Privacy Policy

Service: Naru · Effective: August 18, 2026 · Previous version: August 2, 2026

What changed — TestFlight applications through the website have ended, so we removed that collection item and the email-provider processing (Resend), and updated the data protection officer. Nothing was added to what we collect or how we use it, so this revision is not adverse to users and takes effect on publication.

Naru (the “Service”) is an app for couples to see each other's day at a glance. This policy explains what the Service collects and how it is used.

1. What We Collect

You sign in with an Apple or Google account. The Service does not send its own verification emails.

Email address — received from Apple or Google at sign-in and used to identify your account. If you use Apple's Hide My Email, we receive an Apple-generated relay address instead, and the Service never learns your real address.
Nickname — the name shown to your partner
Your main city (approximate location and time zone) — used to show both people's local times. Location may be read once while you pick a city; it is never tracked continuously.
Sleep hours (optional) — the approximate bedtime and wake time you enter, used to show whether your partner is likely asleep and to work out when you are both free
Naru character — the colour and prop you choose. The Service does not collect profile photos.
Events, notes, and bucket items — what you enter in the app. Notes may contain drawings or attached images; bucket items may contain links and preview images.
Events from connected calendars (optional) — if you connect iPhone Calendar or Google Calendar, the titles and times of events in the calendars you select are brought to our servers and shown to your partner. For Google Calendar we store your Google account email and an encrypted refresh token to keep the connection alive, using read-only access. You can disconnect at any time in the app; doing so deletes the imported events and the token.
Device token for notifications — if you turn notifications on, the device token issued by Apple. Notification text includes minimal content such as your partner's nickname and a note preview, and passes through Apple's push servers on the way to your device.
Purchase records — if you buy a paid membership, the transaction identifier, product, and purchase and expiry times we receive from Apple. Payment details such as card numbers are handled by Apple and never reach the Service.
Usage records — last active time, which app steps you reached, whether widgets are installed and used, and the app version. Kept to run and improve the Service, not for advertising or behavioural tracking.
Consent history — when you agreed, and the version of the terms and policy you agreed to
Feedback (optional) — if you send feedback, its content, a reply email if you provide one, and the app version, device, and language

2. Why We Use It

We use what we collect only to provide and improve the Service — showing both people's local times, events, notes, and bucket items; working out when you are both free; sending notifications; confirming purchases and granting membership access; managing accounts; usage statistics and improvement; handling feedback; and beta invitations. We do not advertise, track behaviour, or sell data, and we use no advertising or third-party analytics SDKs.

3. Sharing With Your Partner

Once you pair, your partner sees your nickname, city, time zone, sleep hours, Naru character, events, notes, and shared bucket items. This is the core of the Service.

Events from connected calendars are shown to your partner too. If you connect iPhone or Google Calendar, the titles and times of events in the calendars you selected become visible to them. You choose which calendars to share in the app; calendars you do not select are never imported.

Unpairing stops further sharing and deletes the imported calendar events. We cannot, however, retrieve anything already shown on your partner's device before that point.

4. Storage, Security, and Overseas Transfer

Data is stored with the cloud backend Supabase, on servers located in Singapore. Your personal data is therefore stored and processed outside Korea in order to provide the Service. Traffic between your device and the servers is encrypted with HTTPS.

Items transferred: everything listed in “1. What We Collect” above
Country and recipient: Singapore · Supabase (cloud infrastructure provider)
Purpose and retention: storage and processing to provide the Service · same as “5. How Long We Keep It” below

If notifications are on, their text reaches your device through Apple's push servers (APNs). If Google Calendar is connected, we communicate with Google's servers to read events. Both happen only as needed to provide the Service.

5. How Long We Keep It

We keep your personal data for as long as your account exists and destroy it without delay when you delete the account. Feedback you sent is deleted along with the account. Beta applications previously submitted through the website are kept for 90 days from submission and then destroyed; you can also ask us to delete them sooner using the contact below.

Two things remain after account deletion.

Payment records — transaction identifiers and payment or refund times. Korea's Act on Consumer Protection in Electronic Commerce requires records of payment and supply to be kept for 5 years, so we keep them for that period and then destroy them. No identifying details such as your name or email are kept with them.
Deletion record — for statistics that help us improve, we keep only when the account was deleted and how far the person got after signing up. It contains no nickname, email, event, or other content.

Where other laws require retention, we may keep data for the period they specify.

6. Deleting Your Account and Data

Use “Delete Account” in the app to permanently delete your account and the data you added (profile, events, and items you saved) at any time.
Deleting your account unpairs you; anything your partner added stays with them.
Deletion cannot be undone.
Payment records required by law, and deletion statistics containing no content, remain as described in “5. How Long We Keep It”.

7. Children Under 14

The Service is not directed to children under 14, and we do not knowingly collect their personal data.

8. Third Parties and Processors

Except where required by law, we do not sell or hand personal data to third parties. We entrust processing only to the infrastructure provider needed to run the Service (Supabase). Sign-in happens through Apple or Google accounts, and we receive the information needed — such as an email address — from whichever provider you choose.

If you connect Google Calendar, the Service receives calendar information from Google within the read-only scope you granted. Information received from Google is used only for the purposes listed in “2. Why We Use It”; it is not used for advertising, not sold to third parties, and not read by humans. You can disconnect at any time in the app or from your Google account security settings.

Payments for paid memberships are processed by Apple. The Service receives no payment method details — only the transaction identifier and status needed to confirm a purchase.

9. Your Rights

You may ask at any time to see, correct, or delete your personal data, or to stop its processing. In the app you can view and change your nickname, city, sleep hours, character, and notification settings; you can disconnect a connected calendar at any time; and you can delete your data by deleting your account. For anything else, please use the contact below.

10. Data Protection Officer

The Service designates a data protection officer to oversee personal data handling and to answer questions and complaints.

Data Protection Officer: Deborah Lee
Contact: slee.iconlab@gmail.com

11. Changes to This Policy

When this policy changes we update this page and announce the effective date at least 7 days in advance. For material changes that are adverse to users — such as broadening what we collect or why — we give at least 30 days notice and, where needed, ask for consent again.