domongPrivacy Policy
This is an English translation. If it differs from the Korean version, the Korean version prevails.
AMINI STUDIO (“we”) protects the personal information processed through the Domong mobile app, the domong.app website, customer support, and account deletion requests (the “Service”) as described in this policy. Domong lets app developers see their own app sales, ad revenue, analytics, reviews, and rankings in one place.
1. What we process, why, and for how long
| Category | Data | Purpose | Retention |
|---|---|---|---|
| Account | Google or Apple sign-in identifier, email (or Apple’s private relay address), sign-in method, session | Sign-in, account linking, identity | Until the account is deleted |
| Guest | Anonymous account identifier, added apps | Viewing rankings without signing in | Until you clear it; deleted automatically after 30 days of inactivity |
| Connections | App Store Connect issuer ID, key ID and private key; refresh token and partially masked email for Google connections; AdMob publisher ID; Google Analytics property IDs; Google Play report bucket identifier | Fetching reports from services you connect | Until you disconnect or delete the account |
| App metrics | App identifiers, store sales and refunds, ad revenue and performance, aggregated install and usage statistics, history by country and date | Dashboard, morning briefing, milestone cards | Until the account is deleted |
| Reviews | Rating, title, body, country or language, app version, date, reply status (Apple reviewer names are masked) | Review inbox | Until the account is deleted |
| Notifications | Push token, device and session identifiers, time zone, language, notification settings, delivery results | Morning notifications | Until you turn notifications off or delete the account; delivery logs are deleted after 30 days |
| Plan | Plan type, period, trial end time, store transaction identifiers | Providing Pro, restoring purchases | Until the account is deleted; legally required records as below |
| Support | Email address, message, attachments | Handling inquiries and deletion requests | 1 year after resolution; 3 years for dispute records |
| Service logs | IP address, request time, errors, browser or device information | Security and incident response | Server logs and backups: up to 7 days |
We also collect public App Store rankings and public app information. This data does not belong to any user and is kept separate from users’ private revenue data.
Legal retention: Under Korea’s Act on Consumer Protection in Electronic Commerce, records of contracts or withdrawals and of payments and supply are kept for 5 years, and records of complaints and disputes for 3 years. Because the App Store and Google Play process payments, we keep only the records we hold.
2. Google user data
When you connect AdMob or Google Analytics with your Google account, we read data only with the permissions you grant:
- AdMob (
admob.readonly): your AdMob accounts and apps, and ad revenue and performance reports, used to show revenue and changes by app, country, and ad format. - Google Analytics (
analytics.readonly): your properties and data streams, and aggregated user, engagement, and acquisition reports, used in the Users tab of each app. - Basic profile (openid, email): stored as a partially masked email so you can see which Google account is connected.
Storage: refresh tokens are kept in an encrypted server vault (Supabase Vault), and fetched reports in our database in the Seoul region. Sharing: we do not sell Google user data or use it for serving ads, ad targeting, or credit decisions, and we do not transfer it to third parties except to service providers needed to run the Service (section 5) or when required by law. Our staff do not read this data unless you consent or it is necessary for security or legal reasons. AI: we do not use Google user data to train AI or machine-learning models.
Domong’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Revoking access: when you disconnect in the app or delete your account, we delete the stored token and ask Google to revoke it. You can also remove access at your Google Account’s third-party connections.
3. Apple and Google Play data
We process App Store Connect data only to provide Domong on behalf of the developer who connected it. We do not combine it with, or compare it against, other developers’ private data. App Store Connect API keys you enter are stored in an encrypted vault and stop working as soon as you revoke them in App Store Connect.
For Google Play, you invite Domong’s service account in Play Console, so we never receive your password or keys. Removing the invitation ends our access.
4. Disclosure to third parties
We do not provide your personal information to third parties, except with your consent or as required by law. When you create and share a milestone card, you send its contents yourself to the destination you choose.
5. Service providers and international transfers
We use the providers below to run the Service, and personal information is transferred abroad in the process. Transfers happen over the network when you use the Service, receive notifications, visit the website, or contact us.
| Recipient (contact) | Country | Data | Purpose | Retention |
|---|---|---|---|---|
| Supabase, Inc. and affiliates (privacy@supabase.com) | Republic of Korea (stored in Seoul region); U.S. and Singapore (operational and support access) | Account, connection, metric, review, notification, and plan data in section 1 | Authentication, database, encrypted storage, server functions | As in section 1 |
| 650 Industries, Inc. (Expo, expo.dev/contact) | U.S. | Push token, notification content | Delivering push notifications | Per the provider’s policy after delivery |
| Apple Inc. (apple.com/legal/privacy/contact) | U.S. | Push token, notification content, Sign in with Apple data | iPhone notifications, Sign in with Apple | Per the provider’s policy |
| Google LLC (policies.google.com/privacy) | U.S. | Push token, notification content, Google sign-in data, support email | Android notifications (FCM), Sign in with Google, support email (Google Workspace) | Per the provider’s policy; support email as in section 1 |
| Cloudflare, Inc. (privacyquestions@cloudflare.com) | U.S. and countries in Cloudflare’s network | IP address, browser information, requested URL | Serving the website, security | Per the provider’s policy |
To refuse these transfers, email privacy@domong.app or delete your account. The transfers are necessary to run the Service, so refusing means you cannot use it. To refuse only notification-related transfers, turn off notifications in the app or device settings.
6. Deletion
We delete personal information without delay once its retention period ends or its purpose is met. Database records and vault secrets are deleted, and copies in backups disappear when the backup period (up to 7 days) ends. Records we must keep by law are stored separately with restricted access and deleted when the period ends.
7. Your rights
You can request access, correction, deletion, or suspension of processing, or withdraw consent at any time. You can delete your account in the app’s settings or email privacy@domong.app. We may ask for information to confirm you own the account, and we respond within the period required by law. See account deletion for steps.
The Service is not intended for children under 14, and we do not knowingly collect their personal information.
8. Automatic collection
The website uses no cookies, ads, or visitor analytics. The app contains no advertising or behavioral analytics SDKs and does not collect advertising identifiers. The photo library is used only when you save a milestone card.
9. Security
- Credentials and tokens are kept in an encrypted vault readable only by server functions.
- Row-level security limits each user to their own data.
- All traffic is encrypted with HTTPS.
- We request read-only access from connected services.
- Operational access is limited to the representative, and secrets are never written to logs.
Please do not send API keys or passwords to support.
10. Privacy officer and remedies
Privacy officer: Domin Kim (Representative) · privacy@domong.app
Company: AMINI STUDIO, Business Registration No. 385-22-02328
Residents of Korea can also contact the Personal Information Infringement Report Center (privacy.kisa.or.kr, 118) or the Personal Information Dispute Mediation Committee (kopico.go.kr, 1833-6972).
11. Changes
We will announce changes on this page and in the app 7 days before they take effect, or 30 days before for important changes or changes that are unfavorable to you.