wehahee (Step Village) Privacy Policy

Version 1.0 · Effective October 14, 2026

wehahee (the "Company") operates the mobile app "Step Village" (the "App") and the App's introduction website (the "Site"). To protect the freedom and rights of data subjects, the Company complies with the Personal Information Protection Act of the Republic of Korea (PIPA) and related laws, processes personal information lawfully, and keeps it secure. Under Article 30 of PIPA, the Company establishes and discloses this privacy policy to explain how personal information is processed and protected, and to handle related complaints promptly and smoothly.

The App lets you build and decorate a small island village on the sea with the steps you walk. The App processes your step count only on your device and does not send it to anyone, including the Company. The App has no account sign-up, no server, no analytics tools, and no advertising. The Company processes only the minimum personal information needed for the purposes below.

Summary — A short summary of the key points of this policy. See each section below for details.

• Personal information the Company processes

  Email inquiries (email address, your name if you include it, the inquiry) · Site access logs (IP address, browser information)

• Information processed only on your device

  Step count (health data) and village data — never sent to the Company

• Retention

  Inquiries: 1 year after the inquiry is resolved

• Provision to third parties

  None

• Processors and international transfers

  Google LLC (inquiry email), Cloudflare, Inc. (Site) — the United States and other countries

• Questions and complaints

  Privacy officer Dongha Ko · wehahee@gmail.com

1. Purposes of processing

1. The Company processes personal information for the following purposes only. It is not used for any other purpose, and if a purpose changes, the Company will take the required steps, such as obtaining separate consent under Article 18 of PIPA.

• Handling inquiries and complaints — receiving and handling inquiries and complaints sent by email, and replying with the result
• Providing and securing the Site — delivering Site pages and blocking abnormal access (attacks)

2. The App processes health data and app data on your device for the following purposes. This information is not sent to the Company (Section 2.3).

• Turning your step count into footprints (1 step = 1 footprint) and letting you decorate your village with footprints
• Showing your recent step history
• If you turn on step alerts, creating the evening reminder and the step goal alert on your device
• If you add the Home Screen widget, showing your village name, level, footprints and today's steps in the widget

3. Health data such as your step count is never used for advertising, marketing or data mining.

2. Personal information we process

1. Personal information processed without consent — The Company processes the following personal information without the data subject's consent.

2. Personal information processed with consent — The Company does not process any personal information on the basis of consent.

3. Information processed only on your device (on-device processing) — The following information is processed directly on your device and is never sent to the Company's servers or anywhere else (the Company has no servers). The Company cannot view or receive it, and it is deleted from your device when you delete the App (except the original records in the Health app, and village pictures you saved to the Photos app or sent to other apps).

4. Steps that you entered manually in the Health app are excluded from footprint calculations. Step alerts are created on your device and shown only on that device, without going through any Company server or push notification service.

5. The Company and the App do not process unique identification information such as resident registration numbers, location (GPS), contacts, the camera, or the advertising identifier (IDFA) or identifier for vendors (IDFV), and the App does not request App Tracking Transparency permission.

3. Children under 14

1. The Company does not process personal information of children under 14 in any way that requires the consent of a legal representative. The App does not send any user's information to the Company, including children's (Section 2.3).

2. If a child under 14 wants to contact the Company, please have a legal representative (parent or guardian) contact us instead.

4. Processing and retention periods

1. The Company processes and keeps personal information within the period required by law or the period needed to take the steps requested by the data subject.

2. The processing and retention period for each item is as follows.

• Inquiries and complaints: 1 year after the inquiry is resolved (in case the same inquiry comes again or a dispute arises). If an investigation into a violation of law is in progress, until the investigation ends
• Site access logs: the Company does not collect or store access logs (the hosting log storage feature is not used). The hosting provider (Section 7) processes them for as long as needed to deliver pages and keep the Site secure, then deletes them under its own privacy policy

3. Information the App processes on your device (Section 2.3) stays on your device until you delete the App.

4. App data is not uploaded to iCloud (CloudKit or iCloud Drive) and is excluded from device backups (iCloud backup and computer backup). This means your decorated village cannot be restored if you change devices or reinstall the App. The original records in the Health app remain in the Health app.

5. Deletion procedure and method

1. When personal information is no longer needed, for example because the retention period has passed or the purpose has been achieved, the Company deletes it without delay.

2. The Company does not keep any personal information under other laws after it is no longer needed.

3. The deletion procedure and method are as follows.

• Procedure: the privacy officer (Section 13) checks inquiry emails whose retention period has passed and deletes them.
• Method: inquiry emails, which are electronic files, are permanently deleted from the email service so that they cannot be recovered (including emptying the trash). The Company does not print or keep personal information on paper.

4. Information the App processes on your device is deleted from the device by the operating system when you delete the App. The Company cannot access this information, so it cannot delete it on your behalf.

6. Provision to third parties

1. The Company does not provide personal information to third parties, except where Articles 17 and 18 of PIPA permit it, such as with your separate consent or where a law specifically requires it.

2. The Company does not make additional use or provision of personal information without consent under Articles 15(3) and 17(4) of PIPA.

3. The App contains no analytics, advertising or crash reporting tools. If any are added, the Company will first revise this policy and give notice under Section 17.

7. Entrusting processing (processors)

1. To handle personal information smoothly, the Company entrusts the following processing tasks. Both processors are overseas companies, so the international transfer details are in Section 8.

2. If the tasks entrusted or the processors change, the Company will disclose the change in this privacy policy without delay.

8. International transfers

1. Under the entrustment in Section 7, the Company transfers personal information overseas (entrusted processing and storage) as follows, and gives this notice under Article 28-8(2) of PIPA.

2. How to refuse an international transfer, the procedure, and its effect — You may refuse the international transfer of your personal information. If you do not want your inquiry email to be transferred, do not send an inquiry by email; you can ask for an inquiry email you already sent to be deleted by contacting us as in Section 13. Because the Company accepts inquiries only by email, the Company will then be unable to receive your inquiry by email. If you do not want your Site access logs to be transferred, do not open the Site. In either case, your use of the App is not affected.

3. Information the App processes on your device (Section 2.3) is neither entrusted to anyone nor transferred overseas.

9. Security measures

The Company takes the following measures to keep personal information secure.

• Administrative measures — the privacy officer handles personal information personally (keeping the number of people who handle it to a minimum); health data is never used for advertising, marketing or data mining; before any change that would send data off the device, this policy is revised first and consent is obtained (Section 17)
• Technical measures — no feature sends health data or app data off the device; no analytics or advertising tools and no advertising identifier in the App; data is stored under iOS app sandboxing and device data protection (encryption); excluded from iCloud uploads and device backups (including the widget copy); no health values in the App's logs; links that open the App from outside can open only allowed screens; the Site runs without cookies, analytics tools or external requests, and its access log storage feature is not used
• Physical measures — the only personal information the Company keeps is inquiry email; there is no server room or paper records; inquiry emails are subject to the physical access controls of the data centers run by the processors (Section 7)

10. Possible disclosure of sensitive information and how to keep it private

1. The Company does not process sensitive information. Your step count is processed only on your device (Section 2.3), and the App has no feature that discloses health data such as your step count to other people. Village pictures contain no step counts or other numbers.

2. However, if you add the Home Screen widget, today's steps appear on your device's screen. To keep others from seeing it, remove the widget from your Home Screen.

11. Automatic collection tools and how to refuse them

1. The App and the Site do not use cookies, and the Site does not use browser storage either. No settings are therefore needed to refuse cookies.

2. App data is stored only in the App's own storage (database) on your device and is not sent over the internet.

3. The Company does not collect behavioral information or provide targeted advertising, and does not allow third parties to collect behavioral information through the App or the Site.

4. Only if you have turned on "Share With App Developers" on your device, Apple provides app developers with app usage statistics and crash reports that do not identify you, under Apple's privacy policy. The Company uses them only to improve the App and its stability. To turn sharing off: Settings → Privacy & Security → Analytics & Improvements → Share With App Developers.

12. Rights of data subjects and legal representatives, and how to exercise them

1. You may at any time ask the Company to let you see, correct or delete, or to stop processing, the personal information it processes (Section 2.1) (your "rights"). The Company does not process any personal information on the basis of consent.

2. The rights of a child under 14 must be exercised by the child's legal representative. A minor aged 14 or older may exercise their rights personally or through a legal representative.

3. You can exercise your rights by email (Section 13) or in writing (to the business address below). The Company will tell you the result within 10 days of receiving your request.

4. You may also exercise your rights through an agent, such as your legal representative or a person you authorize. In that case, a power of attorney in the form of Annex 11 to the Notice on Methods of Processing Personal Information (Korea) must be submitted.

5. Requests to see your information or to stop processing may be limited under Articles 35(4) and 37(2) of PIPA, and you cannot ask for deletion where another law specifies that the information must be collected.

6. The Company checks that the person making a request is the data subject or a legitimate agent. If you make the request from the email address you used for your inquiry, the Company confirms it through that address.

7. The Company does not keep the information the App processes on your device (Section 2.3), so you manage it yourself. Deleting the App deletes all of it. You can cut off access to your step count at any time: Settings → Privacy & Security → Health → Step Village. If you do, no new footprints are created, and the village you have already decorated remains.

13. Privacy officer

1. The Company has designated the following privacy officer, who is responsible for all personal information processing and handles complaints and remedies related to it. The Company is a sole proprietorship with no separate department; the privacy officer personally handles privacy work and complaints.

• Privacy officer: Dongha Ko (Representative)
• Contact: wehahee@gmail.com

2. You can send any privacy inquiry, complaint, request for remedy or request to see your information that arises from using the App or the Site to the contact above, and the Company will respond without delay.

14. Remedies

If you need a remedy, such as dispute resolution or counseling, for an infringement of your personal information, you can file a report or ask for counseling with the following Korean authorities.

• Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
• Personal Information Infringement Report Center: 118 (privacy.kisa.or.kr)
• Korean National Police Agency: 182 (ecrm.police.go.kr)

15. App permissions

1. The App uses the following permissions. Each one is requested through the system prompt the first time it is needed, and you can decline.

2. You can change any permission at any time in the Settings app. Health is changed through the path in Section 12.7; notifications and photos are changed by finding Step Village in the Settings app.

16. What does not apply

The following do not apply to the Company. If any of them ever applies, the Company will revise this policy first.

• The Company does not process pseudonymized information.
• The Company does not make decisions based on personal information processed by a fully automated system (automated decisions).
• The Company does not operate fixed or mobile video surveillance devices.
• The Company is a business with an address in Korea and is not required to designate a domestic agent under Article 31-2 of PIPA.
• The Company is not an information transmitter subject to requests for transmission of personal information under Article 35-2 of PIPA.

17. Changes to this policy

1. This privacy policy applies from the effective date shown above. This is the first version (version 1.0).

2. Previous versions can be found, with the period each one applied, under "Version history" at the bottom of the Site's privacy policy page.

3. If this policy changes, the Company will give notice in the App and on the Site at least 7 days before the change takes effect (at least 30 days before for changes that significantly affect your rights). Significant changes, such as a change in the personal information processed or the purposes of processing, will also be explained with a comparison of the text before and after the change.

4. Any change that would send data off the device (for example, accounts, sync or analytics tools) will be announced in the App before it takes effect, and your consent will be obtained.

5. This policy was written in Korean and is also provided in English, Japanese, Chinese (Traditional), Spanish, French, German and Portuguese. If a translation differs from the Korean version, the Korean version prevails.

wehahee · Representative: Dongha Ko · Business registration number 751-02-04369
202, 20 Saeteosan 16-gil, Mapo-gu, Seoul (Seongsan-dong), Republic of Korea · Email wehahee@gmail.com