This revised policy takes effect on November 22, 2026 (Addition of MY FIT stored items). Until then, the current policy applies. View current version ↗
Notice of Privacy Policy Revision — Effective November 12, 2026 Preview new policy ↗
hmmm.pub/privacy
hmmm Privacy Policy
v1.4 · Effective 2026-11-22
Changwoo Lee (hereinafter referred to as the "Operator") operates the hmmm service (hmmm.pub), a personal research project, and complies with the Personal Information Protection Act. This policy describes what personal information the Operator processes, why, for how long, with whom, and the rights of users.
1. Personal Information Processed and Purposes
| When | Items | Purposes | Legal Basis |
|---|---|---|---|
| When signing up by email | Email address, password (stored only in encrypted form) | Account creation, identity verification, login, notification emails | Performance of contract (Terms of Use) |
| When logging in with a DotSlashDash account | Account identifier, email address (stored in login cookies and used; the account itself is not received) | Login, maintaining login status | Performance of contract |
| When logging in with Google | Google account identifier, email address (even if name and profile picture are transmitted, they are not stored) | Account creation, login | Performance of contract |
| When using the service (automatically collected) | Visitor identifier (random value), session identifier, access logs (date and time of access, hash value of access IP, browser and device type), traffic source (host of referrer address, campaign values) | Service provision, prevention of unauthorized use, usage statistics | Legitimate interests (secure operation) |
| When asking questions and reading | Questions entered, options clicked, cards, brands, and terms viewed, search terms, product link clicks | Generating answers, continuing conversations, service improvement, material for new questions (after removing identifying information) | Performance of contract, legitimate interests |
| When asking questions in Japanese or English | Question language, whether the answer was translated into that language | Translating questions into Korean to generate answers, translating answers into that language, service improvement | Performance of contract, legitimate interests |
| When logging in or opening an email link on a Japanese or English screen | Language used (only when Japanese or English; Korean is not recorded) | Sending notification emails in that language | Performance of contract |
| When saving brands | Saved brands, date and time of saving | Displaying saved list in my account, displaying saved marks on cards and notes | Performance of contract |
| When saving clothes to MY FIT (only when logged in) | Product page address of clothes that fit well, purchased size, selected recommendation range (women/men), size chart, brand, product name, item category, style terms, and representative photo read from that page, date and time of saving | Displaying MY FIT list in my account, finding clothes with similar measurements and styles | Performance of contract |
| When requesting email change, password reset, or account deletion | Email address, date and time of request | Identity verification and request processing | Performance of contract |
| When making an inquiry | Email address, inquiry details | Reply | Performance of contract |
The Operator does not collect names, contact numbers, addresses, or payment information. For access IP, the original value is not stored, and only a hash value is retained. Location information and device fingerprinting are not collected.
MY FIT does not ask for body measurements, but uses only the purchased size and the size chart of that clothing. The size chart, brand, and photos read from the page of the entered address are stored without recording who entered them, and are also used for other users who enter the same address. When used without logging in, nothing about the user is stored. For usage limit restrictions, only the hash value of the access IP or account is used and deleted after one day.
2. Retention Period
| Items | Period |
|---|---|
| Account information (email, password, Google identifier, language used) | Until account deletion. Deleted immediately upon deletion |
| Saved brands | Until account deletion. Deleted immediately upon deletion |
| MY FIT list | Until the user deletes it or deletes the account. Deleted immediately upon deletion. If exceeding 10 items, the oldest ones are automatically deleted first |
| Accounts prior to email verification | Deleted after 7 days |
| Access and login records | 1 year |
| Questions and usage records | 2 years. Thereafter, processed so that the user cannot be identified and retained only as statistics |
| Usage restriction records | 1 year after restriction ends (to prevent recurrence of the same violation) |
Upon deleting an account, links that can identify the user from questions and usage records are immediately disconnected. In cases where other laws and regulations require retention, they are retained for the period stipulated by such laws and regulations.
3. Provision to Third Parties
The Operator does not provide personal information of users to third parties. It is provided only within the scope when requested pursuant to laws and regulations.
4. Outsourcing of Processing and Overseas Transfer
The operator entrusts processing to the following service providers for service operations, some of which are located overseas. The transferred items, purposes, and retention periods are as shown in the table, and each provider processes data solely in accordance with the operator's instructions.
| Recipient | Country/Region | Entrusted Task | Transferred Items | Timing and Method of Transfer | Retention Period |
|---|---|---|---|---|---|
| Vercel Inc. | United States (Server regions: Singapore, Seoul) | Service hosting and execution | Access logs, information transmitted while using the service | Over network upon use | Until the processing purpose is achieved |
| Neon Inc. | United States (Database region: Singapore) | Database storage | All items in Section 1 | Upon storage | Periods specified in Section 2 |
| Cloudflare, Inc. | United States (Worldwide edge) | Domain and network security, image storage | Access logs | Upon use | Until the processing purpose is achieved |
| Resend, Inc. | United States (Dispatch region: Tokyo) | Dispatching verification and notification emails | Email address, email content | Upon dispatch of email | Retained briefly following dispatch in accordance with Resend policy and then deleted |
| Google LLC | United States | Google sign-in, visitor analytics (Google Analytics), answer generation and translation (Gemini) | Sign-in: Google identifier, email / Analytics: Cookie identifier, access logs / Answer generation and translation: Question content, text of answer | Upon use of respective features | Sign-in and analytics: In accordance with Google policy. Answer generation and translation: Not used for training; retained for up to 55 days to monitor for abuse and then deleted |
| Anthropic, PBC | United States | Answer generation (Claude) | Question content | Upon asking a question | Not used for training; retained for up to 30 days and then deleted |
| OpenAI, L.L.C. | United States | Answer generation (GPT) | Question content | Upon asking a question | Not used for training; retained for up to 30 days to monitor for abuse and then deleted |
The DotSlashDash account used for sign-in is a separate service operated by DotSlashDash Co., Ltd. (auth.dotslashdash.com). Personal information associated with that account is governed by that service's privacy policy, and the operator receives only the account identifier and email address upon sign-in. Product links lead directly to the brand's or retailer's page, and no information identifying the member is transmitted upon clicking.
Please do not include personal information in question contents. Questions are transmitted to the aforementioned AI service providers in order to generate answers. If you do not wish for your information to be transferred overseas, you may choose not to use the membership registration and question features; reading content is available without any transfer. To request the cessation of transfers, please contact the contact point in Section 11.
Questions asked in Japanese or English are transmitted solely to Gemini, where they are translated into Korean to compose the answer, and that answer is translated back into the language of the question. Public texts such as cards, notes, and terms displayed on Japanese and English interfaces are also translated via Gemini. No personal information of users is used for this translation.
Product pages corresponding to addresses entered into MY FIT are opened and read directly by the operator's server, and no user information is transmitted to the retailer. The text and size images of the page are transmitted to Gemini in order to read size charts, and one representative image of the product is stored on Cloudflare. No personal information of users is used for this process.
5. Destruction
Personal information is destroyed without delay once the retention period expires or the purpose of processing has been achieved. Electronic files are deleted using methods that render them unrecoverable, and statistics stripped of identifying information do not constitute personal information.
6. Rights of Users
Users may at any time request to access, correct, delete, or suspend the processing of their personal information. Changing email addresses, resetting passwords, and deleting accounts can be done directly via My Page, and other requests submitted to the contact point in Section 11 will be answered within 10 days. When requests are made through an agent, a power of attorney will be verified. If a request is restricted under applicable laws and regulations, the reason will be notified.
7. Automatic Collection Devices (Cookies, etc.)
| Name | Type | Purpose | Duration |
|---|---|---|---|
| hmmm_session | Cookie | Maintain login status | 30 days |
| hmmm_public_session·hmmm_oidc_* | Cookie | Maintain DotSlashDash account login status (account identifier, email) | Until logout or expiration |
| hmmm_in | Cookie | Indicate whether logged in only (does not contain who, not login information) | 30 days |
| hmmm_vid | Cookie | Distinguish visitors (random value) | 1 year |
| hmmm-theme | Browser storage | Screen brightness setting | Until deleted |
| hmmm-lang | Browser storage | Selected display language | Until deleted |
| hmmm-text-size | Browser storage | Selected font size | Until deleted |
| hmmm-curious | Browser storage | List of cards where 「Good question」 was clicked (to prevent clicking 2 times on the same card) | Until deleted |
| hmmm-my-fit-audience | Browser storage | Selected «Women/Men» recommendation scope in MY FIT | Until deleted |
| hmmm-my-fit-intro-closed | Browser storage | Time when the first MY FIT intro was closed with «Do not show for a month» (to avoid displaying again for 30 days) | Until deleted |
| hmmm-feed, etc. | Tab storage | Maintain viewed conversation within the tab | Until tab is closed |
| _ga, etc. | Cookie (Google Analytics) | Visit statistics | According to Google policy (up to 2 years) |
You can reject cookies through browser settings. If rejected, login and questioning features cannot be used, but reading remains available. Values in browser storage remain only in this browser and are deleted together when you clear data for this site in your browser settings.
8. Measures to Ensure Safety
Passwords are saved only via an irrecoverable method (argon2id). Login sessions and verification links store only hash values and have short validity periods. Personal information is transmitted only through encrypted communications (HTTPS), access is permitted only to the operator personally, and access logs are recorded. The number of login attempts is limited.
9. Children Under 14
The operator does not accept membership registration from children under 14. Age of 14 or older is verified during the registration process.
10. Automated Decision-Making on Personal Information
The operator does not make automated decisions that produce legal effects concerning users using personal information.
11. Privacy Officer and Inquiries
- Privacy Officer: Operator Lee Chang-woo
- Email: hello@hmmm.co.kr
- Exercise of rights and inquiries are made via the email above.
12. Remedies for Rights Infringement
Reports and consultations regarding personal information infringement may be made to the following organizations:
- Personal Information Infringement Report Center (privacy.kisa.or.kr, without area code: 118)
- Personal Information Dispute Mediation Committee (kopico.go.kr, 1833-6972)
- Supreme Prosecutors' Office Cyber Investigation Division (spo.go.kr, 1301)
- National Police Agency Cyber Bureau (ecrm.police.go.kr, 182)
13. Amendments to the Policy
When this policy is modified, notice will be given within the service starting 7 days before enforcement. Important changes, such as expansion of collection items or purposes, will be announced 30 days in advance and notified to members via email. Previous policies remain accessible on this screen.
14. Effective Date
This policy takes effect on 2026-11-22.
Operator: Lee Chang-woo (individual) · Email hello@hmmm.co.kr