Reel Nest Privacy Policy

Fellow Survivor Studio (the "Company") values the personal information of users of the mobile application "Reel Nest" (the "App") and complies with the Personal Information Protection Act of the Republic of Korea and other applicable laws. This Policy explains how the App accesses, collects, uses, provides, retains, and destroys user and device data.

1. Personal Information Controller and Privacy Officer

Name: Fellow Survivor Studio

Business registration number: 773-26-02197

Privacy officer: Representative

Privacy and complaints handling: Customer Support (handled by the Representative)

Contact: fellow.survivor.studio@gmail.com

2. Data Processed by the App

A. Data stored only on your device

The App stores the following information on your device to provide its features. This information is not sent to any server operated by the Company, and the Company cannot view it.

• Browsing data: URLs, titles, and visit times of pages you visit (up to 500 entries), open tab URLs, the home page URL, bookmark titles and URLs, and WebView cookies, cache, web storage, and site icons
• Download data: downloaded files, file names, source URLs, file formats and types, save locations, completion times, and preview images
• Data you choose: an image you choose as the home background, and media files you import into Nest
• Settings data: app preferences such as theme, text size, address bar position, ad blocking, history and session retention, and save location, as well as whether you agreed to the Terms of Use before downloading, the version of the Terms you agreed to and when, and whether you agreed to the Nest notice
• Nest lock data: whether the lock is enabled, a one-way hash of the PIN with a random salt, and the number of consecutive incorrect PIN entries and when the entry restriction ends. The PIN itself is not stored. Biometric information is handled by the Android system, and the App does not access or store raw biometric data such as fingerprints or face data.

You can turn off saving of browsing history and download history separately in Settings. Turning off browsing history immediately deletes the existing browsing history, and turning off download history immediately deletes the existing download history.

If Android backup is turned on for your device, some app data, such as app settings (including whether the Nest lock is enabled), browsing history, bookmarks, and WebView data (cookies and site storage), may be included in your Google account backup or in data transfer to a new device through the operating system's backup feature. This processing follows Google's policies and your device settings. However, files kept in Nest and their file list, the download history, and the Nest lock PIN information (PIN hash, salt, and failure count) are excluded from both cloud backups and device-to-device data transfer.

B. Data sent outside your device while using the App

• Web browsing and downloads: When you visit a website or detect or download a resource, the request URL, IP address, User-Agent, Referer, cookies, and other necessary request headers may be sent to that website, content provider, or CDN. This is to display the pages and download the files you request, and it happens directly between your device and the website without passing through the Company.
• Search: If you enter search terms rather than a web address in the address bar, the terms are sent to Google Search and processed under Google's privacy policy.
• Google Firebase Crashlytics (error analysis): If the App crashes, crash logs, stack traces, app, device, and operating-system information, diagnostic information at the time of the crash, and the Crashlytics installation identifier and Firebase installation ID are sent to Google to analyze errors and improve stability. The installation identifiers are generated randomly when the App is first launched and are not linked to your name or contact details. The App does not use any usage statistics (analytics) tools.
• Google AdMob and User Messaging Platform (ads): When a Free User chooses to watch a rewarded ad to download videos, the advertising ID, IP address, device and app information, ad view and interaction information, diagnostic information, and consent status are sent to Google for ad delivery, frequency capping, fraud prevention, measurement, and legal consent management. The App uses Google AdMob as its only ad network. In regions where additional consent is required by law (such as the European Economic Area, the United Kingdom, and Switzerland), a separate consent screen is shown before ads are requested, and you can reopen your ad privacy choices from the Subscription section of Settings. When you open the Settings screen, device and app information and your IP address may be sent to Google to check whether the ad privacy settings menu should be shown.
• Google Play billing: Subscription purchases and payments are processed by Google under the terms between you and Google. The Company receives the subscription product, purchase status, and purchase token from Google Play and uses them only to confirm and restore subscriptions; the Company does not collect or store your payment card information.

The App does not offer registration or its own user accounts, and does not create user profiles on Company servers.

3. Purposes of Processing

The Company processes the above data only for the following purposes, and will take the measures required by applicable law if the purposes change.

• Displaying web pages, detecting and downloading media resources, and managing files
• Restoring tabs, keeping browsing and download history, bookmarks, and preferences, and providing the Nest lock
• Confirming and recording consent to the Terms of Use
• Checking subscription status and restoring subscriptions
• Providing rewarded ads chosen by Free Users
• Diagnosing crashes and improving app stability
• Handling user requests such as withdrawal, refunds, and cancellation, meeting legal obligations, and responding to inquiries

4. Legal Basis for Processing

The Company processes personal information as follows.

• Data stored only on your device (Section 2.A): not collected by the Company; processed only on your device.
• Google Play purchase information needed to confirm and restore subscriptions: conclusion and performance of a contract (Article 15(1)(4) of the Personal Information Protection Act)
• Error analysis (Firebase Crashlytics): the Company's legitimate interest in providing a stable service (Article 15(1)(6) of the same Act). It is sent only when a crash occurs and is processed with random identifiers that cannot identify you.
• Rewarded ad delivery (Google AdMob): conclusion and performance of a contract to provide the rewarded ad you choose (Article 15(1)(4) of the same Act). Ad measurement and fraud prevention are based on the Company's legitimate interest in operating the Service (Article 15(1)(6) of the same Act).
• Withdrawal, refund, and cancellation requests and inquiries: performance of a contract at your request (Article 15(1)(4)) and compliance with legal obligations (Article 15(1)(2))

In regions where consent is required by law (such as the European Economic Area, the United Kingdom, and Switzerland), ad-related information is processed according to the consent given on the ad privacy consent screen.

5. Provision of Personal Information to Third Parties

The Company does not sell your personal information or provide it to third parties, except where specifically required by law or requested by investigative authorities in accordance with legal procedures. Third-party websites that you visit directly within the App process data under their own privacy policies, and the Company is not involved in their independent data processing.

6. Entrustment of Processing

The Company entrusts the processing of personal information as follows to provide the Service.

• Entrustee: Google LLC
• Entrusted tasks: app error analysis (Firebase Crashlytics); ad delivery and ad consent management (Google AdMob, User Messaging Platform)

Google may process information under Google's privacy policy in the course of delivering ads. You can learn how Google uses information from partner apps at https://policies.google.com/technologies/partner-sites.

7. Cross-Border Transfer of Personal Information

For the entrusted tasks in Section 6, the Company transfers personal information abroad as follows under Article 28-8(1)(3) of the Personal Information Protection Act.

• Recipient: Google LLC (privacy inquiries: https://support.google.com/policies/contact/general_privacy_form)
• Destination countries: the United States and other countries where Google operates data centers (list: https://www.google.com/about/datacenters/locations/)
• Items transferred: for error analysis — crash logs, stack traces, app, device, and operating-system information, diagnostic information, the Crashlytics installation identifier, and the Firebase installation ID; for ads — the advertising ID, IP address, device and app information, ad view and interaction information, diagnostic information, and consent status
• Timing and method: sent over the network — for error analysis, when the App is relaunched after a crash; for ads, when a Free User watches a rewarded ad
• Purpose: the entrusted tasks in Section 6
• Retention period: 90 days for error analysis (as published by Firebase); for ads, the period set by Google's privacy policy
• How to refuse and consequences of refusal: Error analysis is necessary to provide a stable service and cannot be turned off in the App; if you do not want it, you can stop using the App (uninstall it). Ad-related transfers do not occur unless you watch a rewarded ad; in that case, video downloads are not available on the Free Plan. You can delete or reset your advertising ID in Android settings.

For more information about how Google services process data:

https://policies.google.com/privacy

https://firebase.google.com/support/privacy

https://policies.google.com/technologies/ads

8. Retention and Destruction

A. Retention period

• Data on your device is kept until you delete it using the App's features or uninstall the App. Browsing history is limited to 500 entries.
• Information the Company receives through user inquiries (email address and inquiry details) is destroyed without delay once the inquiry has been handled.
• Records of transactions such as withdrawal, refund, and cancellation requests are kept as required by the Act on Consumer Protection in Electronic Commerce, etc.: records of contracts, withdrawals, and payments for 5 years, and records of consumer complaints and dispute handling for 3 years.
• The retention periods for data processed by Google are as set out in Section 7.

B. Destruction procedure and method

• Data on your device: You can delete it yourself from each history screen, Settings > Privacy > Clear cookies & cache, and the bookmark and file management features; turning off history saving in Settings immediately deletes the corresponding history. When you uninstall the App, the operating system deletes the data in the App's private internal storage. Files you exported or saved to public media storage and Android/Google backup copies may need to be deleted separately.
• Information held by the Company: When the retention period ends, electronic files are deleted in a way that cannot be recovered.

9. Your Rights and How to Exercise Them

You may at any time request access to, correction of, deletion of, or suspension of processing of your personal information. For data stored only on your device, you can exercise these rights directly by deleting history, changing settings, or uninstalling the App; for information held by the Company, you can make a request to the contact in Section 1. The Company will notify you of the action taken within 10 days of receiving the request. You may also make a request through a legal representative or an authorized person.

Because error analysis information is processed with random installation identifiers that cannot identify you, the Company cannot locate a specific user's information to give access to it or delete it; the deletion process begins after 90 days. When you uninstall the App, the installation identifiers are deleted as well and no further data is collected. For information sent to Google in connection with rewarded ads, you can exercise your rights directly with Google under Google's privacy policy. The App does not create its own accounts, so there is no app account to delete.

10. Installation, Operation, and Refusal of Automatic Data Collection

• Installation identifiers for error analysis (Firebase Crashlytics installation identifier and Firebase installation ID): generated when the App is first launched and used only for error analysis. They are deleted when you uninstall the App.
• Advertising ID (Google AdMob): used for ad delivery and measurement when a Free User watches a rewarded ad. In regions such as the Republic of Korea where separate prior consent is not required by law, Google may use the advertising ID and ad view and interaction information to show ads tailored to your interests (personalized ads). You can stop receiving personalized ads by deleting or resetting your advertising ID in Android Settings > Privacy > Ads (on some devices, Google > Ads).
• WebView cookies: set by the websites you visit and used for their features, such as keeping you signed in. You can delete them in Settings > Privacy > Clear cookies & cache.

11. Security Measures

The App uses app-private storage and Android access controls. Nest files are kept in the App's internal storage, which other apps cannot access, and are excluded from cloud backups and device-to-device transfer. The Nest PIN is stored in encrypted storage as a salted one-way hash, and PIN entry is restricted for a period of time after several consecutive incorrect entries. Communication with supported external services uses modern transport protection such as HTTPS. However, connections may not be encrypted if you visit an HTTP website or download an HTTP resource yourself.

12. Permissions

• Internet and network state: used for web browsing, downloads, ads, error reporting, and billing.
• Notifications (Android 13 and later): used to show the progress and results of downloads.
• Foreground service: used to continue downloads you started while the App is in the background.
• Keep device awake: used so that downloads and SDK (Firebase, Google Play services) data transfers are not interrupted.
• Write external storage (Android 9 and earlier): used to save files to the public storage location you choose.
• Biometrics: used to unlock Nest. The App does not receive raw biometric data.
• Advertising ID and ad-related permissions: used by Google AdMob for ad delivery and measurement.
• Billing: used to purchase subscriptions through Google Play.

The photo picker is used to access only the images or media you explicitly select.

13. Children's Personal Information

The App is not directed at children under the age of 14. Because the App does not verify users' ages, the information in Section 2.B may be sent if a child under 14 uses the App. A legal guardian may request deletion or suspension of processing of that information through the contact in Section 1.

14. Remedies for Infringement of Rights

If you need to report or get advice about an infringement of your personal information, you can contact the following organizations in the Republic of Korea.

• Personal Information Dispute Mediation Committee: 1833-6972, www.kopico.go.kr
• Personal Information Infringement Report Center: 118, privacy.kisa.or.kr
• Supreme Prosecutors' Office: 1301, www.spo.go.kr
• Korean National Police Agency: 182, ecrm.police.go.kr

15. Changes to This Policy

This Policy may be revised if the App's features, the third-party services it uses, or applicable laws change. Significant changes will be announced in a notice shown when the App is launched and on the Company's web page (https://fellow-survivor-studio.github.io/reel-nest/), and the effective date at the top of this document will be updated. Previous versions of this Policy are also available on the same web page.

16. Translations

This Policy was written in Korean and may be provided in translation. If a translation differs from the Korean version, the Korean version prevails.

17. Contact

Please send any questions about this Policy or the processing of personal information to fellow.survivor.studio@gmail.com.