This is a reference translation. The Korean version is the original, and it prevails if the two differ. Read the Korean original.
hobbyist (“we”) provides the mobile application PLUS MINUS (the “app”) and treats your personal information with care. This policy explains what information the app handles, why, and what you can ask us to do about it.
First, the short version. The app does not connect to your bank or card accounts. It does not import account numbers, card numbers, or transaction histories, and it never asks for permission to do so. Every amount in the app is a number you typed in yourself.
If you do not sign in, your ledger never leaves your device.
1. What we handle
(a) Account information (only if you sign in)
| Item | Source | Purpose |
|---|---|---|
| Email address | Apple, Google, or Kakao sign-in | Identifying you; showing who shares a ledger with you |
| Name | Google or Kakao sign-in, when it supplies one | Passed to us by the sign-in provider when you sign in and stored with your account. The app does not use it; it shows your display name instead. |
| Profile picture URL | Your sign-in provider, when it supplies one | Showing your profile in Settings |
| Sign-in method | Which of Apple, Google, or Kakao you used | Showing the matching profile icon |
| Display name | A nickname the app generates (e.g. “Quiet Otter”) | Telling shared members apart. You can change it. |
If you choose Hide My Email with Apple sign-in, we only ever receive Apple’s relay address and cannot see your real one.
(b) Ledger entries (stored on our servers only if you sign in)
Entry name, amount, date and due day, direction (money in or out), type (fixed or variable), repeat interval, memo, per-month amount overrides, the original currency, amount and exchange rate when entered in a foreign currency, sort order, and the times an entry was created and last changed.
If you do not sign in, this stays on your device and is never uploaded. If you do sign in, we store it so a ledger can be shared, and everyone in that shared ledger can see all of its entries.
(c) Advertising identifiers
The app shows Google AdMob advertising. To serve ads, Google may collect your advertising identifier (IDFA on iOS, Advertising ID on Android), device and operating system information, network information, and records of the ads you saw and tapped. Google collects this directly; it is not passed on to us.
In regions where consent is required, such as the European Economic Area, Google’s consent form appears when you first open the app. On iOS a tracking permission prompt is shown alongside it. See Google’s partner sites policy for details.
(d) Microphone and voice
The microphone is used only while you are adding an entry by speaking. The conversion from speech to text is performed by your device’s operating system; we do not store or transmit any recording. The operating system’s speech recognition may route audio through Apple’s or Google’s servers, which is governed by their own policies. Entries made from the recognised text are handled like any other ledger entry, as described in section 1(b).
(e) What we never collect
We do not collect location, contacts, photos, call logs, or financial institution credentials, and we do not request those permissions. We do not collect national identification numbers or comparable unique identifiers.
2. Why we handle it
- Storing your ledger and syncing it across your devices and with people you share it with
- Identifying signed-in users and checking who may access a shared ledger
- Serving advertising and measuring its performance
- Answering enquiries, investigating errors, and improving the service
We do not use personal information for any other purpose.
3. Retention and deletion
- Account information and ledger entries: deleted without delay when you close your account. You can do this yourself under Settings → Delete account, which removes your shared-ledger membership and your account together.
- Entries you delete: marked as deleted so the change can sync across devices, then removed completely 30 days later.
- Ledgers of users who never sign in: held only on the device, so deleting the app deletes them. We cannot recover them.
Where law requires a longer retention period, we keep only the information concerned, held separately, for that period and then destroy it.
4. Processors and international transfers
We rely on the following providers to operate the app.
| Provider | What they do | Where data is held |
|---|---|---|
| Supabase, Inc. | Storing accounts and ledger entries; handling authentication | Republic of Korea (Seoul region). Accessible from the United States for operations and support. |
| Google LLC | Serving and measuring advertising (AdMob); Google account sign-in | The United States and other countries where Google operates servers |
| Apple Inc. | Apple account sign-in; on-device speech recognition | The United States and other countries where Apple operates servers |
| Kakao Corp. | Kakao account sign-in | Republic of Korea |
| Vercel Inc. | Hosting the website that publishes this policy, the terms, and the support page (it does not handle any app data) | The United States and other countries where Vercel operates servers |
The information transferred and the purpose are as set out in each row; transfers happen when you use the feature concerned. Retention follows section 3. You may refuse international transfer, in which case sign-in and shared ledgers will not be available to you.
When you download a font, the app connects to a font distribution server that we operate. The request for the font you want and your device’s IP address, which is needed for the connection, are sent to that server; we use them only to deliver the font.
5. Disclosure to third parties
We do not disclose your personal information to third parties, except where a law enforcement authority requires it through a lawful process, and then only to that extent.
People in the same shared ledger can see each other’s display name, profile picture, sign-in method, and every entry in that ledger. This is how the sharing feature you chose to use works, not a disclosure to a third party. An invite code changes as soon as it is used once, and the person who created the ledger can remove members.
6. Children under 14
The app is not directed at children under 14 and we do not knowingly collect their personal information. If we learn that we have, we delete it without delay.
7. Your rights and how to exercise them
You can exercise the following rights at any time.
- Access and correction: you can view and edit your ledger entries and display name directly in the app. For anything else, write to us at the address below.
- Deletion and account closure: closing your account under Settings → Delete account removes your account and your ledger entries.
- Suspension of processing: signing out stops your ledger being uploaded.
- Opting out of personalised ads: use Settings → Ad privacy settings in the app to change your choice. On iOS, Settings → Privacy & Security → Tracking; on Android, Settings → Privacy → Ads, where you can reset or delete your advertising identifier.
Email us at the address below and we will act on your request and tell you the outcome within 10 days of receiving it. A legal representative or an authorised person may make a request on your behalf.
8. How we keep it safe
- All traffic between the app and our servers is encrypted with HTTPS.
- Row-level access control in the database restricts each signed-in user to the data of ledgers they belong to.
- We keep the number of people who handle personal information to a minimum and manage their access.
9. Privacy officer
Privacy officer: Yongil Kim (hobbyist)
Email: kyi910705@gmail.com
Please send enquiries, complaints, and requests for remedy concerning personal information to the address above. If you need to report an infringement of your personal information or would like advice, you may also contact the following bodies in the Republic of Korea.
- Privacy Infringement Report Centre, Korea Internet & Security Agency (privacy.kisa.or.kr / 118, no area code needed)
- Personal Information Dispute Mediation Committee (kopico.go.kr / 1833-6972)
- Cyber Investigation Division, Supreme Prosecutors’ Office (spo.go.kr / 1301)
- Cyber Investigation Bureau, Korean National Police Agency (ecrm.police.go.kr / 182)
10. Users in the European Economic Area (EEA), the United Kingdom and Switzerland
If you use the app in the European Economic Area, the United Kingdom or Switzerland, the following also applies under the EU General Data Protection Regulation (GDPR), the UK GDPR and the Swiss Federal Act on Data Protection. Where this section differs from the sections above, whichever is more favourable to you prevails.
(a) Controller
The controller is hobbyist (Yongil Kim, Republic of Korea), who can be contacted at kyi910705@gmail.com. We have no establishment in the European Union.
(b) Legal bases for processing
| Processing | Legal basis |
|---|---|
| Storing signed-in users’ account information and ledger entries on our servers, and syncing them across devices and with the people a ledger is shared with | Performance of a contract (Art. 6(1)(b) GDPR) — necessary to provide the syncing and shared-ledger features you ask for. |
| Personalised advertising using advertising identifiers, and storing or reading information on your device for advertising | Consent (Art. 6(1)(a) GDPR and the laws on privacy in electronic communications) — you make your choice in Google’s consent form when you first open the app. If you do not consent, limited, non-personalised ads may be shown in accordance with Google’s policies. |
| Keeping the service secure, preventing misuse, and investigating errors | Legitimate interests (Art. 6(1)(f) GDPR) — our interest in keeping the service and your data safe |
| Answering enquiries | Legitimate interests (Art. 6(1)(f) GDPR) — our interest in replying to the enquiries you send and keeping a record of how they were handled |
| Retention and disclosure required by law | Compliance with a legal obligation (Art. 6(1)(c) GDPR) |
Signing in is optional. Without providing account information you can still keep your ledger on your device; only syncing and shared ledgers are unavailable. We do not make automated decisions, including profiling, that produce legal effects concerning you or similarly significantly affect you.
(c) Safeguards for international transfers
We are based, and ledgers are stored, in the Republic of Korea, for which the European Commission has adopted adequacy decision (EU) 2022/254. Where personal information is transferred to other countries, such as the United States, the safeguards under Articles 45 and 46 GDPR apply, such as the European Commission’s adequacy decisions (including the one covering companies certified under the EU–U.S. Data Privacy Framework) or the Standard Contractual Clauses offered by each provider. You can request details of these safeguards using the contact details above.
(d) Retention
Retention follows section 3 above. Enquiry emails are kept only for as long as needed to answer the enquiry and complete any follow-up.
(e) Your rights
- Right of access: you can obtain the personal information we process about you and information about how it is processed.
- Right to rectification and right to erasure: you can ask us to correct inaccurate information and, where a legal ground applies, to erase your personal information. You can also close your account yourself under Settings → Delete account.
- Right to restriction of processing: in the cases provided by law, you can ask us to pause processing.
- Right to data portability: you can receive the account information and ledger entries held on our servers in a machine-readable format (JSON).
- Right to object: you can object to processing based on legitimate interests.
- Right to withdraw consent: you can withdraw your consent to personalised ads at any time under Settings → Ad privacy settings. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
To exercise these rights, email us at the address above. To help us confirm your identity, please write from the email address you use for your account. As set out in section 7, we aim to act within 10 days, and in every case we respond within one month of receiving your request. If a request is complex or there are many requests and more time is needed, we may extend this period by up to two further months, and we will tell you the reason within one month.
(f) Complaints to a supervisory authority
If you believe that our processing of your personal information breaks the law, you can lodge a complaint with the data protection supervisory authority where you live, where you work, or where the infringement took place. The supervisory authorities of each EEA country are listed on the European Data Protection Board (EDPB) website. In the United Kingdom the authority is the Information Commissioner’s Office (ICO, ico.org.uk), and in Switzerland the Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch).
(g) Children
If you are in the European Economic Area and under 16 (or under the age set by your country, between 13 and 16), please do not create an account without the consent of a parent or guardian.
(h) Website
The website that publishes this policy does not use cookies or visitor analytics tools. Vercel Inc., which hosts the website, processes access logs (such as IP address, time of request and browser information) to run the site securely, on the basis of legitimate interests (Art. 6(1)(f) GDPR).
11. Changes to this policy
We post any change to this policy in the app or on this page at least 7 days before it takes effect, and at least 30 days before where the change is significant or disadvantageous to you. We seek fresh consent where that is required.
- Published: 14 September 2026
- Effective: 14 September 2026