Privacy Policy

Byeongsu KIM (the "Operator"), who operates RootblySub (the "Service"), complies with the Personal Information Protection Act of Korea and related laws, and establishes and discloses this privacy policy to protect users' personal data. This policy applies to the mobile application, the Chrome extension, and the website.

Effective date: 2026-08-24

1. Personal data collected and how it is collected

The Operator collects only the minimum information needed to provide the Service. You can use the Service without creating an account; signing in is optional.

Category	Data collected	How it is collected
All users	IP address, time of request, request type	Generated automatically while you use the Service
Mobile app users	A hash of the device identifier (SHA-256, 64 characters)	The app converts the device identifier into a hash on your device and sends only the hash. The original identifier is never collected
When requesting a translation	The address, title, and channel details of the requested video, the requested language, and an email address for notifications (optional)	Entered by you
Signed-in users	Email address, name, and the account identifier from the sign-in service	Provided by Google or Apple when you sign in
When push notifications are enabled	Push notification token	Generated automatically when you allow notifications
When contacting support	Your message and reply email address	Entered by you
Subtitle pages on the website	Video identifier, IP address, date of the view	Recorded automatically to count daily views of a subtitle page

What is not collected

The Operator does not measure how long you stay on a page or how long you use the Service, does not store your device's operating system, and does not collect precise location data. No third-party analytics tools are installed in the mobile app or the Chrome extension. The website uses Google Analytics 4 to understand aggregate service usage: pseudonymized usage records (pages visited, browser type, approximate region) are transmitted via cookies to Google LLC (United States). You can refuse this collection with your browser's cookie controls or the Google Analytics opt-out add-on (tools.google.com/dlpage/gaoptout). Advertising identifiers (IDFA/AAID) are neither collected nor used. Counts of which download button was pressed, and of navigation from a listing to a video, are recorded as counts only, with no information that could identify you.

2. Purposes of processing

The Operator uses collected personal data only for the purposes below, and will obtain your consent in advance if these purposes change.

Receiving and processing subtitle generation and translation requests, and delivering the resulting subtitles
Preventing abnormally repeated translation requests and circumvention of usage limits (prevention of service abuse). IP addresses and hashed device identifiers are used for this purpose only
Identifying members, keeping you signed in, showing your own request history, and processing account deletion
Sending notices needed to use the Service, such as translation completion
Receiving and replying to enquiries, and responding to incidents
Producing statistics to improve the Service, such as ranking popular videos

The Operator does not use this information for advertising, marketing, behavioural analytics, or tracking.

3. Retention and use periods

The Operator destroys personal data without delay once the periods below have passed. Destruction happens automatically and requires no request from you.

Data	Retention period
Access and usage records (IP address, hashed device identifier, time and type of request)	180 days from collection
Subtitle page view counts (video identifier, IP address, date of view)	180 days from collection
Member information (email address, name, account identifier)	Until you delete your account
Push notification token	Until you disable notifications or delete your account
Translation request history and generated subtitles	For as long as the Service operates. When you delete your account the history is unlinked from it; subtitles are retained because they are shared content used by other users
Enquiry content and reply email address	Until the enquiry has been resolved

Where applicable law requires data to be preserved for a set period, it is kept for that period and then destroyed.

4. Provision of personal data to third parties

The Operator does not provide or sell your personal data to third parties, except in the following cases.

Where required by law, or where an investigative agency requests it under the procedures prescribed by law
Where necessary to protect the imminent life, physical safety, or property interests of the data subject or a third party

Entrusting processing operations that are necessary to run the Service is not provision to a third party; those arrangements are set out in section 5 below.

5. Entrusted processing and transfer overseas

To provide the core features of the Service — such as subtitle generation and translation — the Operator entrusts processing as set out below. As all processors are located outside Korea, details of the overseas transfer are provided together in accordance with Article 28-8 of the Personal Information Protection Act. What is shared is limited to what each purpose requires, and processors may not use the information for any other purpose.

Recipient / Country	Entrusted work	Data transferred	Timing, method, and retention
Groq, Inc. United States	Converting speech into text to generate subtitles	The audio of the video you requested	Transferred over HTTPS at the time the feature is used, and kept until the processing purpose is fulfilled
OpenAI, L.L.C. United States	Translating generated subtitles and producing summary text	Subtitle text	Transferred over HTTPS at the time the feature is used, and kept until the processing purpose is fulfilled
Google LLC United States	Google account sign-in, and delivery of Android push notifications (FCM), and website usage analytics (Google Analytics 4)	Email address, account identifier, push notification token, and (website only) pseudonymized usage records via cookies	Transferred over HTTPS at the time the feature is used, and kept until the processing purpose is fulfilled
Apple Inc. United States	Apple account sign-in, and delivery of iOS push notifications (APNs)	Email address, account identifier, push notification token, and (website only) pseudonymized usage records via cookies	Transferred over HTTPS at the time the feature is used, and kept until the processing purpose is fulfilled
Cloudflare, Inc. United States	Relaying support enquiries	Your message and reply email address	Transferred over HTTPS at the time the feature is used, and kept until the processing purpose is fulfilled
Discord Inc. United States	Receiving support enquiries and incident alerts	Your message and reply email address	Transferred over HTTPS at the time the feature is used, and kept until the processing purpose is fulfilled

The content sent for subtitle generation and translation does not include your account information, email address, IP address, or device identifier. The Service's database runs on servers located in the Republic of Korea.

You may refuse the transfer of your personal data overseas. However, the arrangements above are necessary to provide core features such as subtitle generation, translation, sign-in, and notifications, so refusing may limit your use of those features. To refuse, please contact the privacy officer named below.

6. Procedure and method of destruction

The Operator destroys personal data without delay once its retention period has passed or its processing purpose has been fulfilled. For access and usage records and subtitle page view counts, a cleanup job that runs once a day automatically deletes records older than the retention period (180 days). No application or approval step is required.

Personal data stored as electronic files is deleted from the database so that it cannot be recovered. The Operator does not hold personal data in printed form.

7. Rights of data subjects and legal representatives, and how to exercise them

You may exercise the following rights at any time, either through features in the app or by emailing the privacy officer named below. The Operator will act on your request without delay.

Request access to your personal data
Request correction of any errors
Request deletion
Request that processing be suspended

Information tied to your account can be deleted directly from the app's Settings screen using [Delete account]. The account deletion page describes in detail what is deleted and what is retained.

The hashed device identifier is collected independently of any account and cannot be reversed, so it is not possible to identify a particular user's records from it. Uninstalling the app stops the collection, and reinstalling issues a new identifier different from the previous one. In every case these records are destroyed automatically 180 days after collection.

You may exercise these rights through a legal representative or an authorised agent, in which case documentation evidencing that authority must be provided.

9. Measures to ensure the security of personal data

All communication between your device and the server is encrypted with HTTPS.
The device identifier is converted into a one-way hash (SHA-256) on your device before transmission, so only a value that cannot be reversed is stored on the server.
Sign-in tokens are kept in the secure storage provided by the operating system.
Access to personal data is limited to the minimum number of people required, and access rights are reviewed regularly.
Records past their retention period are destroyed automatically, keeping the volume of stored personal data to a minimum.

10. Personal data of children under 14

The Operator does not collect personal data from children under the age of 14, and the Service is provided to users aged 14 and over. If the Operator learns that personal data of a child under 14 has been collected without the consent of a legal representative, it will be destroyed without delay. If you believe a child has provided personal data, please let the Operator know using the contact details below and the necessary action will be taken.

11. Privacy officer

The Operator has designated the following privacy officer to oversee personal data processing and to handle enquiries, complaints, and remedies from data subjects. Enquiries about personal data sent to the address below will be answered without delay.

Name: Byeongsu KIM
Role: Privacy Officer (Service Operator)
Contact: rootbly.service@gmail.com

12. Remedies for infringement of rights

If you wish to seek redress for harm caused by a personal data breach, you may apply to the following bodies for dispute resolution or advice. You may also file an administrative appeal if you object to the action taken by the Operator in response to a request made under Articles 35 to 37 of the Personal Information Protection Act.

Personal Information Dispute Mediation Committee — 1833-6972 (www.kopico.go.kr)
Privacy Infringement Report Centre — 118 (privacy.kisa.or.kr)
Supreme Prosecutors' Office, Cybercrime Division — 1301 (www.spo.go.kr)
Korean National Police Agency, Cybercrime Reporting System — 182 (ecrm.police.go.kr)

13. Changes to this privacy policy

If this privacy policy is added to, removed from, or amended, notice will be given on the website at least 7 days before the change takes effect. Where there is a significant change to users' rights, notice will be given at least 30 days in advance.

Compared with the previous version (effective 13 March 2026), this version adds details on device identifier collection, entrusted processing and overseas transfer, retention periods, and how to exercise your rights.