Privacy Policy

1Purposes, items and retention of personal information

1. (1)
   Crog has no sign-up process and processes only the personal information in the table below.
   Crog does not use it for any purpose other than those listed, and if a purpose changes, Crog takes the measures required by Article 18 of the Personal Information Protection Act.
2. (2)
   Crog processes the personal information in the table below without the data subject’s consent, on the legal basis under Article 15(1) of the Personal Information Protection Act shown in the ‘Legal basis’ column.

1-1. App error reports

When an error occurs in the app or the app closes unexpectedly, the details are sent automatically to an error-tracking service (Sentry).
When the app is opened and closed, a short record (a session) used to count whether the app ended normally is also sent.

Items processed

The error (the error message and where in the code it occurred); the screen and step where it occurred; the app version and state (start time, memory use, whether it was on screen); the device model and state (screen size, memory, number of processors, thermal state); the operating system version; display mode (light or dark); language; time zone; and time format (12-hour or 24-hour)

Identifiers

A random number created at each installation, and a value that distinguishes devices.
Crog uses these only to count how many people experienced the same error, and does not link them to any name, email address or Apple Account.

Sessions

The time the app was opened, the duration of use, how it ended (normally, with an error, or unexpectedly), the app version and the installation number.
Crog uses these only to determine how often the app ends normally.

City

Not sent by the app.
When Sentry receives a report, it estimates the city from the IP address the report came from and records it.
Crog has configured Sentry not to store IP addresses.

Not processed

Name, email address, phone number, book names, notes, clips, photos, screenshots, buttons tapped, screens visited, and accessibility settings (such as Bold Text and VoiceOver)

How to refuse

If ‘Send Error Reports’ is turned off in the app’s settings, the app sends no error reports or session records from then on.
Crog then cannot learn of errors that occur on that device.

1-2. Support emails

When a data subject contacts Crog by email, Crog processes the email address, the name (if included), the content of the message and any attachments, such as screenshots.
Crog keeps support emails for 1 year from the final reply and then destroys them.
However, emails concerning consumer complaints or disputes are kept for 3 years, as required by Article 6 of the Enforcement Decree of Korea’s Act on the Consumer Protection in Electronic Commerce.

1-3. Subscriptions and lifetime purchase

Payments are processed by the App Store (Apple) and Google Play (Google).
Crog does not receive payment details such as card numbers.

Crog confirms purchases through a purchase-confirmation service (RevenueCat).
The app first connects to RevenueCat when the user opens the purchase screen, makes a purchase or restores purchases; for users who have bought paid services, it then checks the purchase status each time the app is opened.
In the process, a random number, the product purchased, the purchase date, renewal, expiry and refund status, the operating system and app versions, the App Store country and the IP address are processed.
This number is not linked to any name or email address.

The App Store and Google Play provide Crog with sales records that exclude buyers’ names and email addresses: from the App Store, sales quantities and amounts aggregated by country and per-subscriber sales records (a pseudonymous subscriber ID, country, device type, dates and the like); from Google Play, for each order, the order number, country, city, state or province, postal code, device model, product, date and amount.

When Crog refunds a user directly (Terms of Use, Article 14), Crog asks by email for the account to be refunded (bank, account number and account holder) and uses it only for the refund.
Once the refund is complete, Crog promptly deletes the email containing the account number, and separately keeps the record of the withdrawal and refund (request date, processing date, amount and order number) for 5 years.

As required by law, records of contracts and order withdrawals and records of payments and supply of goods are kept for 5 years, and accounting books and supporting documents for transactions are kept for 5 years (7 years for offshore transactions) from the statutory filing deadline of the tax concerned.

1-4. Visiting the website

The website (crogapp.com) uses no cookies and no visitor analytics.
The website is served through Firebase Hosting by Google LLC, and serving a page involves processing the visitor’s IP address, the address of the requested page and browser information.
Google keeps visitors’ IP addresses for several months to prevent abuse.
Crog does not receive these access logs and sees only totals, such as overall data transferred.

2Information stored only on the user’s device

1. (1)
   Crog does not operate any server that collects or stores records.
   Where records are stored and how they are deleted are shown in the table below.

1. (2)
   The following features also work only within the device.

• Notifications — the reminder about a book that hasn’t been opened in a while, and the ‘Reminder for this book’ turned on for each book, are shown by the device itself; no server sends them.
• Widgets, the Lock Screen work card, the Lock Screen camera and Shortcuts — information is exchanged only within the device.
• App lock — Face ID, Touch ID and the device passcode are checked by the device; Crog receives only the result.
• Scan address with camera — text is recognized on the device.
• Sending books — a sent book and the recipient’s information are delivered through Apple’s iCloud sharing or the transfer method the user chooses; Crog does not receive them.

3App permissions

The app asks for a permission the first time a feature that needs it is used.
Users can use the service apart from that feature even without granting the permission, and can change granted permissions at any time in the device’s settings.

iPhone and iPad

Settings › Apps › Crog

Android

Settings › Apps › Crog › Permissions

4Provision of personal information to third parties

1. (1)
   Crog does not provide data subjects’ personal information to third parties, except where a law specifically provides otherwise (for example, where an investigative agency requests it through a procedure set by law, such as a warrant).
2. (2)
   When a user sends videos or files or books to others directly from the app, that is the user’s own act and does not constitute the provision of personal information to a third party by Crog.

5Entrustment of processing and transfers abroad

1. (1)
   To provide the service, Crog entrusts the processing of personal information as set out below, and in the process personal information is stored outside Korea.
   Because this entrustment and storage is necessary to conclude and perform the contract with the data subject, Crog discloses it in this Policy under Article 28-8(1)(iii) of the Personal Information Protection Act.

1. (2)
   Crog concludes a data processing agreement (DPA) with each processor that sets out, among other things, the prohibition on processing personal information for purposes other than the entrusted work, security measures and restrictions on further entrustment (Article 26 of the Personal Information Protection Act), and supervises whether each processor handles personal information securely.
   The parties to which each processor further entrusts processing (sub-processors) are as listed by each processor (Sentry, Google, Firebase Hosting, RevenueCat).
2. (3)
   If the entrusted work or a processor changes, Crog will disclose it through this Policy without delay.

6Destruction of personal information

1. (1)
   When personal information is no longer needed — for example, because its retention period has expired or its purpose has been achieved — Crog destroys it without delay.
2. (2)
   Personal information due for destruction is destroyed after confirmation by the privacy officer.
   App error reports are deleted automatically by Sentry once the retention period (90 days) has passed.
3. (3)
   Personal information in electronic form is deleted in a way that cannot be recovered.
   Crog does not print or keep personal information on paper.
4. (4)
   Personal information that other laws require to be kept is stored separately from other personal information.
   The legal basis and the information retained are shown in the table below.

Basis: Article 6 of the Enforcement Decree of the Act on the Consumer Protection in Electronic Commerce; Article 85-3 of the Framework Act on National Taxes (books and documents: from the statutory filing deadline of the tax concerned)

7Rights and obligations of data subjects and legal representatives

1. (1)
   Data subjects may at any time ask Crog for access to their personal information, its correction or deletion, or the suspension of its processing.
2. (2)
   Crog does not hold the records on the user’s device, so users can correct or delete them directly in the app.
3. (3)
   Requests concerning personal information processed by Crog (1-1 to 1-4) can be made to support@crogapp.com.
   Crog will act within 10 days of receiving a request and give notice of the result.
   If Crog declines a request, it will give the reason and explain how to object.
4. (4)
   App error reports contain no name or email address, so Crog cannot identify a particular data subject’s reports, and deleting individual reports may therefore be difficult.
   Error reports are deleted automatically at most 90 days after collection.
5. (5)
   Data subjects may exercise their rights through a representative, such as a legal representative or a person they have authorized, who must submit a power of attorney.
6. (6)
   Crog does not make automated decisions within the meaning of Article 37-2 of the Personal Information Protection Act.
7. (7)
   Data subjects must not, in violation of the Personal Information Protection Act or other laws, infringe their own or other people’s personal information or privacy processed by Crog.

8Personal information of children under 14

Crog has no sign-up process and does not separately collect personal information of children under 14. A child under 14 who wishes to contact Crog must do so together with a legal representative.

9Automatic collection devices: installation, operation and refusal

• App — no advertising identifier is used, and there is no tracking across other companies’ apps or websites.
  Behavioral information, such as buttons tapped or screens visited, is not collected.
  Records of opening and closing the app are processed only as the sessions in 1-1.
• Website — no cookies and no visitor analytics are used.
• In-app browser and YouTube — other websites opened in the app (for example, pattern links) and the YouTube player may use cookies, and their own privacy policies apply.
  YouTube is opened in privacy-enhanced mode, which uses fewer cookies.
  Crog does not receive what users view there.
• App store statistics — if ‘Share With App Developers’ (iPhone and iPad) or ‘Usage & diagnostics’ (Android) is turned on, Apple and Google provide Crog with app usage statistics and error logs in a form that does not identify the user.
  On iPhone and iPad, this can be turned off in Settings › Privacy & Security › Analytics & Improvements.

10Security measures

Crog takes the following measures necessary to ensure security under Article 29 of the Personal Information Protection Act.

• Records are not gathered on a server; they are stored only on the user’s device and in the user’s iCloud.
• Error reports are sent only over encrypted connections (HTTPS), and Sentry is configured not to store IP addresses and not to collect screenshots, screen layouts, buttons tapped or screens visited.
• A setting that removes values such as passwords or card numbers from error messages is in use.
• Only the privacy officer can access personal information received by Crog.
• If, under Article 34 of the Personal Information Protection Act, Crog becomes aware that personal information has been lost, stolen or leaked (including the possibility of this as provided by that Act), Crog will notify data subjects whose contact details it has within 72 hours, post a notice on the website for at least 30 days where contact details are unknown, and report it as required by law.

11Privacy officer and complaints department

1. (1)
   Crog has designated a privacy officer and a complaints department, as set out below, to take overall responsibility for the processing of personal information and to handle data subjects’ complaints and requests for remedies.

Privacy officer

Representative of Crog (크로그)

Complaints department

Crog Support

Contact

support@crogapp.com

1. (2)
   Data subjects may send inquiries, complaints and requests for remedies concerning personal information to the contact above, and Crog will respond and act without delay.

12Remedies for infringement

To obtain remedies for an infringement of personal information, data subjects may apply for dispute resolution or counseling to the Personal Information Dispute Mediation Committee, the Korea Internet & Security Agency’s Personal Information Infringement Report Center and others.
For reports of or advice on infringements, they may also contact the Korean agencies below.
The phone numbers work within Korea.

13Data subjects outside Korea

Crog is a business in the Republic of Korea, and this Policy follows Korea’s Personal Information Protection Act.
Where the law of the country in which a data subject lives applies to Crog and grants broader rights, Crog complies with that law.

EU, EEA and UK

Under the GDPR and the UK GDPR, the controller is Crog (크로그).
The legal bases are: for error reports and website access logs, the legitimate interest in operating the app and website reliably and securely (Article 6(1)(f)); for support emails, responding to the request (Article 6(1)(b) or (f)); for purchase information, performance of a contract (b) and legal obligations (c).

Rights

Data subjects may request access, rectification, erasure, restriction of processing and data portability, and may object to processing based on legitimate interests.
They may also lodge a complaint with the data protection authority in their country (list of EU authorities; in the UK, the ICO).

Transfers

The EU and the UK have recognized that Korea provides an adequate level of data protection (adequacy decisions).
Transfers to services outside Korea are protected by the standard contractual clauses (SCCs) in the data processing agreements with each service.

United States

Crog does not sell personal information or share it for targeted advertising.
The website does not track visitors across sites, so it works the same whether or not a browser sends a ‘Do Not Track’ signal.
Crog is not directed to children under 13, and if Crog learns that it has received personal information from a child under 13, it deletes it without delay.

14Changes to this Privacy Policy

1. (1)
   This Privacy Policy applies from October 28, 2026.
2. (2)
   If this Policy changes, Crog will announce the change on the website and in the app at least 7 days before it takes effect, or at least 30 days before for changes that significantly affect data subjects’ rights.

Effective

October 28, 2026

Previous version

Version posted on October 28, 2026 — replaced by this version before the app’s release