Privacy Policy
Effective date: October 1, 2026
bombMemo ("the Service") respects your privacy and processes only the minimum information needed to provide the Service. This policy explains what information we process, why, and for how long.
1. Information we process
| Category | Items | When collected |
|---|---|---|
| Memos | Text you enter, photos and archive files you attach, creation time, scheduled deletion time, share code | When you press [Save] |
| Signed-in users | Google account identifier, email address, name, profile photo URL | When you sign in with Google |
| Consent record | Version of the terms agreed to, time of consent, confirmation of being 14 or older | On first sign-in (sign-up) |
| Reports | Code of the reported memo, reason, optional details, time of report | When you send a 🚩 report |
| Collected automatically | Access logs (IP address, browser information, request time), cookies and browser storage | While you use the Service |
| Shared-memo view count | A random visitor ID created by your browser (the original is not stored; only a hash combined with the memo code, up to 100 per memo) | When you open a shared memo |
| Usage statistics | Data collected by Google Analytics: country and region (estimated from the IP address; the IP address itself is not reported), device, browser and operating system, how you arrived, and counts of page views and feature use (saving, sharing, opening, etc.). Memo content, share codes and file names are never sent. | While you use the Service |
| Abuse-prevention records | A hashed IP address (the raw IP address is not stored) and the number of attempts when a memo code is opened or a memo is saved, plus each member's per-account daily save count. Used only to block excessive attempts and automated bulk creation. | When you open a shared memo |
| PIN (hash) | A hash of the PIN (4 to 8 digits) a member chooses. The original value is not stored and can't be viewed again. Optional. | When a member sets a PIN |
Anything you type in the editor before pressing [Save] is not sent to our servers and is not stored anywhere.
2. How we use information
- Saving memos, sharing them via a 6-character code, QR code or link, and deleting them automatically after the chosen time
- Providing signed-in users with a list of their memos and letting them make memos private or delete them
- Operating the Service, diagnosing errors and preventing abuse
- Reviewing and acting on reported memos
- Showing today's visitor count (only an anonymous daily total is stored)
- Showing ads (to users who are not signed in; banner ads to members)
- Counting how many different people opened a shared memo (used as the ad display threshold)
- Analyzing and improving the Service with usage statistics (Google Analytics)
- Preventing abuse such as brute-force guessing of codes (hashed IP, reCAPTCHA)
- Automatically screening photos uploaded by members for illegal or sexually explicit images (Cloud Vision) and suspending violating accounts
- Checking the PIN when a PIN-protected memo is opened
- Detecting duplicate reports from the same person when a report is submitted (a hash of the visitor ID combined with the memo code)
3. Retention and deletion
- Memos and photos: once the time you chose when saving has passed (up to 30 minutes for anonymous users, up to 30 days for signed-in users), access is blocked immediately and the memo is permanently deleted from our servers within about one minute. Photos and files are deleted together, and no backups are kept.
- Signed-in users can delete their memos themselves before the chosen time.
- Account information: deleted without delay when you request account deletion.
- Reports: kept for up to one year after review and then deleted.
- Abuse-prevention records: the hashed IP address is kept for up to 24 hours after the last attempt; if access was blocked for excessive attempts, it is deleted when the 24-hour block ends. Save-count records are deleted within 2 days. Image screening results (pass or blocked flag) are deleted together with the memo, and the identifier of a suspended account is kept while the suspension lasts.
- PIN (hash): replaced when a member sets a new PIN, and deleted together with the member's data on request.
- Usage statistics: event-level data in Google Analytics is deleted within 14 months.
- View-count data: deleted together with the memo. The visitor ID kept in your browser is removed when you clear browser storage.
- Access logs: kept for the default log retention period of our infrastructure provider (Google Cloud) and then deleted.
4. Service providers and international transfer
The Service runs on the infrastructure below. Memo data is stored in the Google Cloud Seoul region (asia-northeast3).
| Provider | Purpose |
|---|---|
| Google LLC (Firebase) | Web hosting, data storage (Firestore, Cloud Storage), Google sign-in, server-side functions (Cloud Functions) |
| Google LLC (AdSense) | Serving ads and measuring ad performance |
| Google LLC (Google Analytics) | Collecting and analyzing usage statistics |
| Google LLC (reCAPTCHA) | Detecting automated access (bots) and preventing abuse |
| Google LLC (Cloud Vision) | Automatically screening photos uploaded by members for illegal or sexually explicit images |
We do not sell your personal information or share it with third parties for any purpose other than those above, except where required by law.
5. Ads and cookies
Users who are not signed in may see Google AdSense ads, and members may also see banner ads. Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website and other websites.
- How Google uses advertising cookies: https://policies.google.com/technologies/ads
- Opt out of personalized advertising: https://adssettings.google.com
- Users in the European Economic Area (EEA), the UK and Switzerland are asked for consent before advertising cookies are used.
We also use browser storage (such as IndexedDB) to keep you signed in and to show your latest share code and remaining time, to remember whether you already visited today (so the visitor count is not doubled), and to remember the refresh wait time for the public memo list. You can delete or block cookies and site data in your browser settings; doing so may sign you out.
Google Analytics uses cookies (such as _ga) for usage statistics. We do not use Google signals or ad personalization features, and we do not collect data if your browser sends a Do Not Track or Global Privacy Control signal. In the European Economic Area (EEA), the UK and Switzerland, analytics cookies are not stored before you consent. If you do not want to be measured, you can install the Google Analytics opt-out browser add-on.
We use Google reCAPTCHA to tell automated access (bots) from people. Device and browser information and interaction behavior may be sent to Google in the process, and Google's Privacy Policy and Terms of Service apply.
6. About shared memos
A shared memo can be opened by anyone who knows its 6-character code, QR code or link until it is deleted. Do not share sensitive information such as passwords, national ID numbers or financial details.
Memos saved with "🎲 Show in random browse" turned on can also be viewed by people who do not know the code, in the public memo list and random browse. This option is off by default.
7. Your rights
You may request access to, correction of, deletion of, or restriction of processing of your personal information at any time. Signed-in users can delete their memos directly on the memo screen. For any other request, email us at the address below and we will handle it without delay.
8. Children
The Service is not directed at children under 14, and we do not knowingly allow children under 14 to sign in.
9. Contact
Privacy officer: Dean
Email: support@bombmemo.com
10. Changes to this policy
If this policy changes, we will post a notice on this page at least 7 days before the change takes effect.
This English version is provided for convenience. If there is any difference between versions, the Korean version prevails.