DDirong

Privacy Policy

DDirong maintains this Privacy Policy pursuant to Article 30 of the Personal Information Protection Act of Korea, in order to protect users' personal information and to handle related grievances.

Effective Date: September 26, 2026

This is an English translation of DDirong's Privacy Policy, provided for reference only. If there is any conflict or discrepancy between this translation and the Korean original, the Korean version shall prevail.

1. Personal Information Collected

The Service collects the following items when a user signs in with a Google account.

The scopes requested from Google are openid, email, profile, and calendar.readonly, which is used to read calendar events on a read-only basis. The Service does not access data from any other Google service besides Calendar, such as Gmail or Drive.

The calendar screen displays the user's default Google Calendar events retrieved using the scope above. The retrieved event data is only displayed on screen and is not stored on the server.

In addition, to-dos, memos, and workspace names that a user directly enters are stored in association with the user's account. The date and time of access and the access IP may be automatically recorded in server logs while the Service is used.

For usage statistics, Google Analytics automatically collects the following when a web page is opened.

Account information such as name and email, content a user enters such as to-dos, memos, and documents, and Google Calendar data are not sent to Google Analytics. Workspace invite and document share link addresses are sent with the token removed, and nothing is collected on those pages. Query strings in page addresses are not sent, except utm parameters that identify traffic sources.

2. Purpose of Processing Personal Information

Personal information is not used for any purpose other than those above, and prior consent is obtained if the purpose changes. It is not used for advertising or profiling. Usage statistics are viewed in aggregate by page and traffic source, and are not used to identify a specific user or for targeted advertising. Google Calendar data is used solely for the purpose of displaying it on the calendar screen, in accordance with the Limited Use requirements of the Google API Services User Data Policy, and is not provided to third parties, used for advertising, or viewed by any human.

3. Retention and Use Period of Personal Information

Account information and content a user has entered are retained while the account remains active, and are destroyed without delay upon the user's request for deletion. Server access logs are retained for 3 months from the date recorded and then destroyed.

Of the information Google Analytics collects, event-level data such as page visits is deleted automatically 2 months after collection, and data tied to the visitor identifier 14 months after the last visit. The _ga cookie stays in the browser for up to 2 years after the last visit. Reports that have already been aggregated keep only numbers that cannot identify an individual.

The Google OAuth refresh token is also retained while the account remains active and is destroyed without delay when the account is deleted. Google Calendar events are not stored, so no separate retention period applies to them.

Because the Service does not provide the sale of goods or services, the record-keeping obligations under the Act on the Consumer Protection in Electronic Commerce, etc. of Korea do not apply.

4. Account Deletion and Handling of Personal Information

Users can delete their account directly within the Service, from My settings in the user menu.

Deleting an account immediately deletes personal data with no grace period, including personal documents and drawings, personal folders, the user's personal workspace and the to-dos and recurrence rules within it, notifications, browser push subscriptions, and the OAuth refresh token used to look up Google Calendar. The account record itself is deleted as well.

To-dos and documents left in a shared workspace remain there, because the team sharing the workspace still needs them. When this happens, the item's recorded author changes to the workspace owner, so the deleted user's name or email no longer appears.

A shared workspace the user owned is automatically transferred to a remaining admin. If no members remain, that workspace is deleted as well. A to-do the user was assigned is unassigned so another member can take it over, and any result notes attached to it, visible only to that user, are deleted along with the account.

A user may sign up again with the same Google account after deleting it, and is treated as a new user. Deleted data is not restored.

5. Provision of Personal Information to Third Parties

The Service does not provide or sell users' personal information to third parties, except where otherwise specifically required by law or requested by an investigative agency in accordance with the procedures and methods prescribed by law.

6. Outsourcing of Personal Information Processing

The Service outsources the following personal information processing task for the smooth operation of the Service.

Account information and content users enter are physically stored in Chuncheon, Republic of Korea, and this information is not transferred overseas.

Information collected by Google Analytics is transferred overseas as follows.

7. Procedure and Method of Destroying Personal Information

When personal information becomes unnecessary because the retention period has passed or the purpose of processing has been achieved, it is destroyed without delay. Information in electronic file form is permanently deleted by a method that prevents recovery, and destruction covers both the corresponding database record and any backups.

8. Rights and Obligations of Data Subjects, and How to Exercise Them

Users may exercise the following rights at any time.

To exercise these rights, please contact the Personal Information Protection Officer listed below by email, and the Service will take action without delay. Requests may also be made through a legal representative or an authorized agent. If the Service must continue processing despite a user's request because it is required to do so by law, the Service will notify the user of the reason.

9. Measures to Secure Personal Information

10. Operation of Cookies and Other Automatic Collection Tools, and How to Refuse Them

The Service uses the following cookies. It does not use cookies for advertising.

Collecting visit history through Google Analytics cookies counts as collecting behavioral information under the Personal Information Protection Act of Korea. The items, purpose, and retention periods are set out in Sections 1, 2, and 3. This information is not used for targeted advertising or provided to other businesses.

Cookies can be refused or deleted in browser settings. However, refusing the authentication cookie prevents login sessions from being maintained, making the Service unusable. To refuse only Google Analytics, install Google's Google Analytics Opt-out Browser Add-on; the Service remains fully usable.

11. Personal Information Protection Officer

The Service designates a Personal Information Protection Officer, who is responsible for personal information processing overall and for handling related grievances.

12. Remedies for Infringement of Rights

If you need consultation or relief for harm caused by a personal information infringement, you may contact the agencies below. Please use these if you are not satisfied with the Service's own handling of your request or need further assistance.

13. Changes to This Privacy Policy

This Privacy Policy applies from its effective date. If the content changes due to a change in law or the Service, the change will be posted on this page, and material changes will be announced at least 7 days before they take effect.