Sprout Grow Labs (CEO: Kim Eunhee, the "Company") complies with the Korean Personal Information Protection Act and other applicable law, and publishes this Privacy Policy so that users' personal data is handled safely.
1. What we collect and how
We collect only the minimum needed to run the Service — what you enter, and what is generated automatically as you use it. Items without a marker are required; items marked "(optional)" can be declined without losing access to the Service.
| Category | Items | When collected |
|---|---|---|
| Social sign-in | social account identifier, name (nickname), email (where provided) | on Apple or Google sign-in (Kakao coming soon) |
| Guest | the name (nickname) you enter | when you start as a guest — stored on the device only |
| Optional profile (optional) | gender, birthday (month and day) | if you enter it on the start screen (skippable) |
| Service use | routines (name, icon, schedule, records) and streaks; focus session records (category, time, break tags); events, to-dos and timetables you enter; Mallangotchi (name, stage, vigor, dango gifts, pokes); guestbook notes, replies and reactions; Discover posts, grabs and reports; invite codes and connections (couple, friend, family); block lists; character, theme and lock screen settings; D-Day | in the course of using the Service |
| Proof photos (optional) | photos you take or choose | when you attach a proof photo to a routine (camera permission) |
| Device and notifications | push device token, OS, app version, error logs | on app launch and when you allow notifications |
| Usage analytics | usage events (screen views, whether and roughly how often features are used), member identifier, sign-in method, gender and birth year (if entered), device, app and OS information, IP address and approximate region | in the course of using the app (Amplitude — see section 7) |
| Health data (optional) | step count, exercise minutes, sleep, water intake, mindful minutes | if you separately consent to Apple Health / Health Connect integration |
| Device calendar and reminders (optional) | titles, times and calendar names of events and reminders stored on your device | if you turn on calendar sync and allow permission — read-only |
| Saving photos (optional) | none (the save permission only) | when you save a lock screen wallpaper you made to Photos |
We do not collect resident registration numbers, card or bank details, or any other payment information. Mallang is entirely free and has no in-app purchases. We do not collect the advertising identifier (IDFA), do not request App Tracking Transparency consent, and do not track users across other companies' apps or websites.
2. Information processed only on your device
The following is processed entirely on your device and never sent to our servers.
- Device calendar and reminders — read in read-only mode purely to show alongside the Calendar tab, lock screen wallpaper and widgets. Nothing is stored, modified or uploaded. Turn the sync off and they stop appearing immediately.
- Health data — used only to decide whether a routine finished itself; never transmitted to or backed up on our servers.
- Original lock screen photos — stored on the device only and excluded from server backups.
- Guest records — routines, events and records created while signed out stay on the device. Link a social account later and backups begin from that point.
3. Why we use it
- identifying members, managing accounts (including guest-to-social conversion and adding sign-in methods) and providing the Service
- backing up and restoring records — so routines, events, to-dos, your Mallangotchi and your styling survive a reinstall or a new device
- showing social features: friend and family connections, guestbooks, cheers, dango gifts and study rooms
- posting, reviewing, recommending and ranking shared routines in Discover
- personalising routine suggestions using your optional profile (gender)
- sending notifications: routine reminders, guestbook reactions, friend news and daily words (all service notifications), plus offers and events (only with separate consent)
- improving features through usage analytics (used in aggregate; we do not inspect individuals)
- keeping the Service stable, analysing errors, answering enquiries, handling reports and blocks, and preventing abuse
- meeting legal obligations
4. What other users can see
Mallang is used together with other people, so some information is shown to them. The table below sets out exactly what — this is not the same as the Company providing personal data to third parties.
| Where | What is shown | Who sees it |
|---|---|---|
| Friend home and guestbook | name, character, the completion status and streak of routines you chose to share, guestbook notes, replies and reactions, proof photos on shared routines, and your Mallangotchi (name, stage, vigor) | connections you accepted (couple, friend, family) |
| Study rooms | nickname (can be turned off), character and stage, focusing/resting status, total focus time today | others in the same room — account identifiers are never exposed |
| Study stats | the last 62 days of study timer records — daily focus time, start and end times to the minute, break time and what you focused on (routine or subject name). Gym and general timer records are not included. | connections you accepted, and others in the same study room — account identifiers are never exposed |
| Discover (shared routines) | the name and setup of routines you chose to share, and the author's name (anonymous is an option), a streak summary and how many people grabbed it | all users — posted after the Company approves it |
- Routines are private by default, and you choose the audience for each routine by relationship.
- You can turn off nickname display in study rooms; you then appear anonymously. End a session and you disappear from the room.
- Study stats display is a permanent part of studying together (study rooms and friends). However, only study timer records are shared — use the general or gym timer for focus sessions you would rather not share, and they are neither collected nor shared.
- You can take a Discover routine down at any time. Individual records and who is currently doing it are never made public.
- Blocked users cannot see each other's information.
5. How long we keep it
- Personal data is destroyed without delay when you delete your account. Running [My → Delete account] deletes your original proof photos first, then the account, and the linked profile, backups, shared routines, guestbook, connections (including the other side's list), notifications, push tokens, Mallangotchi and focus records are deleted immediately in cascade. There is no grace period.
- Signing up again with the same social account issues a new member identifier; previous records are not restored.
- Notes you left on other users' homes remain with the author information removed (shown as "deleted user").
- Usage events may remain in the analytics tool in aggregate, non-identifying form; even then, the link to your member identifier is severed when you delete your account. You can request deletion at the contact in section 9.
- Where law requires retention, we keep the data for that period (for example, three years for consumer complaint and dispute records under the Korean Act on Consumer Protection in Electronic Commerce).
6. Providing data to third parties
We do not provide or sell users' personal data to third parties. Information is shown to other users according to the audience you chose, as set out in section 4. Lawful requests grounded in legislation are an exception.
7. Processing on our behalf and overseas transfer
We entrust processing to the parties below to run the Service. Where a processor is located overseas, we disclose the following under Article 28-8 of the Korean Personal Information Protection Act. Transfer happens automatically over the network as you use the Service.
| Processor | Work entrusted and items transferred | Country | Retention |
|---|---|---|---|
| Supabase, Inc. (Supabase) | database, authentication and storage — everything stored on our servers per section 1 (credentials, profile, record backups, social data, proof photos) | Republic of Korea (Seoul region) | until you delete your account |
| Amplitude, Inc. (Amplitude) | usage analytics — member identifier, usage events, gender and birth year (if entered), device, app and OS information, IP address | United States | the period set in the processing agreement, from the date of collection |
| Apple Inc. (APNs) Google LLC (FCM) | push notification delivery — device token, notification title and body | United States | as long as delivery requires |
You may refuse overseas transfer. To refuse the analytics transfer (Amplitude), write to the privacy officer at mallang-privacy@sproutgrowlabs.com and we will act without delay; refusing does not limit your use of the Service. Database and authentication (Supabase) and push delivery are, however, essential to providing the Service, so refusing those may limit the relevant features or membership.
Processing agreements require compliance with data protection law, prohibit processing beyond the stated purpose, restrict sub-processing and mandate safeguards; we supervise accordingly. Any change of processor is disclosed in this policy.
8. Children under 14
Children under 14 may use the Service only with a legal guardian's consent. Where we learn that data belongs to a child, we verify guardian consent and, if it cannot be confirmed, destroy the data without delay.
9. Your rights
- You can view and correct your personal data at any time (edit your name, character and optional profile under [My] in the app).
- You can withdraw consent and request deletion through [My → Delete account]; it is processed immediately, as set out in section 5.
- Per-routine audiences, study room nickname display and routines posted to Discover can all be changed or withdrawn from their own screens at any time.
- Notification consent can be withdrawn item by item under [My → Notifications] (routines, guestbook, friend news, daily words, offers). Offers and events are sent only on opt-in, and we notify you of the outcome when you consent or withdraw.
- Health, calendar, reminders, camera and photo permissions can be withdrawn at any time in your device settings.
- You can also exercise your rights of access, correction, deletion and suspension of processing by email (mallang-privacy@sproutgrowlabs.com); we act without delay, within 10 days of the request. Requests may also be made through a legal guardian or an authorised representative.
10. Destruction of personal data
Personal data is destroyed without delay once its retention period has passed or its purpose has been fulfilled. Electronic files are deleted irrecoverably; printed material is shredded or incinerated.
11. Security measures
- encryption in transit (TLS) and encryption of key information at rest
- per-user access control — row-level security at the database level, enforced server-side so that only you and the people you allowed can read your data
- proof photos are kept in private storage, readable only by you and the friends that routine is shared with
- minimum access privileges, access logging and audit logs of data changes — for answering enquiries and analysing abuse
- vulnerability review and training for staff who handle personal data
12. Privacy officer
| Category | Details |
|---|---|
| Privacy officer | Kim Eunhee (CEO) |
| Contact | mallang-privacy@sproutgrowlabs.com |
You can report or seek advice on privacy infringement from the Korea Internet & Security Agency's Privacy Infringement Report Centre (privacy.kisa.or.kr, 118) or the Personal Information Dispute Mediation Committee (kopico.go.kr, 1833-6972).
13. Changes to this policy
If this policy is added to, removed from or amended, we announce it in the app's notices and on this page from 7 days before it takes effect (30 days for changes material to users' rights).
Revision history
- Version 2.1 (effective date to be confirmed) — stopped collecting full date of birth in the optional profile, taking only the birthday (month and day). Years already collected were deleted, leaving month and day. Added a Study stats row to "What other users can see" — connections and others in the same study room see the last 62 days of study timer records (focus time by hour, breaks, what you focused on), limited to study timer records.
- Version 2.0 (effective 18 August 2026) — added usage analytics (Amplitude) and overseas transfer; reflected the optional profile (gender, date of birth), proof photos, focus records, Mallangotchi and Discover in the collected items; added the sections "What other users can see" and "Information processed only on your device"; added guidance on device calendar and reminders integration; corrected the health data items to what is actually collected (steps, exercise minutes, sleep, water intake, mindful minutes); corrected account deletion to immediate and complete erasure.
- Version 1.0 (effective 23 July 2026) — first issue.
Addendum
This policy (version 2.0) takes effect on 18 August 2026 and replaces the previous policy (version 1.0, effective 23 July 2026).