Tomoyui Privacy Policy

1. Responsible operator

Operator: 주식회사 케이프렌드 (KFRIEND Inc.), Republic of Korea. Privacy contact: 우광식. Contact kfriend986@gmail.com for access, correction, deletion, withdrawal of consent and other privacy requests.

Address: 45-8 World Cup-ro 8-gil, Mapo-gu, Seoul 04029, South Korea
Korean business registration number: 8868602482
Representative / management and privacy contact: 우광식

2. Information and purposes

• Login method, authentication identifiers, an email address if provided, and membership, connection and consent records: authentication, membership management and prevention of unauthorized linking.
• Profile photos, nickname, nationality, date of birth, gender, languages, interests and biography that you enter: profiles, age display, finding friends and social interaction.
• Posts, comments, messages, photos, video or audio you choose to send, and information associated with voice participation: communication, delivery, access management and responding to reports.
• Tomoyui purchase, transaction and store-verification records include purchaser/account references, product and order references, Google Play purchase tokens where applicable, purchase/refund/renewal/restoration status, Coin use and Premium entitlement results. We use them to verify purchases, deliver or read eligible same-account Tomoyui rights across operating systems in the same environment, restore rights, prevent duplicate credits and resolve purchase issues. Apple or Google Play handles payment-card information; Tomoyui does not collect full card numbers. Other brands’ purchase information is not imported or included in connected-profile sharing. License/Sandbox test records and rights remain separate from the real service.
• Device and app information, notification registration, connection, usage and error records, and block/report information: notifications, troubleshooting and safety.

3. Public profile boundaries

Within a service, profiles are shown according to visibility settings. Sharing with another service requires separate connected-service consent. The scope is limited to K-Friends and Tomoyui and these eight fields: photos, nickname, nationality, age, gender, languages, interests and biography. Email, authentication IDs, the original date of birth, precise location, Coin balance, Premium and purchase information are excluded from that public profile. Nationality is self-reported, not inferred from location or interface language.

4. Linking, consent and community posts

Connecting accounts verifies the same person across memberships; it is not consent to cross-service profile sharing. We record acceptance and withdrawal with the document version, services, fields and time. Adding a service does not automatically expand consent. Community posts are handled in the service where they were created. Network consent alone does not repost them into another service’s feed. Read the sharing notice.

Using the same verified sign-in account still requires explicit enrollment in each service. A shared login alone does not enroll you elsewhere or grant sharing consent.

When first joining Tomoyui, you explicitly choose either a one-time import of your verified K-Friends profile or creation of a new profile. You review and edit the profile, including any imported information, before completing registration. Importing does not change the original K-Friends profile. Afterward, Tomoyui and K-Friends profiles are stored and managed separately; editing a profile in one app does not update the other app’s profile. Your verified common sign-in and friend relationships and conversations available under existing consent and access conditions are maintained. Separate profile storage and editing do not add services or shared fields or retroactively expand existing consent. Importing a profile does not copy or transfer subscriptions, purchase records, or Coin or Premium entitlements to Tomoyui.

5. Permissions and feature-specific processing

Microphone access is used when you speak; camera and photo access are used when you choose to create or upload content. Notification permission controls device notifications. You may decline these permissions and continue using features that do not need them.

Location is optional. Tomoyui requests it when you choose a nearby search or your current location, not automatically at sign-in or when returning to the app. Denial does not prevent registration or topic browsing. With permission, latitude and longitude are sent to our server for nearby features; the latest stored position is replaced on updates rather than used as a travel-history feature. Precise coordinates are not sent to the translation provider or included in public profiles shared across services. You can turn off future access in device settings and request removal of the stored position through support.

External AI translation is optional. Before sending text, the app explains that the text and target language will be sent to OpenRouter and Google model services, and asks for explicit permission for this purpose. Both the person requesting translation and the original author must have the applicable permission; this also applies to public Tomoyui posts and comments. Being able to view content or having connected-service consent does not grant permission to send its author’s text to external AI. Translation results are saved with the relevant content.

You can decline translation permission and continue using the app, posting and chatting without external AI translation. You can withdraw permission in the app. Withdrawal stops new sends and pending translation work covered by that permission. It does not guarantee recall of a request already sent or immediate deletion of all provider-side data or completed results. The provider and retention details below also apply to automatic translation.

Public-image safety checks use a separate permission from translation. Before your first public profile, post or comment image is sent to OpenAI for safety checking, the app identifies the recipient and purpose and asks for explicit permission. Declining or withdrawing that permission prevents new public image submissions that require this check, while other app functions remain available. Private chat images and private report-evidence images are not sent to OpenAI by this public-image safety check. Permission for translation or connected-service sharing does not grant this separate permission.

Permission given for a profile image before enrollment applies only to that individual image-preparation request; it is not automatically carried over as account-wide permission after enrollment.

The app does not show display or rewarded ads or initialize advertising services for advertising, and does not request advertising tracking permission.

Firebase Analytics collection is disabled in the verified Tomoyui iOS and Android release configurations, including automatic Analytics app/purchase events. The iOS configuration also disables Analytics IDFV collection; the Android configuration disables Analytics advertising-ID collection and ad-personalization signals. Android does not request advertising-ID permission or broad photo-library access; selected photos and videos are accessed through the device picker. AdMob advertising and its automatic initialization are disabled. This does not stop functional installation/push identifiers, Crashlytics crash/error diagnostics, Agora connection-quality diagnostics, Maps requests, or service-side account/activity/purchase records used for their stated functions.

Map display and access to your current location are separate. Maps may show a country selected during registration or a previously saved position without obtaining a new device location. Opening those maps sends the displayed map area to Google Maps. Turning off location permission stops future device-location access; it does not erase a saved position or stop map requests when you open a map.

6. Service providers and international processing

Our operator is in the Republic of Korea. To deliver the functions you use, data travels over the network to the following services. Processing is not limited to Japan.

• Google / Firebase: authentication identifiers, email and sign-in security data support Apple, Google and email login. Firebase Authentication processes data in the United States. Google Cloud also hosts our service database in Seoul, Republic of Korea, and disaster-recovery copies in Tokyo, Japan. Private attachments use a separate access-controlled storage area in Seoul. Notifications use Firebase Cloud Messaging on Google’s global infrastructure. See Firebase privacy information. Firebase Cloud Messaging uses installation/push tokens for notifications, and Crashlytics uses crash logs, app/device state and diagnostic identifiers to investigate stability problems. These functions are separate from disabled Firebase Analytics.
• Apple: when you select Sign in with Apple, Apple supplies the sign-in identifier and the name or email you choose to share, including an email alias where available. Apple processes its sign-in service under its sign-in privacy notice.
• Google Play: on Android, Google processes the purchasing Google account and payment method under Google’s privacy policy. Tomoyui receives the purchase token, product/order references and verification or entitlement results needed for its own purchases. These records are tied to the owning Tomoyui account and the test or real-service environment; they are not public-profile fields and do not grant another brand’s rights.
• Agora Lab, Inc.: live voice, session identifiers and connection/device quality information are processed through its global communication network, including infrastructure outside Japan. Tomoyui does not offer recording of live voice rooms. Voice messages you deliberately attach to chats are separate stored content. See Agora’s privacy policy.
• OpenRouter, Inc. and Google model services: translation text and target language are sent for translation using Gemini through OpenRouter. We request only routes meeting the provider’s data-collection restriction and zero-retention policy; translation fails if no eligible route is available. This does not mean that our saved messages or translations, transient processing, or provider usage/security records are never stored. Processing is not restricted to one country. See OpenRouter’s privacy policy and its retention-routing explanation.

  Our shared translation account currently allows OpenRouter to use submitted inputs and outputs to improve its services under its data-discount setting. The provider-routing restrictions above do not disable this platform-level use. Private input/output observability logging is off; that is a separate setting and does not cancel the data-discount permission. OpenRouter also describes retention of content flagged by its child-safety screening for review and legal preservation. Do not include passwords, authentication codes or unnecessary sensitive information in text you choose to translate. See OpenRouter’s data-collection explanation.

• OpenAI: after the separate public-image safety permission, image data for new Tomoyui public profile, post and comment images is sent to the Moderation API using omni-moderation-latest to check for unsafe content before publication. This is a safety classification service, not an image-generation feature or a check of private chat images. Processing is not limited to Japan. Provider data handling is described in OpenAI’s API data controls. We do not claim immediate deletion or zero retention at every layer, or that automated checks detect every unsafe image.
• Google Maps Platform: maps process the requested map area or coordinates, device IP address, request time/status and app/SDK information. Google uses request records to operate and improve its services, provide support and maintain security, under its own retention rules. Processing may occur outside Japan. These records are separate from the disabled Firebase Analytics SDK. See Google’s privacy policy and Maps data collection and use. Android Maps SDK processing can also include its SDK-specific pseudonymous identifier, map interactions and crash metrics as described in Google’s Android Maps data disclosure. Disabling Firebase Analytics does not disable these separate Maps functions.

Account linking and the optional two-service profile-sharing choice do not replace permissions or choices required for these functions. Contact support to request information about data handling or exercise your rights.

7. Retention and account deletion

Requesting Tomoyui deletion stops its access and notifications and starts removal of its posts, comments and attachments. In shared chats, your Tomoyui-origin message bodies, translations and attachments are removed, while conversation reference records and other participants’ messages remain. The same request does not remove another service’s content or membership.

Your Tomoyui profile, including its stored location, is deleted when you leave Tomoyui. Actual memberships in other services and those apps’ profiles remain; they are not a reason to retain your Tomoyui profile. After the last membership ends, remaining profiles, common personal information, email, login and device data are also removed. If another actual membership still uses the same Firebase sign-in account, that authentication is kept; it is deleted only when no membership uses it. Deletion processing records are distinguished from the personal profile. Existing records needed to preserve another service’s purchase or restoration rights are not arbitrarily destroyed. Being visible in another service is not a membership.

Profiles and published content remain while you use them, until you delete the content or the relevant membership ends. Unused uploads become eligible for cleanup after 24 hours. Account-connection codes expire after 10 minutes; their request records become eligible for automatic removal one day after expiry. Cleanup failures are retried rather than reported as completed. When Apple authorization is no longer needed by another membership and must be revoked, you may need to authenticate again.

Consent and withdrawal history, membership-end records and deletion-processing records retain the internal account reference, service, document version, time and processing result needed to demonstrate prior authorization and avoid duplicate actions. Reports are handled for safety investigations and dispute resolution. These records are not a public profile and are not used to restore a deleted membership.

There is currently no single fixed expiry or automatic erasure schedule for these limited records. Retention is assessed according to the need to demonstrate consent, finish or verify deletion, preserve purchase or restoration rights, and resolve an open safety investigation or dispute. You may ask support to review whether a retained record is still needed and request its deletion or anonymization. A record that is no longer needed for these purposes is subject to removal; this does not reactivate the account.

New Tomoyui attachments use access-controlled storage in Seoul. This storage has neither object version history nor a soft-delete recovery period: after successful deletion, the storage service does not keep a recoverable object copy under those settings. Existing K-Friends files used by a profile you imported remain subject to that service’s storage settings, including its seven-day soft-delete recovery period. A file still needed by another actual membership or another author is not deleted solely because you leave Tomoyui.

Completion time depends on the remaining media and authentication-provider processing, including retries or Apple reauthentication. We do not present a queued or failed step as completed. Support can explain the current processing status and any action needed; we do not promise a fixed completion time without checking that request.

Database recovery copies are separate from the active service: Seoul backups use a 14-day cleanup threshold, point-in-time recovery uses 3 days, and monthly Tokyo disaster-recovery copies use 65 days. Dependent backup chains can remain until they can be safely removed. These recovery periods are not a reason to keep your deleted profile visible or active.

Provider retention is separate. Firebase publishes removal of authentication data from active and backup systems within 180 days after a user-deletion request, and keeps sign-in IP logs for a few weeks. Agora’s published RTC defaults are up to 30 days for IP/network/session information and up to 365 days for device quality data; live RTC streams are not stored as recordings under that service. See the provider notices above. These periods do not describe how long Tomoyui takes to accept your deletion request.

Check the request and completion status in the app or contact support. Removing only the app or logging out does not request account deletion.

Purchase verification, entitlement, refund, restoration and financial dispute records are distinguished from public profiles and message content. We retain the limited references and results needed to honor purchase rights, prevent duplicate credits, handle refunds and meet applicable obligations; account deletion is not treated as erasing every financial record or cancelling a store subscription. Sandbox records do not grant real-service entitlements.

8. Your choices and requests

Use the app to review or edit your profile, withdraw connected-profile consent or request account deletion. You may also request access, correction, deletion or restriction of use at kfriend986@gmail.com. We verify identity as appropriate for the request. Do not email passwords, sign-in verification codes or account connection codes.

9. Changes

We announce material changes in the app or on this page. Where new consent is required, we explain the change and ask you to choose again.