Effective date: 2026-10-18
This page was translated by AI.
In case of any discrepancy between this translation and the Korean original, the Korean original prevails.
한국어 원문Taeho Park (Tirang) (the "Operator") complies with applicable law, including the Personal Information Protection Act (개인정보 보호법), and processes the personal information of users of the Th. Services as described below. The Th. Services are non-profit services run by an individual. This policy applies to all services that the Operator makes publicly available under the name Th. Systems, including services added in the future.
| Category | Items | How collected |
|---|---|---|
| Account information | Unique identifier of the social account, email address, name or nickname (as provided by the social login provider), the ID and nickname chosen by the user, a profile photo uploaded by the user (optional), and the version and time of consent to the terms | Provided by the social login provider (Google, Kakao, Naver) at sign-in; entered by the user |
| Usage information | Information the user enters or creates while using service features and the related usage records (for example, short links a user has created and their click counts, and likes given while signed in (the internal identification number and public identifier hash of the account that gave the like, its target, and its time)); comments left on blog posts (the text, the nickname at the time, the internal identification number of the account, and the time) and reports of comments (the internal identification number of the reporting account, the reason, and the time); a one-way hash of connection information such as the IP address used to prevent duplicate view counts (kept only in server memory and never stored in files or the database) | Entered by the user; automatic during use |
| Subscription information | The services the user chose to receive new posts from by email, and the times of subscribing, changing and unsubscribing | Chosen by the user |
| Website information | Information the user enters when creating a User Site: the address of a public Notion page (page identifier), the site address name, the site name, description and menu, the chosen favicon, and images uploaded by the user (such as a cover image or favicon; the server keeps a copy); and a cache of the page content and files fetched from Notion to show the User Site | Entered by the user; fetched automatically from Notion |
| Connected domain information | The domain name the user wants to connect to a User Site, the name of the domain provider identified from the domain's name servers, and domain names the Operator has blocked from being connected | Entered by the user; automatic when checking the connection |
| Site visit statistics | View counts of a User Site by site, page and date (Korea Standard Time), and the host name of the site visitors came from (only the host part of the referrer). Visitors' IP addresses, cookies and browser information are not stored | Automatic during visits |
| Report and inquiry information | The content written in a report of a User Site or an inquiry about domain ownership, the site or domain concerned, and contact details (optional). The IP address of the person making the report or inquiry is not stored | Entered by the user (no sign-in required) |
| Problem report information | The details of a problem report that the user writes on the report screen, the address of the page it was sent from, and a reply email address (optional; if the report is sent while signed in, the account's email address) | Entered by the user |
| Premium information | Records of the Premium Codes the user has entered (the code used and the time of use), and the date Premium ends | Entered by the user; automatic when a code is used |
| Automatically generated information | Access records (IP address, browser and device information, access date and time), records of authentication token issuance and expiry, and a hash of the email verification code used to confirm identity for requests such as account deletion (it becomes invalid after 10 minutes) the number and times of repeated wrong codes (used to lock the deletion procedure for 24 hours), and account deletion records (internal identification number, time, step and the result for each connected service; no email address or name), records of unsubscribing from emails (internal identification number and time), and the account's internal identification number and public identifier hash created at sign-up, and the time the account was created | Automatically generated |
Comments are shown on the page of the post together with the nickname at the time and the time they were written. Other account information, such as the email address, is not shown.
What appears on a User Site is public and can be viewed by anyone. If a user puts personal information in a Notion page, that information is also made public, so the user decides what to publish.
The Operator does not receive or store the passwords of social accounts; authentication is performed through the social login provider.
The details of a problem report and the reply email address are not stored in the service's database; they are only forwarded to the Operator by email, and that email is kept in the Operator's mailbox as described in Section 4.
Only the result of the user's cropping in the browser is transmitted, and the server re-saves it as a 256×256 WebP image. The original photo's metadata (EXIF) is not retained in this process. Users can change or delete their photo at any time on the profile screen, and deleting it also deletes the file on the server. Profile photos from social login providers are not imported.
Personal information is destroyed without delay when the user withdraws or when the purpose of processing has been achieved. If the law requires retention, or if this Section sets a separate period, it is kept for that period.
Problem report emails (the details of the report, the address of the page it was sent from, and the reply email address) are kept in the Operator's mailbox for one year after the handling of the report is finished, and are then destroyed. A report whose handling is not finished is kept until it is.
Visit statistics for User Sites are kept for 90 days and then deleted. Domain registrations that have not been connected are deleted after 14 days. Domain names the Operator has blocked from being connected are kept on a block list so that they cannot be connected again.
When a user withdraws, the information of that account remaining in each service used with Th. ID (for example, short links, User Sites and connected domains, and images uploaded by the user), the record of unsubscribing from emails, Premium information (records of Premium Code use and the date Premium ends), the existing activity records (including points and tier) that are no longer newly collected but still remain, and subscription information are also deleted. Likes are changed so that no one can tell who gave them, and only their count remains; blog comments remain with only their text, with the author information removed and shown as "Deleted user"; blog reports made by that person remain, but the reporter is changed so that no one can tell who made them; view counts also remain. Account deletion records are kept for one year to confirm the deletion and then deleted. However, so that the public identifier hash is never reassigned to another user, only the account's internal identification number, public identifier hash and sign-up time are kept, and these values are not linked to any other information. Connected services keep only an irreversible hash of the deleted account's identifiers so that nothing can be recorded again through a leftover session of that account.
The service database is backed up daily, and backups are automatically deleted after 14 days on the server and after 30 days in the offsite storage abroad. Accordingly, information as of just before withdrawal may remain in backups for up to 30 days; these backups are used only for disaster recovery.
When the retention period has passed or the purpose of processing has been achieved, information in electronic files is promptly deleted by a method that makes it impossible to recover or reproduce.
The Operator does not provide personal information to third parties, with the following exceptions.
The social login providers (Google, Kakao, Naver) are not processors but authentication methods chosen by the user, and the only items the Operator receives from them are the social account's unique identifier, email address, and name or nickname.
When a user plays a video on a work page, the user's browser loads the player of the video service concerned (YouTube or Vimeo). At that time, connection information such as the user's IP address is sent directly to that service, and that service may set cookies. This does not pass through the Operator, and the terms and privacy policy of that service apply. The player is not loaded before playback is requested.
To show a User Site, the Operator uses the page identifier entered by the user to fetch the content and files of the public page from Notion (Notion Labs, Inc.) and serves them to visitors itself. Visitors' browsers do not connect directly to Notion to view this content.
External content embedded in a Notion page (such as YouTube or X (Twitter)) is loaded by the visitor's browser connecting directly to the service concerned. At that time, connection information such as the visitor's IP address is sent directly to that service, and that service may set cookies. This does not pass through the Operator, and the terms and privacy policy of that service apply.
To check the connection of a connected domain, the Operator looks up that domain name with public DNS resolvers (1.1.1.1 of Cloudflare, Inc. and 8.8.8.8 of Google LLC). Only the domain name is used in these lookups.
| Processor | Outsourced task | Location |
|---|---|---|
| Oracle Corporation (Oracle Cloud Infrastructure) | Operating servers and databases | Republic of Korea, Chuncheon region (ap-chuncheon-1) |
| Cloudflare, Inc. | DNS, CDN, traffic protection and access routing; receiving and forwarding email sent to the Operator's address (inquiries and problem reports); human verification on the report and inquiry screens (Turnstile) | Global edge network |
| Notion Labs, Inc. | Providing the content and files of the public Notion pages shown on User Sites | United States |
| Discord Inc. | Notifying the Operator (delivering notice of received reports and inquiries with a summary of their content) | United States |
| Google LLC (Gmail) | Operating the Operator's mailbox (keeping inquiry and problem report emails) | Google data centers in the United States and elsewhere |
| Cloudflare, Inc. (R2) | Storing backups for disaster recovery | Asia-Pacific |
| Sendinblue SAS (Brevo) | Sending emails such as notices of amendments to the terms and this policy, identity verification codes, problem report emails and new post notification emails | France |
After the processors above deliver a problem report email or other email sent to the Operator's address to the Operator's mailbox, it is kept in the Operator's mailbox for the period in Section 4.
The servers and database of the services are located in the Republic of Korea (Chuncheon). However, personal information is transferred abroad as described below for protecting access routes, storing backups for disaster recovery, sending notification, identity verification, problem report and new post notification emails, receiving and keeping email sent to the Operator's address, fetching the Notion pages shown on User Sites, and human verification and Operator notification for reports and inquiries. Users may refuse the transfer by notifying tea@trh.kr or by deleting their account; in that case, use of the services may be restricted.
| Recipient | Country | Items transferred | When and how | Purpose | Retention |
|---|---|---|---|---|---|
| Cloudflare, Inc. | United States and global edge network | Communication data such as IP addresses and request headers generated during access | Transmitted over the network when the user accesses the services | DNS, CDN, traffic protection | According to Cloudflare's policy |
| Cloudflare, Inc. (Turnstile) | United States | Connection information such as the IP address, and browser information, of the browser that opened a report or inquiry screen | Sent directly by the browser when the report or inquiry screen is opened | Human verification to prevent automated reports and inquiries | According to Cloudflare's policy |
| Notion Labs, Inc. | United States | The Notion page identifier entered by the user (used to retrieve the content and files of the public page) | Requested over the network by the Operator when showing a User Site | Fetching the page content and files shown on User Sites | According to Notion's policy |
| Discord Inc. | United States | A summary of the content of reports and inquiries | Transmitted over the network when a report or inquiry is received | Notifying the Operator | According to Discord's policy |
| Cloudflare, Inc. (Email Routing) | United States | Email sent to the Operator's address (the content of inquiries and problem reports, and the sender's and reply email addresses) | Transmitted over the network when the email is received | Forwarding to the Operator's mailbox | Not kept after forwarding |
| Google LLC (Gmail) | United States | Email sent to the Operator's address (the content of inquiries and problem reports, and the sender's and reply email addresses) | When the email is forwarded | Keeping the Operator's mailbox and replying | One year after handling is completed (Section 4) |
| Cloudflare, Inc. (R2) | Asia-Pacific region (may be stored outside the Republic of Korea) | The entire service database backup (encrypted with AES-256-GCM before transfer; the decryption key is kept only on servers in Korea) | Automatically transferred once a day | Storing backups for disaster recovery | Automatically deleted 30 days after transfer |
| Sendinblue SAS (Brevo) | France | Email address and email content (notices, identity verification codes, the details of a problem report and its reply email address, new post notifications) | When an email is sent | Sending notification, identity verification, problem report and new post notification emails | Until the purpose of sending is achieved (a problem report email that has reached the Operator's mailbox follows Section 4) |
Users may at any time request access to, correction of, deletion of, or suspension of processing of their personal information, and may withdraw consent. You can do this yourself on the profile screen or by request to tea@trh.kr, and you can delete your account (withdraw from membership) from the account screen by entering a verification code sent to the account's email address. Accounts without an email address are deleted with the user's consent and a typed confirmation sentence only. Upon withdrawal, the account and the information in the services used with Th. ID are deleted without delay (for the values that are kept and for backups, see Section 4).
For reports of and consultation on privacy infringement, you may contact the Personal Information Infringement Report Center (privacy.kisa.or.kr, 118), the Supreme Prosecutors' Office Cyber Investigation Division (1301), or the National Police Agency Cyber Investigation Bureau (182).
When this policy is amended, the change is announced on the Th. Services 7 days before it takes effect (30 days before for changes unfavorable to users). The Operator may also notify users by email.
This policy takes effect on 2026-10-18. The previous version is available here.