Shooblog Privacy Policy — Blog Section
Effective date: 2026-10-02 · Text pending legal review
This section describes blog, content and report processing by 조지컴퍼니 (JOJI COMPANY) for Shooblog. It must be combined with finalized account and payment disclosures before publication.
Data and purposes
| Area | Data | Purpose |
|---|---|---|
| Account | Account identifiers, email, name, sign-in provider identifiers and supplied profile data | Authentication, account administration, contact |
| Blog | Account linkage, handle, name, description, logo/cover, language, search visibility, timestamps | Hosting, display and search access |
| Posts/images | Title, content blocks, formatting, tags, cover/image URLs, uploaded image bytes, file type/size/hash, post number, AI/manual designation, language, visibility and timestamps | Saving, editing, publication and image delivery |
| Reports | Blog/post references, category, details, original URL, reporter email, optional name, receipt and decision times/results | Rights complaints, reason-based hiding and review, investigation, contact and disputes |
| Responses/audit | Response text/time, operator identifier, restoration/removal decisions, reasons, timestamps and previous decisions | Appeals and accountable moderation |
| Rate limits | Hashes of trusted client IP and normalized email, minute counters | Abuse prevention; the quota table stores no raw IP |
| AI/payment/access | AI inputs and results, usage, access/error records and, when applicable, transaction/receipt information | Requests, reliability, usage accounting and payment; exact scope and retention to be finalized in the combined policy |
Users are responsible for checking and publishing AI-made text and images. Avoid unnecessary personal data about others in posts and reports. AI accuracy or legality is not guaranteed. No official writing API is offered.
Visibility and disclosure
Public blog profiles, posts, images and publication metadata are accessible to visitors and search services. Drafts, author-hidden and report-hidden posts are excluded from public reads. Public responses contain no account identifiers, account email or reporter identity. Outside copies and search caches may survive removal.
Reporter identity, details and original URLs are available to authorized operators, not visitors or the author-facing interface. Authors see categories, their own response and processing status. Statutory Korean copyright notices, formal DMCA counter-notice forwarding and valid court/authority demands may require limited disclosure to parties or authorities. Explain required identity data and disclosure before formal submission; this is separate from the ordinary report interface.
Retention and erasure
Blogs, posts and images are kept while needed to provide the service. Deleting a post deletes its draft content; unlinked uploaded images may remain until account deletion. Account deletion removes owned blogs, posts and images; failed object deletion can leave metadata for retry.
Retention proposal for review: Keep reports, responses and audit while the matter is open, then separately retain them only for a defined dispute-handling period. Review whether the statutory three-year period for consumer complaint/dispute records applies; determine minimum necessary periods for other cases. Legal preservation obligations take precedence within their scope. Post/account deletion does not automatically delete report records, and automatic post-resolution erasure is not yet implemented. Finalize and implement a matching period before publication.
Quota hash rows unused for more than a day are deleted on the next report transaction, not by a scheduled timer. Electronic data is securely erased. Separate account, AI, payment and access-log retention periods must be specified in the combined policy.
Processors, transfers and rights
Google (if used for sign-in), Vercel (web hosting), Supabase (database) and Amazon Web Services (servers/images) participate in processing. Confirm AI providers, actual processing countries, contracts, transfer items/timing/method/purpose/retention, refusal options and lawful bases before final publication. This draft claims no unverified storage location or consent.
Controls include restricted permissions, server-side authorization, encrypted transport, blocking direct client access to moderation tables and recording operator decisions. Sign-in/security may use cookies or similar technologies. Request access, correction, erasure, restriction or withdrawal of consent using the contact below, subject to lawful retention. We respond under applicable requirements and identity checks and announce material changes before they apply.
Operator and privacy contact
- Business name: 조지컴퍼니(JOJI COMPANY)
- Representative and privacy contact: 조영진
- Business registration number: 108-39-69341
- Mail-order business registration: 2025-안양동안-1522
- Address: 경기도 안양시 동안구 시민대로 327번길 11-41 3F
- Telephone: 010-7510-7298
- Email: contact@jojicompany.com
Reading and likes
We store a random browser cookie to count likes and views. The server stores its hash, post identifier, like status, view count and last viewing date, without raw IP addresses or email addresses. These records are deleted with the post. Your daily reading list and the time you dismiss a signup prompt stay on your device. Clearing cookies and site data resets your browser identifier and prompt preferences.
Payment processing entrusted to Toss Payments
Processor: Toss Payments Co., Ltd. (토스페이먼츠 주식회사). Tasks: card registration and authentication, recurring payment approval, cancellation, refunds and transaction verification. Shared items: random customerKey, authKey, billingKey, order number, product name, amount and cancellation reason. Toss directly processes card and identity details entered in its checkout; we do not collect raw card numbers or passwords. We receive payment references, receipts, issuer and masked numbers. Our current billing API does not additionally send names or emails.
Account, consent and personal data controls
Signup stores your email, a password verifier (never the plaintext password), the time you confirmed you are at least 14, and optional marketing consent and its update time. Users under 14 cannot sign up. Email signup completes after verification; Google signup uses the email verified by Google.
Verification, email-change and password-reset links expire after 30 minutes and can be used once. Only a token hash is stored. Expired requests are removed on the next account email request. Account security emails are separate from marketing consent.
News and offer emails require separate optional consent, off by default. Consent is not required to use the service and can be withdrawn in Account settings. Consent remains until withdrawal or account deletion. Marketing delivery is not currently offered.
Account → Account settings lets you change a password/email, sign out other devices, withdraw consent, download personal data as JSON and delete your account. The export includes your profile, consents, all blogs, draft/public/hidden posts and uploaded image list. Image files are not included.
Deletion removes blogs, all posts, uploaded images, account email, password verifiers and consents, and ends all sessions. Legally required contract/payment/supply records are retained for 5 years and consumer complaint/dispute records for 3 years. Name, email and card authentication data are removed from payment records. App diagnostics follow the existing policy and are processed for deletion after 30 days. Device logs mixed with other accounts may require a separate privacy request to remove attributable information.