English
Privacy Policy
This is a translation for reference. If anything differs, the Korean version applies.
In short
- You sign up with an email and a password. We do not ask for your name, phone number or address.
- Messages, photos and doodles are stored locked and deleted after 24 hours.
- Nothing is sold or handed to another company. The servers run on Cloudflare.
- Delete your account and it goes right away (up to 30 days later in backups).
- If someone reports a message, the operator sees it and up to 10 messages before it. Report records are deleted after a year.
- You must be 14 or older to sign up.
- Questions are welcome at support@hammerturtle.xyz.
Hammer Turtle Lab (representative Kim Jaehyeon) (the "operator") processes the personal data of users of Huggybugi (the app, the web chat and this website, the "service") under the Korean Personal Information Protection Act, and sets out this privacy policy.
Article 1 (Purposes and legal basis)
The operator processes personal data for the purposes below. If a purpose changes, notice is given in advance and the required steps are taken.
| Purpose | Legal basis | Consent |
|---|---|---|
| Sign-up, sign-in, identity checks, verification and password reset email | Entering into and performing a contract (Act art. 15(1)(iv)) | Not required |
| Providing the service: groups, characters, chat | Performing a contract (Act art. 15(1)(iv)) | Not required |
| Preventing abuse (password stuffing, sign-up spam) | Legitimate interest (Act art. 15(1)(vi)) | Not required |
| Reviewing reports and acting on them (harassment, spam, inappropriate pictures) | Legitimate interest (Act art. 15(1)(vi)) | Not required |
| New message notifications in the web chat | Consent of the data subject (Act art. 15(1)(i)) | Your browser asks when you turn notifications on, and the data is deleted when you turn them off |
No automated decisions (decisions that affect your rights or duties without a person involved) are made.
Article 2 (Personal data processed)
| Category | Data |
|---|---|
| Sign-up | Email, password (stored in a form that cannot be reversed), acceptance of the terms (confirming you are 14 or older) and the time you accepted |
| Groups | Your nickname in the group, the character you picked, your status text, your bubble styling |
| Service use | Messages, photos, link cards, doodles, reactions and read marks, the character, item and emote images and sounds you upload, GIF favorites (GIF ids) |
| Generated automatically | Action counts (by date), time the app was running, session records (IP address and device info), sign-in and sign-up attempt counts (by IP and email), feature use counts (GIF search, link cards, photo uploads), the time email was sent |
| Web notifications (optional) | Your browser push endpoint |
| Reports | Who reported and who was reported, the reason chosen and any note, the reported message and up to 10 messages before it (unlocked by the server with the group key), and the name and file location of a reported character, item or emote |
No sensitive data, unique identifiers or pseudonymized data are processed. Messages, photos, link cards and doodles are stored encrypted with a group key, and the server keeps that key.
Article 3 (Retention periods)
| Data | Retention |
|---|---|
| Messages, photos, link cards, doodles, group notices | 24 hours after they are created |
| Time email was sent, sign-in and sign-up attempt counts, feature use counts | 24 hours |
| Verification and password reset links | Until they expire (at most 24 hours) |
| Session records | Until you sign out or they expire (at most 1 year) |
| Web notification push endpoint | Until you turn notifications off or your browser drops the endpoint |
| Report records | 1 year after the report (kept even if either person deletes their account) |
| Everything else | Until you delete your account |
No personal data is kept separately under any statute.
Article 4 (How data is destroyed)
- The server deletes data past its retention period automatically every hour. Deleting your account deletes it right away.
- Electronic files are deleted so they cannot be recovered. Database backups keep them for up to 30 days, after which they disappear automatically.
- No personal data is handled on paper.
Article 5 (Sharing with third parties)
The operator does not share personal data with third parties, except where a statute specifically requires it.
Article 6 (Processors)
| Processor | Work entrusted |
|---|---|
| Cloudflare, Inc. | Running the servers, database and file storage |
| Plus Five Five, Inc.(Resend) | Sending verification and password reset email |
| Google LLC(Gmail) | Operator's mailbox (receiving support emails) |
| GIPHY, Inc. | GIF search and serving the images |
| GitHub, Inc. | Hosting this website, serving the installers and updates |
| Apple Inc., Google LLC, Mozilla Corporation | Delivering web notifications (whichever one matches your browser) |
Article 7 (Transfers abroad)
The operator transfers personal data abroad for the processing and storage needed to perform the service contract, and publishing this article serves as the required notice (Act art. 28-8(1)(iii)(a)).
| Recipient (contact) | Country | Data | Purpose | Retention |
|---|---|---|---|---|
| Cloudflare, Inc.(privacyquestions@cloudflare.com) | United States (data centers worldwide) | Everything in Article 2 | Servers and storage | Same as Article 3 |
| Plus Five Five, Inc.(support@resend.com) | United States | Email address and message contents | Sending email | As long as the send record is kept |
| Google LLC (Gmail, see Google's privacy policy) | United States | Contents of support emails | Operator's mailbox | Once the request is handled |
| GIPHY, Inc.(giphy.com/privacy) | United States | GIF search terms, the IP address used to load an image | GIF search and display | Per that company's own policy |
| GitHub, Inc.(privacy@github.com) | United States | IP address | Serving the website and installers | Per that company's own policy |
| Apple, Google, Mozilla (see each company's privacy policy) | United States | Push endpoint, encrypted notification | Delivering web notifications | Until the notification is delivered |
- When and how: sent over an encrypted connection each time you use the service.
- How to refuse and what happens: if you do not sign up, or you delete your account, nothing is transferred. The service cannot be provided without these transfers. Turning web notifications off stops that transfer.
Article 8 (Your rights, duties and how to use them)
- You can ask to see, correct, delete or transfer your personal data, ask that processing stop, or withdraw consent, at any time.
- Your nickname, status text and uploaded images can be changed or deleted in the app, and you can delete your account under Settings > Account.
- For anything else, write to the contact in Article 12 and you will hear back within 10 days. You may also act through a representative.
- If you ask for a transfer, your personal data is sent to you by email as a JSON file.
- You must look after your own account and password, and must not upload or infringe anyone else's personal data.
Article 9 (Children under 14)
Children under 14 cannot sign up, and age is confirmed at sign-up. If the operator learns that data from a child under 14 has been processed, it is deleted immediately.
Article 10 (Security measures)
- Passwords are stored in a form that cannot be reversed (one-way hashing).
- All traffic is encrypted with https, and messages and photos are encrypted again with the group key.
- Sign-in and sign-up attempts are rate limited.
- Only one person, the operator, can reach the servers and the database.
Article 11 (Automatic collection)
No cookies are used. The web chat keeps your session and display settings in browser storage (localStorage), which goes away when you sign out or clear site data in your browser. No advertising or behavioral analytics tools are used.
Article 12 (Data protection officer)
- Business name: Hammer Turtle Lab
- Business registration number: 794-02-03917
- Address: 115 Cheonhodae-ro 110-gil, Gwangjin-gu, Seoul, Republic of Korea
- Name: Kim Jaehyeon
- Position: Representative
- Contact: support@hammerturtle.xyz, +82 10-2802-0192
- Requests to see your data and complaints are also received and handled by the data protection officer directly.
Article 13 (Where to complain)
- Korea Privacy Infringement Report Center: privacy.kisa.or.kr, 118
- Personal Information Dispute Mediation Committee: kopico.go.kr, 1833-6972
- Supreme Prosecutors' Office: spo.go.kr, 1301
- Korean National Police Agency: ecrm.police.go.kr, 182
Article 14 (Effective date and changes)
Changes to this policy are announced on this website and in the app's 'What's new' at least 7 days before they take effect, or 30 days if they are to your disadvantage.
Effective: 1 November 2026
Revision history
- 1 November 2026: first in effect