Privacy Policy Amendment Notice — Effective November 12, 2026 Preview new policy ↗
hmmm.pub/privacy
hmmm Privacy Policy
v1.2 · Effective 2026-10-07
Lee Chang-woo (hereinafter referred to as the "Operator") operates the hmmm service (hmmm.pub), a personal research project, and complies with the Personal Information Protection Act. This policy sets out what personal information the Operator processes, why, for how long, with whom, and the rights of users.
1. Personal Information Processed and Purposes
| When | Items | Purpose | Legal Basis |
|---|---|---|---|
| When signing up via email | Email address, password (stored only in encrypted form) | Account creation, identity verification, login, notification emails | Performance of contract (Terms of Service) |
| When logging in with a DotSlashDash account | Account identifier, email address (used contained in a login cookie; the account itself is not received) | Login, maintaining login status | Performance of contract |
| When logging in with Google | Google account identifier, email address (even if name and profile picture are transmitted, they are not stored) | Account creation, login | Performance of contract |
| When using the service (automatically collected) | Visitor identifier (random value), session identifier, access logs (date and time of access, hash value of access IP, browser and device type), traffic source (host of referrer address, campaign values) | Service provision, prevention of unauthorized use, usage statistics | Legitimate interests (secure operation) |
| When asking questions and reading | Entered questions, selected options, viewed cards, brands, and words, search terms, product link clicks | Answer generation, continuation of conversation, service improvement, material for new questions (after removing identifying information) | Performance of contract, legitimate interests |
| When saving brands | Saved brands, date and time of saving | Displaying saved list in My Account, indicating saved status on cards and notes | Performance of contract |
| When requesting email change, password reset, or account deletion | Email address, date and time of request | Identity verification and request processing | Performance of contract |
| When making an inquiry | Email address, inquiry content | Reply | Performance of contract |
The Operator does not receive names, contact details, addresses, or payment information. For access IP, the original value is not stored and only the hash value is retained. Location information and device fingerprints are not collected.
2. Retention Period
| Items | Period |
|---|---|
| Account information (email, password, Google identifier) | Until account deletion. Immediately deleted upon deletion |
| Saved brands | Until account deletion. Immediately deleted upon deletion |
| Accounts prior to email verification | Deleted after 7 days |
| Access and login logs | 1 year |
| Questions and usage logs | 2 years. Thereafter, processed so that the user cannot be identified and retained solely for statistics |
| Service restriction records | 1 year after restriction ends (to prevent recurrence of the same violation) |
When an account is deleted, the link identifying the user from questions and usage logs is severed immediately. Where other laws and regulations require retention, it is retained for that period.
3. Provision to Third Parties
The Operator does not provide users' personal information to third parties. It is provided only within the scope when requested pursuant to laws and regulations.
4. Entrustment of Processing and Cross-Border Transfer
For service operations, the Operator entrusts processing to the entities below, some of which are located overseas. The transferred items, purposes, and periods are as shown in the table, and each entity processes them solely in accordance with the Operator's instructions.
| Recipient | Country / Region | Entrusted Tasks | Transferred Items | Transfer Timing and Method | Retention Period |
|---|---|---|---|---|---|
| Vercel Inc. | United States (server regions Singapore, Seoul) | Service hosting and execution | Access logs, information transmitted during service use | Via network upon use | Until achievement of processing purpose |
| Neon Inc. | United States (database region Singapore) | Database storage | All items in Section 1 | Upon storage | Period in Section 2 |
| Cloudflare, Inc. | United States (global edge) | Domain and network security, image storage | Access logs | Upon use | Until achievement of processing purpose |
| Resend, Inc. | United States (dispatch region Tokyo) | Dispatch of verification and notification emails | Email address, email content | Upon email dispatch | Retained briefly in accordance with Resend policy after dispatch processing and then deleted |
| Google LLC | United States | Google login, visit statistics (Google Analytics), answer generation (Gemini) | Login: Google identifier, email / Statistics: cookie identifier, access logs / Answer generation: question content | Upon use of each feature | Login and statistics: In accordance with Google policy. Answer generation: Not used for training, retained for up to 55 days for abuse monitoring, and then deleted |
| Anthropic, PBC | United States | Answer generation (Claude) | Question content | Upon asking questions | Not used for training, retained for up to 30 days, and then deleted |
| OpenAI, L.L.C. | United States | Answer generation (GPT) | Question content | Upon asking questions | Not used for training, retained for up to 30 days for abuse monitoring, and then deleted |
The DotSlashDash account used for login is a separate service operated by DotSlashDash Co., Ltd. (auth.dotslashdash.com). Personal information of that account follows that service's privacy policy, and the Operator receives only the account identifier and email address upon login. Product links lead directly to the brand's or seller's page, and information identifying members is not sent upon clicking.
Do not include personal information in the content of your questions. Questions are transmitted to the above AI service providers to generate answers. If you do not wish for cross-border transfer, you may choose not to use member registration and question features; reading is possible without transfer. To request the suspension of transfer, please notify via the contact information in Section 11.
5. Destruction
Personal information is destroyed without delay once the retention period expires or the purpose of processing has been achieved. Electronic files are deleted using a method that cannot be restored, and statistics from which identifying information has been removed are not personal information.
6. Rights of Users
Users may request access to, correction of, deletion of, or suspension of processing of their personal information at any time. Changing email addresses, resetting passwords, and deleting accounts can be done directly on My Page, and other requests will receive a response within 10 days if sent to the contact information in Section 11. When a representative makes a request, a power of attorney will be verified. If a request is restricted under relevant laws and regulations, the reason will be notified.
7. Automatic Collection Devices (Cookies, etc.)
| Name | Type | Purpose | Period |
|---|---|---|---|
| hmmm_session | Cookie | Maintaining login status | 30 days |
| hmmm_public_session·hmmm_oidc_* | Cookie | Maintaining DotSlashDash account login status (account identifier and email) | Until logout or expiration |
| hmmm_in | Cookie | Indicates only whether logged in (does not contain identity, not login credentials) | 30 days |
| hmmm_vid | Cookie | Distinguishing visitors (random value) | 1 year |
| hmmm-theme | Browser storage | Screen brightness setting | Until deleted |
| hmmm-feed etc. | Tab storage | Retaining viewed conversations within the tab | Until the tab is closed |
| _ga etc. | Cookie (Google Analytics) | Visit statistics | Subject to Google policy (up to 2 years) |
Cookies can be refused in browser settings. If refused, login and question features cannot be used, but reading remains available.
8. Security Measures
Passwords are stored solely using an irreversible method (argon2id). Login sessions and verification links store only hash values and have short validity periods. Personal information is transmitted only through encrypted communication (HTTPS), access is restricted solely to the operator personally, and access logs are maintained. The number of login attempts is limited.
9. Children Under 14
The operator does not accept membership registrations from children under the age of 14. Verification that a user is 14 years of age or older is conducted during the registration process.
10. Automated Decision-Making on Personal Information
The operator does not make automated decisions that produce legal effects concerning users using personal information.
11. Privacy Officer and Inquiries
- Privacy Officer: Operator Lee Chang-woo
- Email: hello@hmmm.co.kr
- Exercises of rights and inquiries may be submitted to the email address above.
12. Remedies for Rights Infringement
Reports and consultations regarding personal information infringement may be made to the following organizations:
- Personal Information Infringement Report Center (privacy.kisa.or.kr, 118 without area code)
- Personal Information Dispute Mediation Committee (kopico.go.kr, 1833-6972)
- Supreme Prosecutors' Office Cybercrime Investigation Division (spo.go.kr, 1301)
- National Police Agency Cyber Bureau (ecrm.police.go.kr, 182)
13. Amendments to the Policy
When this policy is modified, notice will be given within the service starting 7 days prior to implementation. Material changes, such as additions to items collected or purposes, will be notified 30 days in advance and will also be notified to members via email. Previous policies remain accessible on this screen.
14. Effective Date
This policy takes effect on 2026-10-07.
Operator: Lee Chang-woo (Individual) · Email hello@hmmm.co.kr