Last updated: 2026-10-14 · Effective: October 21, 2026
Archived version (effective October 21, 2026). The current Privacy Policy is at a-cha.app/privacy. · 이전 판(2026년 10월 21일 시행)입니다. 현재 개인정보처리방침은 a-cha.app/privacy 에 있습니다.
아차코리아 (ACHA KOREA) ("A-CHA", "we") runs the A-CHA mobile app and the website a-cha.app (the "Service"). This policy explains how we handle personal data under the Korean Personal Information Protection Act and how to reach us. We do not sell your personal data, and we do not track you for advertising.
We process personal data only for the purposes below. If a purpose changes, we tell you first and ask for consent where required.
| Area | What | Required |
|---|---|---|
| Sign-up and sign-in | Email address (email sign-up and code sign-in), or the name, email and account ID returned by Google or Apple sign-in | Required |
| Profile | Nickname, nationality | Required |
| Profile | Stay period, school, profile photo, intro, friend card | Optional |
| Profile links | App usernames for 13 apps such as Instagram (a phone number for WhatsApp), and whether each is shown on the web | Optional |
| School verification | A photo of your ARC or student ID, deleted after the review decision | Optional |
| Your content | Posts, comments, photos, chat messages, voice messages (recorded only while you hold the button, up to 60 seconds), reviews, events you create | When used |
| A-CHA event bookings | Booking details (event, quantity, amount, payment method), the sender name for bank transfers, your refund account (bank, account number and holder, or a Wise or similar email), PayPal transaction ID, ticket and entry records, points used. Card details are handled by PayPal and never stored by us. | When used |
| Club sign-ups and dues | Name, country, school, answers to the club's form, payment method (cash or transfer), whether you sent the money | When used |
| Split bill payout details | Whichever you enter of: Revolut, Wise or PayPal username, Korean bank account, English name, phone, email, date of birth, address | Optional |
| Booking requests | Name as on your passport, contact details, date and party size (we never ask for your passport number) | When used |
| Housing | What you write in a listing inquiry or the help request form | When used |
| Trips | What you write as your accommodation, and the nearest station (no coordinates are stored) | Optional |
| Location | Your device location when you open a nearby map (used on your device only), location pins you send in chat, live location while you share it | Optional |
| Translation | The text of a message you tap to translate | When used |
| Points and invites | Referral code, points history | When used |
| Contact us | Email (web form), name (optional), your message, the related event | When used |
| Generated automatically | Push token (if you turn on notifications), access logs (IP address, time, browser and device information) | Automatic |
Profile links (optional): the username or ID you add for Instagram, Snapchat, TikTok, Threads, BeReal, WhatsApp, Telegram, Discord, Spotify, VSCO, KakaoTalk, WeChat or LINE, and whether you chose to show each link on the web. For WhatsApp this is your phone number, and the app asks you to confirm before it is saved. We store only what you type.
The free tests on the website (Kimchi Gauge, Korean Saju, the Nunchi Exam) keep your answers and results in your browser only and do not store them on our servers. If you share a result, the result (for Saju, including the birth date and name you entered) is part of the share link. Visit counts send only the event name, the referring channel and your browser language, with nothing that identifies you.
We delete personal data without delay when you delete your account or the purpose is fulfilled, except for the following.
| Data | Kept for | Basis |
|---|---|---|
| School verification photo | Deleted right after the review decision | Our policy |
| Profile links | Until you remove them or delete your account | Our policy |
| Booking request contact details | Deleted 30 days after the request | Our policy |
| Contact us conversations | 1 year after the last message, or 3 years if tied to an order | Our policy, E-Commerce Act |
| Contract, withdrawal and payment records | 5 years | E-Commerce Act Enforcement Decree, Art. 6 |
| Consumer complaint and dispute records | 3 years | E-Commerce Act Enforcement Decree, Art. 6 |
| Advertising records | 6 months | E-Commerce Act Enforcement Decree, Art. 6 |
| Access logs | 3 months | Protection of Communications Secrets Act Enforcement Decree, Art. 41 |
Profile links are deleted when you remove them or delete your account. Verification documents are deleted right after the review decision.
We use personal data only for the purposes in Article 1 and share it with third parties only with your consent or where the law specifically requires it. We share it, with your consent at the time you apply, in these cases:
| Recipient | Purpose | Data | Kept for |
|---|---|---|---|
| Staff of the club you sign up with | Confirming sign-ups and payments, managing the member list | Name, country, school, form answers, payment method, whether you sent the money | Until the club finishes running the event |
| The vendor of a booking request | Confirming the booking, payment instructions, boarding or entry | Name as on your passport, contact details, date and party size | Our copy of the contact details is deleted after 30 days |
| The agent of a listing you ask about | Answering your inquiry | Your message, nickname, the profile fields you show | Until the inquiry is handled |
Payout details you enter in split bills are visible only to the people you split with. If a club's staff connect their member list to a Google Sheet, that club's list is also written to that sheet.
We use the providers below to run the Service. Most are outside Korea, so personal data is sent to them over the network when you use the Service. They keep it until the contract ends or you delete your account.
| Provider (country) | What they do | Data |
|---|---|---|
| Supabase Inc. (USA; data stored in the project's configured region) | Database, sign-in, file storage, server functions | All personal data processed in the Service |
| Vercel Inc. (USA) | Website hosting | Website access logs and what you enter on the website |
| 650 Industries, Inc. (Expo, USA) | Delivering app push notifications | Push token, notification content |
| Google LLC (USA) | Google sign-in, message translation, maps on Android, Google Sheets that clubs connect | Sign-in data, messages you ask to translate, map location, club member lists |
| Apple Inc. (USA) | Sign in with Apple, iOS push notifications | Sign-in data, push token |
| PayPal (USA; local entity per PayPal's policy) | PayPal payments and refunds | Amount, PayPal transaction data |
| Resend, Inc. (USA) | Sending sign-in and verification emails | Email address |
| Telegram (UAE; per Telegram's policy) | Alerts to our staff (sign-ups, payments, support) | Nickname and partly masked email, name, account and contact details |
| NAVER Corp. (Korea) | Sending support replies by email, reading bank deposit notices | Email address, sender name and amount |
If you do not want your data transferred abroad, you can stop it by deleting your account, but you will then be unable to use the Service.
We use your device location only when you open a nearby map or share a location in a chat, and never in the background. On a nearby map, your location is used on your device to center the map. A pin you choose to share is stored as your chat message. Live location is always opt-in: you pick how long it runs (15 minutes, 1 hour or 8 hours, extendable up to 8 hours in total), it updates only in that chat, you can stop it any time from the banner in the chat, and it stops by itself when the time runs out.
When the retention period ends or the purpose is fulfilled, we delete the data without delay. Electronic files are deleted so they cannot be recovered, and we keep no paper records. Data kept by law is stored separately and deleted when its period ends. When you delete your account, we delete or anonymize your profile, posts, comments, reviews, chat messages and verification documents.
Children under 14 cannot join without the consent of a parent or legal guardian. We do not knowingly collect personal data from children under 14 without that consent, and we delete it without delay if we find out.
We do not use advertising or tracking cookies. The website keeps your language choice, test results and sign-in state in your browser's storage, which you can clear in your browser settings. Clearing it signs you out and removes saved test results.
| Privacy officer | 신형구 (CEO) |
| acha0516@naver.com | |
| Phone | 010-3049-3225 |
For reports or advice about a privacy violation, you can contact:
When this policy changes, we announce it in the Service at least 7 days before it takes effect, or 30 days before for changes that significantly affect your rights. This policy is provided in Korean and English. If the two differ, the Korean version applies.
This policy takes effect on October 21, 2026. Previous version (July 25, 2026): see here.