This revised policy takes effect on November 12, 2026. The current policy applies until then. View current version ↗
hmmm.pub/privacy
hmmm Privacy Policy
v1.3 · Effective 2026-11-12
Lee Chang-woo (hereinafter referred to as the "Operator") operates the hmmm service (hmmm.pub), a personal research project, and complies with the Personal Information Protection Act. This policy describes what personal information the Operator processes, why, for how long, with whom, and the rights of users.
1. Personal Information Processed and Purposes
| When | Items | Purpose | Legal Basis |
|---|---|---|---|
| When signing up by email | Email address, password (stored only in encrypted form) | Account creation, identity verification, login, notification emails | Performance of contract (Terms of Use) |
| When logging in with a DotSlashDash account | Account identifier, email address (stored and used in login cookies; the account itself is not received) | Login, maintaining login status | Performance of contract |
| When logging in with Google | Google account identifier, email address (name and profile picture are not stored even if transmitted) | Account creation, login | Performance of contract |
| When using the service (automatically collected) | Visitor identifier (random value), session identifier, access logs (access date and time, hash value of access IP, browser and device type), referral path (host of referrer address, campaign value) | Service provision, prevention of unauthorized use, usage statistics | Legitimate interests (secure operation) |
| When asking questions and reading | Entered questions, selected options, viewed cards/brands/words, search queries, product link clicks | Generating answers, continuing conversations, service improvement, material for new questions (after removing identifying information) | Performance of contract, legitimate interests |
| When asking questions in Japanese or English | Question language, whether the answer was translated into that language | Translating questions into Korean to generate answers, translating answers into that language, service improvement | Performance of contract, legitimate interests |
| When logging in or opening email links on Japanese or English screens | Language used (only when Japanese or English; Korean is not recorded) | Sending notification emails in that language | Performance of contract |
| When saving brands | Saved brands, date and time of saving | Displaying saved list in my account, displaying saved status on cards and notes | Performance of contract |
| When requesting email change, password reset, or account deletion | Email address, date and time of request | Identity verification and processing of request | Performance of contract |
| When making an inquiry | Email address, inquiry details | Reply | Performance of contract |
The Operator does not receive names, contact information, addresses, or payment information. The original value of access IP is not stored and only the hash value is retained. Location information and device fingerprints are not collected.
2. Retention Period
| Items | Period |
|---|---|
| Account information (email, password, Google identifier, language used) | Until account deletion. Deleted immediately upon deletion |
| Saved brands | Until account deletion. Deleted immediately upon deletion |
| Accounts before email verification | Deleted after 7 days |
| Access and login records | 1 year |
| Questions and usage records | 2 years. Afterwards, retained only as statistics after processing so that users cannot be identified |
| Service restriction records | 1 year after restriction ends (to prevent recurrence of the same violation) |
When an account is deleted, the link identifying the user from questions and usage records is immediately severed. If other statutes require retention, it will be retained for that statutory period.
3. Provision to Third Parties
The Operator does not provide users' personal information to third parties. It is provided only within the scope required when there is a demand pursuant to statutes.
4. Outsourcing of Processing and Overseas Transfer
The operator entrusts processing to the entities below for service operation, some of which are located abroad. The transferred items, purposes, and retention periods are as shown in the table, and each entity processes data only in accordance with the operator's instructions.
| Recipient | Country / Region | Entrusted Task | Transferred Items | Transfer Timing and Method | Retention Period |
|---|---|---|---|---|---|
| Vercel Inc. | United States (server regions: Singapore, Seoul) | Service hosting and execution | Access logs, information transmitted during service use | Via network upon use | Until the purpose of processing is achieved |
| Neon Inc. | United States (database region: Singapore) | Database storage | All items in Article 1 | Upon storage | Periods in Article 2 |
| Cloudflare, Inc. | United States (global edge) | Domain and network security, image storage | Access logs | Upon use | Until the purpose of processing is achieved |
| Resend, Inc. | United States (sending region: Tokyo) | Sending verification and informational emails | Email address, email content | Upon sending email | Stored briefly after transmission according to Resend policy, then deleted |
| Google LLC | United States | Google login, visit statistics (Google Analytics), answer generation and translation (Gemini) | Login: Google identifier, email / Statistics: cookie identifier, access logs / Answer generation and translation: question content, text of answers | Upon using each feature | Login and statistics: Subject to Google policy. Answer generation and translation: Not used for training; stored for up to 55 days for abuse monitoring, then deleted |
| Anthropic, PBC | United States | Answer generation (Claude) | Question content | Upon asking a question | Not used for training; stored for up to 30 days, then deleted |
| OpenAI, L.L.C. | United States | Answer generation (GPT) | Question content | Upon asking a question | Not used for training; stored for up to 30 days for abuse monitoring, then deleted |
The DotSlashDash account used for login is a separate service operated by DotSlashDash Co., Ltd. (auth.dotslashdash.com). Personal information for that account follows that service's privacy policy, and the operator receives only the account identifier and email address upon login. Product links lead directly to brand or seller pages, and no information identifying members is transmitted upon clicking.
Please do not include personal information in question content. Questions are transmitted to the AI service providers above to compose answers. If you do not wish for overseas transfer, you may choose not to use the membership registration and question features; reading is possible without transfer. To request suspension of transfer, please notify the contact point in Article 11.
Questions asked in Japanese or English are sent only to Gemini to be translated into Korean to compose answers, and the answers are then translated back into the language of the question. Public texts such as cards, notes, and terms on Japanese and English screens are also translated via Gemini. No user personal information is used in this translation.
5. Destruction
When the retention period expires or the purpose of processing is achieved, personal information is destroyed without delay. Electronic files are deleted using methods that cannot be restored, and statistics from which identifying information has been removed do not constitute personal information.
6. Rights of Users
Users may at any time request access to, correction of, deletion of, or suspension of processing of their personal information. Changing email addresses, resetting passwords, and deleting accounts can be done directly in My Page, and other requests will be answered within 10 days if submitted to the contact point in Article 11. When requested by a representative, a power of attorney will be verified. If a request is restricted under relevant laws and regulations, the reason will be notified.
7. Automatic Collection Devices (Cookies, etc.)
| Name | Type | Purpose | Period |
|---|---|---|---|
| hmmm_session | Cookie | Maintaining login status | 30 days |
| hmmm_public_session, hmmm_oidc_* | Cookie | Maintaining DotSlashDash account login status (account identifier, email) | Until logout or expiration |
| hmmm_in | Cookie | Indicates only whether logged in (does not contain identity, not login credentials) | 30 days |
| hmmm_vid | Cookie | Distinguishing visitors (random value) | 1 year |
| hmmm-theme | Browser storage | Screen brightness setting | Until deleted |
| hmmm-lang | Browser storage | Selected screen language | Until deleted |
| hmmm-lang-suggest-closed | Tab storage | Whether the language suggestion bar was closed | Until the tab is closed |
| hmmm-feed, etc. | Tab storage | Maintaining the viewed conversation within the tab | Until the tab is closed |
| _ga, etc. | Cookie (Google Analytics) | Visit statistics | Subject to Google policy (up to 2 years) |
You may refuse cookies in your browser settings. If refused, login and question features cannot be used, but reading remains available.
8. Measures to Ensure Security
Passwords are stored only using an irrecoverable method (argon2id). Login sessions and authentication links store only hash values and have short validity periods. Personal information is transmitted only via encrypted communications (HTTPS), access is permitted only to the operator personally, and access logs are maintained. The number of login attempts is limited.
9. Children Under 14
The operator does not accept membership registration from children under 14 years of age. During the registration process, it is verified that the applicant is at least 14 years of age.
10. Automated Decisions on Personal Information
The operator does not make automated decisions using personal information that produce legal effects on users.
11. Privacy Officer and Inquiries
- Privacy Officer: Operator Changwoo Lee
- Email: hello@hmmm.co.kr
- Exercising rights and inquiries are made to the email address above.
12. Remedies for Infringement of Rights and Interests
You may report or seek consultation regarding personal information infringement to the following organizations:
- Personal Information Infringement Report Center (privacy.kisa.or.kr, 118 without area code)
- Personal Information Dispute Mediation Committee (kopico.go.kr, 1833-6972)
- Supreme Prosecutors' Office Cybercrime Investigation Division (spo.go.kr, 1301)
- National Police Agency Cyber Bureau (ecrm.police.go.kr, 182)
13. Amendments to the Policy
If this policy is amended, notice will be provided within the service starting 7 days prior to enforcement. For significant changes, such as additions to collected items or purposes, notice will be provided 30 days prior, as well as via email to members. Previous policies will remain accessible on this screen.
14. Effective Date
This policy takes effect on 2026-11-12.
Operator: Changwoo Lee (Individual) · Email hello@hmmm.co.kr