Privacy
Privacy Policy
This revision takes effect on September 12, 2026. Advertising in the app adds new items to what we collect, share, and transfer. Through September 11, 2026, the version effective August 14, 2026 applies.
BIKECORD (the "Service") respects your privacy and complies with applicable data protection laws. This policy explains what personal data we collect, use, store, and delete through our mobile app and related services.
1. Information We Collect
a. Account & Authentication
- Social login (Google · Apple · Kakao · LINE · Facebook): the unique identifier, email address, name, and profile picture provided by that provider
b. Collected While Using the Service
| Data | Feature |
|---|---|
| Location (precise & approximate) | Cafe arrival check (PLACES), AR cafe badges, location sharing in channels, maps |
| Microphone (audio) | Real-time voice channels & PTT |
| Camera | QR code scanning, AR sticker discovery |
| Photos | Photos you attach to boards, your profile, or ride summaries |
| Usage records | Posts & comments, mail, friends/teams, channel activity, riding logs |
| Purchases & subscription | Gem (in-app purchase) history, subscription tier (Free/Pro/Max) with its start and expiry dates, and store receipt tokens and product IDs (payment instrument data is handled by Apple/Google and not held by us) |
| Marketing opt-in | Whether you gave the optional marketing consent at sign-up, and your channel preferences |
| Push token | Delivering notifications (FCM/APNs) |
c. Automatically Collected
Device information (model, OS, app version), device identifiers, IP address, and service usage logs.
Audio from your microphone is used only for real-time communication and is not recorded or stored on our servers.
d. Collected When Ads Are Shown (only for members who see ads)
- Advertising identifier — Android advertising ID / iOS IDFA (may be unavailable depending on your device settings)
- Device information (model, OS version, language) and IP address
- Ad impressions and clicks in the app
We do not show ads to members with a subscription (Pro / Max) or the ad-removal purchase, and we do not process the data above for them. The ad SDK is initialized only at the moment an ad is actually requested.
You control your advertising identifier. On iOS, the IDFA is collected only if you allow App Tracking Transparency; you can change this at any time under Settings → Privacy & Security → Tracking. On Android, the advertising ID is provided without an OS permission prompt; you can reset or delete it under Settings → Google → Ads.
2. How We Use Your Information
- To identify and authenticate members, and to operate the Service
- To provide location-based features (cafes, maps, AR)
- To provide social features (community, channels, mail, friends/teams)
- To provide paid services (gems, subscriptions, and ad removal) and to manage billing, auto-renewal, and expiry
- To display advertising and measure its performance (only for members who see ads)
- To respond to inquiries and send notices and notifications
- To deliver event, benefit, and news information (only where you consent)
- To prevent abuse, ensure safety, and comply with legal obligations
3. Sharing & Processors
| Processor / Provider | Purpose |
|---|---|
| Meta Platforms, Inc. | Facebook Login (authentication) |
| Google LLC | Google Login, Maps/Places API, push notifications (FCM), subscription status notifications (Google Play RTDN) |
| Google LLC (AdMob) | Serving and measuring in-app ads — advertising identifier, device information, IP address, ad impressions and clicks (only for members who see ads) |
| Apple Inc. | Apple Login, push notifications (APNs) |
| Kakao Corp. | Kakao Login (authentication) |
| LY Corporation | LINE Login (authentication) |
| Apple App Store / Google Play | In-app purchase and subscription billing, and subscription status (renewal, expiry, refund) notifications |
| Hostinger PTE | Server operation and data storage |
4. International Transfer
a. Server hosting (data storage)
We transfer and store personal data outside Korea as follows.
| Item | Details |
|---|---|
| Recipient | Hostinger PTE (16 Raffles Quay, #33-02, Hong Leong Building, Singapore 48581) |
| Contact | https://www.hostinger.com/contacts |
| Country of transfer | Malaysia (data centre in Kuala Lumpur) |
| Data transferred | All personal data processed under this policy — account details, profile, location and riding records, posts and photos, purchase and subscription records, access logs |
| When & how | Transferred on an ongoing basis as you use the Service, stored on the server over an encrypted connection (TLS 1.2 or higher) |
| Purpose | Server hosting and data storage only; the recipient does not use the data for its own purposes |
| Retention | Same as section 5 (until account deletion or fulfilment of the purpose; longer where required by law) |
| Right to refuse | You may refuse this transfer. Because server hosting is essential to the Service, refusing means you cannot use the Service and your account will be deleted. To refuse, contact contact@carrotsoftclan.com. |
b. Authentication and notification providers
Some providers in section 3 (Meta, Google, Apple) operate servers outside your country (e.g., the United States). Using social login, push notifications, or maps may transfer the data needed for those features internationally. You may decline by not using social login, though some features may then be limited. In addition, for members who see ads, the advertising data in section 1(d) is transferred to the United States (Google LLC, AdMob) at the moment an ad is requested. A subscription or the ad-removal purchase stops that transfer.
5. Retention
- Member data is deleted without delay upon account deletion.
- The advertising data in section 1(d) is not stored on our servers; it is retained under Google LLC’s own retention policy.
- Information we are legally required to retain is kept for the required period.
6. Your Rights
You may request access, correction, deletion, or restriction of your personal data, withdraw consent, or delete your account at any time — via Profile > Delete account in the app, or the contact below. See Data Deletion Instructions for details.
7. Security
We apply technical and organizational measures including transport encryption (HTTPS) and access controls.
8. Children
We do not knowingly collect data from children under 14 and restrict their sign-up.
9. Contact
- Business: CarrotSoftClan (캐럿소프트클랜), a sole proprietorship registered in the Republic of Korea · Representative: Kim Gwanbin · Business registration no. 339-77-00517
- Email: contact@carrotsoftclan.com
10. Changes
We may update this policy as laws or the Service change, and will announce changes in the app or on this page.
Supplementary Provisions
- This policy takes effect on September 12, 2026.
- The policy effective August 14, 2026 applies through the day before that date and remains available here. This revision adds section 1(d) for advertising and the related items in sections 2, 3, 4, and 5.