actually calls the Firebase installation ID deletion API. It is not a period that starts automatically on account closure, withdrawal of notification permission, or token deactivation.

6-3. Airbridge and Advertising Channels

App versions with the Airbridge SDK enabled use Airbridge from AB180 Inc. Account and device identifiers and basic events and properties in Section 2-4 are transmitted over the network for advertising acquisition, installation and basic-activity measurement. The actual contracting entity, processing and storage countries, subprocessors, transfer timing, method and basis, retention period and deletion request and completion-verification procedures require further confirmation using the contract and dashboard. Countries and retention periods for PostHog or other services are not applied to Airbridge.

Advertising-material and campaign management in Airbridge GO is separate from event collection by the app’s Airbridge SDK. Our rule for advertising materials excludes users’ account IDs, email addresses and free-text content, while the app SDK is implemented to receive internal user IDs as described in Section 2-4.

Advertising-channel integrations are limited to channels where we actually run ads. Connecting Google and Meta advertising accounts in Airbridge GO does not itself obtain an individual user’s consent. The information, purposes, recipients and processing relationship for each actual platform, required notices and consent, and ATT compliance require separate verification; publishing this correction does not complete that verification.

7. Automatic Collection and Behavioral Information

The app may automatically generate access and error logs and product-use events. The app initializes PostHog at startup. App versions offering AI focus measurement disable PostHog Session Replay. Earlier app versions may collect Session Replay according to their settings at the time; disabling it in a newer version does not delete past replays. Functionality that blocks collection before individual consent or stops it automatically after consent is withdrawn has not been confirmed and needs improvement. Consent-withdrawal requests may be sent to the email address in Section 9; receipt of a request and confirmation that new collection has actually stopped are distinct.

PostHog is configured to disable IP-based location estimation and to mask input fields, images, and similar content. These settings alone do not guarantee that IP addresses are never processed during transmission or that personal and authentication information is completely removed from all screens and events. The data actually transmitted needs to be verified to ensure authentication information is not collected.

Stopping new collection, deleting past events, user information, and replays following account closure, and handling a separate personal information deletion request are distinct actions. Resetting the analytics identifier after account closure does not delete stored analytics data or anonymize it so that reidentification is impossible. Integration with remote analytics-record deletion and verification of completion have not been validated. Receipt of a deletion request by email is not described as completed deletion of records held by external analytics services.

The Meta Pixel and Conversions API on the pre-registration website are covered by a separate pre-registration privacy notice and advertising measurement consent. That consent does not replace consent to join the Cattus app.

Versions with the Airbridge SDK enabled are implemented to start collection at app launch and set the signed-in account’s internal user ID. App-level collection consent and iOS ATT or Android advertising-ID settings are distinct; refusing ATT or turning off AI focus measurement does not itself stop all Airbridge events. Pre-consent blocking, automatic stopping after withdrawal and verification of transmissions from the actual release build still require improvement. Receiving requests, clearing user information, stopping new collection and deleting past remote data are distinct actions. Requests may be sent to the email address in Section 9.

8. Deletion and Account Closure

Personal information must be deleted when its retention period ends or it is no longer needed for its purpose. However, the account-closure processing currently confirmed has the scope and limitations below. “Deletion” means removal of the relevant stored data; “disconnecting from the account” means removing a user reference. Disconnection or resetting an identifier alone does not establish that data has been anonymized so that reidentification is impossible.

When you close your account:

1. Login sessions are invalidated, and authentication credentials and social sign-in links are erased. This does not delete all authentication session records and user IDs. Notification tokens are deactivated on a separate server; this is distinct from deleting tokens and user IDs.
2. Original measurements of total usage by device and date and usage reports for time intervals are deleted from the production database during account closure. Daily screen-time aggregates are disconnected from the user. This is not described as deletion of all original app-by-app usage records.
3. The internal UUID in the account record and user identifiers in some membership, settlement, and reward records remain. User-and-week records used to prevent duplicate payouts also remain. Identifiers that can be linked to other records are not described as anonymous information. The final deletion period and conditions for ending retention for each remain unconfirmed.
4. Shared records, including island fish, ledgers, and notices, remain to preserve other residents' activity and settlement records. Some records, such as notices, are disconnected from their authors, but user identifiers are not removed from every record. In island chat, stored content and internal sender IDs remain even when the sender is hidden from view. The shared-record rule “while the island exists” does not substitute for a retention period for personal identifiers.
5. Comments and guestbook entries are deleted on account closure. Closing a friend letter hides it from view rather than deleting its content. We have not confirmed that account closure alone deletes personal information within friend letters and all shared posts and attachments. Removing an author link and removing personal information within content must be distinguished and checked as subjects of separate deletion requests.
6. Automated database backups have a seven-day retention setting. This is a setting for the backup retention cycle, not a guarantee that all copies are removed within seven days of receiving an account-closure request or deleting production data. Retention and deletion times for manual and final snapshots, restored copies, and copies of attachments require separate confirmation.
7. Logs, error records, and analytics records are not all automatically deleted together with the account. Disclosure of rotation, expiration, or query-access periods in Section 6 does not by itself justify continued retention. Integration with deletion and verification of completion for past PostHog data, notification tokens, remaining identifiers, and similar data, and specific grounds for retention exceptions, are still needed.

Leaving an island is different from closing your membership. Your account and personal records remain when you leave an island. If the owner deletes an island with no other residents and closes their account, shared data subject to deletion, such as shared fish, ledgers, and notices, is removed. This does not delete every record, including the island's closed-status marker, memberships, and existing settlement records.

Requests to restrict or delete Airbridge-related analytics data are accepted through the Team email address in Section 1 (nappaegonoljima@gmail.com). We use only the minimum identifiers needed to verify a request and do not request passwords or verification codes. Stopping new collection, resetting on-device identifiers or user information, and deleting data already sent to Airbridge are distinct. Account closure or identifier reset alone is not described as automatically deleting past Airbridge data. We follow the external service's procedure and report as complete only the processing actually verified as complete.

9. Your Rights and How to Exercise Them

You may request access to, correction or deletion of, or restriction of processing of your personal information, withdraw consent, or close your membership. Send a request to nappaegonoljima@gmail.com. After verifying your identity, the Team will handle it under the procedures required by applicable law and notify you of the result.

1. Sending a request: You can email the address above without installing or reinstalling the app or signing in. Include the nickname you used in the app, your sign-in method, and the type of request: withdrawal of consent, deletion of your account and associated data, or deletion of specific personal information.
2. Identity verification: Only the minimum information needed to confirm account ownership will be checked. Do not send passwords, verification codes, or social sign-in passwords. A nickname alone does not establish ownership. You may mention that you use a guest account, have the same nickname as another user, or cannot access the app, but the specific additional verification procedures for these situations have not yet been established.
3. Processing: Stopping new collection, processing production database data, handling past data held by external services, and retention exceptions are checked separately. An island owner with other residents currently needs to transfer ownership before closing their account in the app. Procedures for ownership transfer and account closure by email for an owner who cannot access the app have not been established, so completion by email alone is not guaranteed.
4. Reporting the result: The Team distinguishes the actions actually completed, remaining data, and reasons for incomplete processing. A practical estimated processing time and a deletion completion deadline covering external services and backups have not yet been established. Receiving a request is not treated as completed deletion.

You may withdraw consent for optional features by email. Exercising your rights will be no more difficult than the way your information was collected. If a legal reason requires us to deny or limit a request, we will explain the reason and how to object.

10. Security Measures

The Team applies technical and organizational measures to protect personal information, including limiting access, protecting authentication information and data in transit, managing access logs, responding to vulnerabilities and malware, restricting access to backups, and reviewing service providers.

11. Remedies and Advice

For advice or to report a personal information incident, you may contact:

• Personal Information Infringement Report Center: 118 (no area code) · privacy.kisa.or.kr
• Personal Information Dispute Mediation Committee: 1833-6972 · kopico.go.kr
• Personal Information Protection Commission: pipc.go.kr

12. Changes and Language

When this Policy changes, we will announce its effective date and the main changes in the app or on the official website. Changes that significantly affect your rights will be clearly announced before they take effect or as soon as they take effect, and we will obtain renewed consent when required.

The Korean version of this Policy controls. If translations differ in meaning, the Korean version controls, without limiting any mandatory rights under the laws of your country or region of residence.

This Policy takes effect on September 27, 2026.

Wording revised: October 22, 2026. The original effective date is unchanged. This revision corrects the previous notice by distinguishing deletion of original screen-time measurements from disconnection of aggregates; hiding friend letters from view; remaining identifiers; log and backup retention settings; and limitations of analytics collection and deletion and Firebase installation ID deletion. It does not newly authorize unconfirmed retention periods or mean that deletion functionality in the app or backend has been improved.

Airbridge processing notice corrected: November 1, 2026. The October 28 introduction draft is corrected regarding processing in SDK-enabled versions and transmission of account IDs. This reflects the implemented internal user ID, login provider or account conversion, focus duration and fish-earned properties, and collection-start and stopping limitations. The original effective date is unchanged. It does not confirm collection start dates in each installed version, contractual processing conditions, consent and withdrawal controls or completed external deletion.

AI focus measurement notice added: November 1, 2026. This addition covers camera permission, periodic checks, preview and stopping controls in versions offering the feature; no video or audio storage or transmission; temporary processing of detection results and verified time; and the feature states and identifiers sent for product analytics. The original effective date and the deletion and retention notices above remain unchanged. Publishing this Policy does not activate the camera feature or constitute user consent.

App SDK disclosure update: November 12, 2026. Added the existing app’s Sentry and direct Meta SDK/app CAPI processing paths. This does not constitute new consent or claim that unreleased reporting/account-deletion changes have been deployed.