Naekiro Privacy Policy
Effective: September 30, 2026
Operator: BathTime Studio (바스타임스튜디오)
Contact: getbathtime@gmail.com

1. Information stored in the app
Basic search and practice do not require an account. Recent songs, playlist names, saved song titles, video and thumbnail URLs, and semitone settings are stored in the app's private space on your device. Your last “Prefer backing tracks” setting and home song group are also stored on the device. Except for explicit public posts described in section 7, this information is not sent to the operator's servers. The app does not use cloud sync or Android automatic backup. Suggestions and thumbnails are temporarily cached in memory while the app runs. Chart song titles, artists, chart periods and refresh times are stored on the device for offline display.

App language and whether recent playback is recorded are also stored on the device. Turning recording off stops adding new history. Existing history can be cleared separately in Settings without changing your library.

This version does not offer file backup or restore. Backups exported in earlier versions may contain playlist names, song titles, video and thumbnail URLs, saved keys and practice notes. The files are not encrypted and can be read by anyone with access to that storage. A cloud storage provider handles transfer and storage under its own policy. Existing files survive app removal; delete them from the chosen storage location when no longer needed.

Ratings you explicitly save (low, comfortable or high), the rated key and date, personal notes and practice status are stored only on this device and are not sent to our servers or analytics events. These manual notes are separate from the recent playback setting. The latest record for up to 500 videos is kept; you can edit or delete it in Song notebook in Settings. This feature does not collect a full rating history or practice-time report.

Submitted search queries are stored locally, up to 10, under a separate search history setting. URLs and autocomplete drafts are excluded from this history. Turning the setting off hides history and stops recording without removing existing entries; individual or all entries can be deleted. The last practice song, key, confirmed content position and queue are saved locally for a manual continuation. Personal saved-song suggestions use only saved songs, latest ratings and playback dates still available on this device and can be disabled in Settings. Search history and continuation state are not included in analytics events. These features add no new server transmission or cloud backup.

2. Connections to external services
Search, suggestions, video playback and thumbnails connect directly to Google/YouTube and the relevant content servers. When you pause typing, suggestions may send part or all of the query before you press Search. Requests may include the query, selected video identifiers, and language/country settings corresponding to the app language. With backing search enabled, a localized backing keyword may be added to the query. Your IP address and request headers are transmitted in the course of internet communication. External services handle and retain information under their own policies.
Video playback uses YouTube's embedded player and official playback-control API inside an app WebView. YouTube third-party cookies are allowed to preserve the player's sign-in, advertising and playback context. YouTube may use its own cookies and web storage and show advertisements. This is separate from optional Naekiro PostHog analytics and governed by Google policies. WebView file access and microphone/camera permission requests are denied.
Google Privacy Policy: https://policies.google.com/privacy?hl=en

Refreshing Korean songs connects directly to TJ Media's public chart; refreshing Japanese songs connects to the JOYSOUND (XING) public chart. Requests include the chart type, period or public page address, but not your personal queries, playback history or playlists. Your IP address and request headers are sent to the respective servers. Pop recommendations are included in the app and require no chart request to display. Tapping a source or reference catalog link opens that website in an external browser.
TJ Media Privacy Policy: https://www.tjmedia.co.kr/terms?cate_cd=T01
JOYSOUND (XING) Privacy Policy: https://xing.co.jp/privacy

3. Optional usage analytics and advertising
Analytics is off by default. Only after you agree in the notice or Settings does the app send events over HTTPS to PostHog, Inc. using its EU ingestion service in Frankfurt, Germany. Previous Firebase consent is not reused for this service. The purpose is to improve features and reliability.
Events contain app screens, search success/failure and result counts, actual practice time, pitch/save/queue actions and reuse of saved songs, banner impressions/load failures by placement, app version/language/orientation, timestamps and a randomly generated installation identifier. We do not include search text, song titles, video URLs, playlist names, email or voice. PostHog analytics does not use login identities or advertising IDs, record screens, automatically capture clicks or personalize advertising.
Internet requests transmit IP addresses and request headers. Analytics IP geolocation is disabled and the project is configured to discard client IP addresses from stored events. Service/security processing and international processing follow PostHog's privacy and subprocessor policies.
All practice features work if you decline. Turning analytics off stops new transmissions, cancels in-flight requests, and removes the local analytics identifier and unsent queue. It does not immediately delete records already received by the service. Unsent events are bounded and kept only in memory; some may be lost offline or when the app closes.
The free plan provides one year of event data retention; this is not a guarantee of automatic deletion exactly one year later. Contact getbathtime@gmail.com for access or deletion requests. Without a login identity, an email alone may not locate past events. We will explain what can be located and the available deletion procedure. Retention and deletion follow the service's actual policies and procedures.
PostHog Privacy Policy: https://posthog.com/privacy
Data storage and deletion: https://posthog.com/docs/privacy/data-storage
Advertising
Google AdMob banner ads appear on Home and the portrait player. We do not use interstitial or rewarded ads. Advertising is separate from optional PostHog analytics; turning analytics off does not stop advertising processing. The Firebase Analytics SDK is not included.
For ad delivery, measurement, analytics and fraud prevention, the Google Mobile Ads SDK may collect and share IP addresses (which may estimate approximate location), app/ad interactions, diagnostic and performance information, and device identifiers such as Android advertising ID and app set ID. You can delete or reset the advertising ID in Android settings. The developer does not directly add search text, song titles, video URLs, your library or voice to ad requests.
Google UMP provides consent and refusal choices where required for your region, and the advertising SDK initializes only after UMP permits ad requests. Where required, you can revisit your choices through Advertising privacy choices in Settings. Declining does not prevent practice; depending on your choices and region, limited ads or no ads may be shown.
Advertising data is encrypted in transit using TLS. Processing, international transfers, retention and deletion by Google and advertising partners follow their policies. Withdrawing PostHog consent does not delete data already sent to Google.
Google advertising privacy: https://policies.google.com/technologies/ads?hl=en

4. Retention and deletion
You can delete saved songs and recent history within the app, or clear Naekiro's storage/data in Android settings. Uninstalling also removes the app's data from your device. Clearing all data or uninstalling can erase saved playlists and should be your own choice. For information independently processed by external services, use those services' rights-request procedures.

5. Support inquiries
The contact screen only displays the support email address (getbathtime@gmail.com). The in-app form and automatic sending are disabled. Tapping the address lets you compose and send an email yourself in an external email app. Naekiro does not automatically attach app or Android versions, playback history, your library or device identifiers.
The operator uses the email address and message you send to handle and answer your inquiry. Your chosen email service and the operator’s Gmail service process and store the email under their respective privacy policies.
Do not send passwords, identity documents or payment details. To request access, correction or deletion, contact the same support address. The operator deletes inquiry emails when the response and follow-up are complete, except where a legal retention obligation applies. Sending an inquiry is optional; search, playback and your library work without it.

6. Protection and contact
External app requests use HTTPS. Locally stored information is kept in the app's private storage. Send privacy questions or rights requests to BathTime Studio (getbathtime@gmail.com).

7. Optional sign-in and public playlists
Search, practice, browsing public playlists and importing a local copy do not require sign-in. Publishing, liking, reporting and account-based blocking use Google or Kakao sign-in. Naekiro does not receive your provider password. The authentication service processes the provider account identifier and the profile information you consent to share; Google may provide email, name and profile picture URL. Kakao is requested only for the nickname scope. You choose a separate public nickname. Email and sign-in profile information are not shown in public playlists.

Account ID, public nickname, sharing-rules version and acceptance time, explicitly published titles, video IDs, song titles and optionally shared keys, likes, reports and blocks are sent to Supabase Pte. Ltd. for authentication, playlist sharing and moderation. The primary database is in Seoul, South Korea. Connection IP and request information are processed for operation and security. Support, subprocessors and international processing are governed by Supabase's data processing addendum and subprocessor policies.

Only the selection you confirm in the publication preview becomes public. Personal notes, ratings, practice status, your full library and playback history are not uploaded. Session information is encrypted on the device using Android Keystore. Drafts and guest blocks are stored locally. Account or publication data is not joined to our optional analytics events.

Public posts can be read, shared and copied by guests. Unpublish hides a post from the home feed and its link; its server record remains until account deletion or a deletion request. Account-linked records are kept while your account exists. Settings → Account · public playlists → Delete account removes your account, public playlists, likes, reports and blocks. Copies already imported by others, the provider's own account and service security logs are not removed by that action. Local library and private notes remain. Uninstalling or signing out does not delete your server account.

If you cannot use the app or need access, correction or deletion, contact getbathtime@gmail.com with your sign-in provider and public nickname. We verify ownership before acting. Never send passwords or verification codes. Shared pages use GitHub Pages, which may process connection IP information. Deletion instructions: https://dykim0917.github.io/singkey-privacy/community/account.html
Supabase data processing addendum: https://supabase.com/legal/dpa
Supabase subprocessors: https://supabase.com/legal/subprocessors
Kakao privacy: https://www.kakao.com/policy/privacy
GitHub privacy: https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement