Travplan Privacy Policy

Travplan Operator operates the Travplan service (hereinafter 'Service' or 'App') and takes the privacy of users seriously. The Operator establishes and discloses the following Privacy Policy to lawfully process and safely manage users' personal information in accordance with applicable laws.

The Operator currently provides the Service as an individual operator. This Privacy Policy may be revised if business registration, incorporation, introduction of paid services, advertising, or external partner integration occurs in the future.

The Operator processes the minimum personal information necessary to provide the Service.

2.1 When using Google Login

If a user logs in with a Google account, the following information may be processed.

The Operator does not collect or store Google account passwords.

2.2 Information entered or generated by users during Service use

The above information is processed to enable users to manage travel itineraries, save places, and check budget, weather, and map information.

2.3 Information that may be automatically processed

The following information may be automatically generated or processed during Service use.

The Service does not collect users' real-time location, GPS location, or current location-based movement routes.

Maps, weather, places, and travel information provided in the app are based on travel destinations, cities, and place information selected or registered by the user. For example, if a user registers an Osaka travel itinerary, weather, place, and map information for Osaka may be displayed, but this does not involve collecting the user's current location.

The Service does not provide features based on current location, such as nearby place recommendations, nearby place search, or GPS-based route guidance. If features using personal location information are added in the future, the Operator will establish separate notices and required consent procedures and revise this Policy.

The Operator processes personal information for the following purposes.

• Member identification and Google Login provision
• Creating, saving, viewing, editing, and deleting travel itineraries
• Providing place search, place saving, and scheduling features
• Providing map, place, route, distance, and travel information
• Travel budget estimation and currency conversion information
• Weather information based on travel destination
• Service error checking, issue response, and security management
• Prevention of fraudulent use and stable service operation
• Responding to inquiries and processing user requests
• Service quality improvement and feature enhancement

The Operator does not use personal information beyond the scope reasonably related to the collection purposes.

The Operator retains personal information for the period necessary to achieve the processing purposes and promptly disposes of it when the purposes are achieved or when a user requests deletion.

The Service is currently provided free of charge and does not offer payment features. The Operator does not directly collect payment method information or credit card information. If in-app purchases, subscriptions, or paid features are added in the future, a separate payment processing policy will be announced.

The Operator does not, in principle, sell or provide users' personal information to third parties.

However, personal information may be provided in the following exceptional cases.

• When the user has given prior consent
• When there is a legal basis or a lawful request from investigative agencies, courts, supervisory authorities, or other authorities following due process
• When processed through external services or subcontractors within the scope necessary to provide the Service

The Operator may use the following external services to provide the Service.

The Operator endeavors to transmit only the minimum information necessary for service provision to external services. The personal information processing methods of external services may be subject to each provider's policy.

The Operator may provide a launch notification sign-up feature on the website to inform users about the Travplan launch.

Launch notification information is used for launch announcements and initial service operation notices. If a user requests deletion or opts out of receiving communications, the information will be deleted or processing will be stopped. However, records of already-sent notices and minimum records necessary for security and misuse prevention may be retained within the scope permitted by applicable law and operational purposes.

Some external services used by the Service are provided by overseas businesses, so users' information may be stored, processed, or accessed outside of Korea.

The Operator endeavors to comply with protective measures required by applicable law in connection with cross-border processing. The above table may be updated to reflect the latest server regions, contract terms, DPA, or personal information processing conditions of each service prior to actual deployment.

The Service may use cookies or local storage to maintain login status, save app settings, display screens, check errors, and process launch notification sign-ups.

Users may refuse or delete cookie storage through their browser or device settings. However, restricting cookies or local storage may prevent some features such as maintaining login status, saving itineraries, and retaining app settings from functioning properly.

The Service may automatically calculate results such as budget estimates, place recommendations, and schedule arrangements based on travel itineraries, saved places, categories, and external price information registered by users.

These results are reference information to assist with travel planning and are not used as automated decisions that significantly affect the rights or obligations of users. Users may directly edit or delete itinerary, place, and budget information within the app.

Users may exercise the following rights regarding their personal information at any time.

• Request to access personal information
• Request to correct or modify personal information
• Request to delete personal information
• Request to restrict processing of personal information
• Request to delete account
• Request to delete launch notification information or opt out of communications

Users may exercise their rights through the in-app account management feature or by contacting us at the email address below.

Contact email: ddour21@gmail.com

The Operator will process requests within a reasonable period after verifying the identity of the requester in accordance with applicable law. However, information required to be retained by law may be retained for the applicable period.

Users may request account deletion through the in-app account deletion feature or by contacting us via email.

Upon account deletion, the Operator will delete information linked to the user, including account information, travel itineraries, saved places, and budget information. However, information required to be retained by law or minimum information necessary for security and dispute resolution may be retained for a certain period in accordance with applicable law and this Policy.

Unlinking or managing permissions for the Google account connection itself can also be done directly through Google Account settings.

The Operator promptly disposes of personal information when the retention period has expired or the processing purpose has been achieved.

• Electronic files: Deleted so that recovery or regeneration is difficult
• Database information: Deleted or de-identified by removing the link to accounts or identifiers
• Log information: Deleted or aggregated and de-identified after the retention period expires
• Printed materials: Shredded or disposed of if printed materials exist

The Operator applies or endeavors to apply the following measures to protect personal information.

• Use of encrypted communications such as HTTPS
• Supabase authentication and access rights management
• Restriction of database access rights
• Minimization of administrator access rights
• Monitoring of errors and abnormal access
• Prevention of external exposure of API keys and authentication information
• Regular security updates and configuration reviews
• Minimization of personal information processing

The Service is not primarily intended for children under the age of 14. The Operator does not intentionally collect personal information from children under 14.

If the Operator becomes aware that personal information of a child under 14 has been collected, it will promptly delete the information or take necessary action.

The Service does not currently require sensitive device permissions such as real-time location, contacts, photos, camera, or microphone.

The Service does not collect users' GPS location or current location. Map, weather, and place information is provided based on travel destinations, cities, or place information registered by the user.

If features requiring device permissions, such as photo uploads, current location-based recommendations, or camera use, are added in the future, the Operator will notify users of the purpose through the app permission request screen or separate notices. Users may change permission settings in their device settings.

The Service does not currently use personalized advertising or advertising SDKs.

If advertising SDKs such as Google AdMob or Meta Audience Network are introduced, or if marketing notifications are sent in the future, the Operator will reflect this in this Policy and provide the necessary consent or opt-out procedures.

Email addresses provided by launch notification subscribers are used solely for the purpose of Travplan launch announcements and initial service notices.

For inquiries related to personal information processing, account deletion, exercising rights, or Service use, please contact us at the following.

This Privacy Policy may be revised in accordance with changes in laws, service content, external services, information items collected, or purposes of processing.

If there are significant changes, the Operator may notify users through appropriate means such as in-app notices, the website, or email.

This Privacy Policy is effective from June 7, 2026.