wehahee (Step Village) Privacy Policy

Version 1.2 · Effective October 22, 2026

wehahee (the "Company") operates the mobile app "Step Village" (the "App") and the App's introduction website (the "Site"). To protect the freedom and rights of data subjects, the Company complies with the Personal Information Protection Act of the Republic of Korea (PIPA) and related laws, processes personal information lawfully, and keeps it secure. Under Article 30 of PIPA, the Company establishes and discloses this privacy policy to explain how personal information is processed and protected, and to handle related complaints promptly and smoothly.

The App lets you build and decorate a small island village on the sea with the steps you walk. The App processes your step count only on your device and does not send it to anyone, including the Company. The App has no account sign-up, no server and no advertising. Only if you agree, the App and the Site use analytics tools to collect usage records (which screens and features you use, and which items and islands you choose when decorating); these records never include health data such as your step count. The Company processes only the minimum personal information needed for the purposes below.

Summary — A short summary of the key points of this policy. See each section below for details.

• Personal information the Company processes

  Email inquiries (email address, your name if you include it, the inquiry) · Site access logs (IP address, browser information) · Only if you agree, App and Site usage records (analytics tools)

• Information processed only on your device

  Step count (health data) and village data (footprint counts, level, layout) — never sent to the Company or to analytics tools

• Retention

  Inquiries: 1 year after the inquiry is resolved · Usage records: 2 months (Site session recordings: 30 days)

• Provision to third parties

  None

• Processors and international transfers

  Google LLC (inquiry email, analytics tools), Microsoft Corporation (Site analytics tool), Cloudflare, Inc. (Site) — the United States and other countries

• Questions and complaints

  Privacy officer Dongha Ko · wehahee@gmail.com

1. Purposes of processing

1. The Company processes personal information for the following purposes only. It is not used for any other purpose, and if a purpose changes, the Company will take the required steps, such as obtaining separate consent under Article 18 of PIPA.

• Handling inquiries and complaints — receiving and handling inquiries and complaints sent by email, and replying with the result
• Providing and securing the Site — delivering Site pages and blocking abnormal access (attacks)
• Analyzing and improving the App and the Site — looking at statistics on which screens and features people who agreed use, in order to improve the App and the Site

2. The App processes health data and app data on your device for the following purposes. This information is not sent to the Company or to analytics tools (Section 2.3). However, if you agree, the kinds of decorating actions are sent as usage records (Section 2.2).

• Turning your step count into footprints (1 step = 1 footprint) and letting you decorate your village with footprints
• Showing your recent step history
• If you turn on step alerts, creating the evening reminder and the step goal alert on your device
• If you add the Home Screen widget, showing your village name, level, footprints and today's steps in the widget

3. Health data such as your step count is never used for advertising, marketing or data mining, and is never sent to analytics tools.

2. Personal information we process

1. Personal information processed without consent — The Company processes the following personal information without the data subject's consent.

2. Personal information processed with consent — Only if you agree (PIPA Article 15(1)1), the Company processes the following usage records. You can use every feature of the App and the Site without agreeing, and you can withdraw your consent at any time (Section 11). You are not identified by name or email; you are told apart only by a random identifier created for each installation or browser.

3. Information processed only on your device (on-device processing) — The following information is processed directly on your device and is never sent to the Company's servers, analytics tools or anywhere else (the Company has no servers). The Company cannot view or receive it, and it is deleted from your device when you delete the App (except the original records in the Health app, and village pictures you saved to the Photos app or sent to other apps).

However, if you agree to analytics, the names of decorating actions and the kinds of items, islands and villagers involved are sent to the analytics tool as App usage records under Section 2.2. Step counts, footprint counts, levels, where things are placed, how many you have and your village name are never sent.

4. Steps that you entered manually in the Health app are excluded from footprint calculations. Step alerts are created on your device and shown only on that device, without going through any Company server or push notification service.

5. The Company and the App do not process unique identification information such as resident registration numbers, location (GPS), contacts, the camera, or the advertising identifier (IDFA) or identifier for vendors (IDFV), and the App does not request App Tracking Transparency permission. The analytics tools' collection of advertising identifiers and their advertising features are turned off.

3. Children under 14

1. The Company does not process personal information of children under 14 in any way that requires the consent of a legal representative. The consent screens in the App and on the Site state that only people aged 16 or older can agree; children under 14 should not agree. If the Company learns that a child under 14 has agreed, it will stop processing those usage records and ask for them to be deleted.

2. If a child under 14 wants to contact the Company, please have a legal representative (parent or guardian) contact us instead.

4. Processing and retention periods

1. The Company processes and keeps personal information within the period required by law or the period agreed to when the personal information was collected.

2. The processing and retention period for each item is as follows.

• Inquiries and complaints: 1 year after the inquiry is resolved (in case the same inquiry comes again or a dispute arises). If an investigation into a violation of law is in progress, until the investigation ends
• Site access logs: the Company does not collect or store access logs (the hosting log storage feature is not used). The hosting provider (Section 7) processes them for as long as needed to deliver pages and keep the Site secure, then deletes them under its own privacy policy
• App and Site usage records: 2 months from collection (the data retention setting of the analytics tools). Site session recordings are kept for 30 days, and aggregated statistics such as heatmaps made from them are kept for 13 months. After you withdraw consent, no further records are collected

3. Information the App processes on your device (Section 2.3) stays on your device until you delete the App.

4. App data is not uploaded to iCloud (CloudKit or iCloud Drive) and is excluded from device backups (iCloud backup and computer backup). This means your decorated village cannot be restored if you change devices or reinstall the App. The original records in the Health app remain in the Health app.

5. Deletion procedure and method

1. When personal information is no longer needed, for example because the retention period has passed or the purpose has been achieved, the Company deletes it without delay.

2. The Company does not keep any personal information under other laws after it is no longer needed.

3. The deletion procedure and method are as follows.

• Procedure: the privacy officer (Section 13) checks inquiry emails whose retention period has passed and deletes them. Usage records are deleted automatically when the retention period set in the analytics tools has passed.
• Method: inquiry emails, which are electronic files, are permanently deleted from the email service so that they cannot be recovered (including emptying the trash). Usage records are deleted by the analytics providers (Section 7) so that they cannot be recovered once the retention period has passed. The Company does not print or keep personal information on paper.

4. Information the App processes on your device is deleted from the device by the operating system when you delete the App. The Company cannot access this information, so it cannot delete it on your behalf.

6. Provision to third parties

1. The Company does not provide personal information to third parties, except where Articles 17 and 18 of PIPA permit it, such as with your separate consent or where a law specifically requires it.

2. The Company does not make additional use or provision of personal information without consent under Articles 15(3) and 17(4) of PIPA.

3. The App contains Google Firebase Analytics, and the Site contains Google Analytics and Microsoft Clarity, as analytics tools; they work only if you agree (Sections 7 and 11). There are no advertising or crash reporting tools. If any are added, the Company will first revise this policy and give notice under Section 17.

7. Entrusting processing (processors)

1. To handle personal information smoothly, the Company entrusts the following processing tasks. All processors are overseas companies, so the international transfer details are in Section 8.

2. If the tasks entrusted or the processors change, the Company will disclose the change in this privacy policy without delay.

8. International transfers

1. Under the entrustment in Section 7, the Company transfers personal information overseas (entrusted processing and storage) as follows, and gives this notice under Article 28-8(2) of PIPA.

2. How to refuse an international transfer, the procedure, and its effect — You may refuse the international transfer of your personal information. If you do not want your inquiry email to be transferred, do not send an inquiry by email; you can ask for an inquiry email you already sent to be deleted by contacting us as in Section 13. Because the Company accepts inquiries only by email, the Company will then be unable to receive your inquiry by email. If you do not want your usage records to be transferred, do not agree to analytics or withdraw your consent (Section 11); you can still use every feature of the App and the Site. If you do not want your Site access logs to be transferred, do not open the Site. In any case, your use of the App is not affected.

3. Information the App processes on your device (Section 2.3) is neither entrusted to anyone nor transferred overseas.

9. Security measures

The Company takes the following measures to keep personal information secure.

• Administrative measures — the privacy officer handles personal information personally (keeping the number of people who handle it to a minimum); health data is never used for advertising, marketing or data mining; what is sent to analytics tools is limited to a predefined list; before any change that would send data off the device, this policy is revised first and consent is obtained (Section 17)
• Technical measures — no feature sends health data or app data off the device (analytics tools receive only predefined action names and the kinds of things involved, and only if you agree); analytics tools do not work before you agree (the Site does not load them or set cookies before you agree); the analytics tools' collection of advertising identifiers and their advertising features are turned off; no advertising identifier in the App; data is stored under iOS app sandboxing and device data protection (encryption); excluded from iCloud uploads and device backups (including the widget copy); no health values in the App's logs; links that open the App from outside can open only allowed screens; the Site blocks external requests other than those allowed by its content security policy, and its access log storage feature is not used
• Physical measures — the only personal information the Company keeps is inquiry email; there is no server room or paper records; inquiry emails and usage records are subject to the physical access controls of the data centers run by the processors (Section 7)

10. Possible disclosure of sensitive information and how to keep it private

1. The Company does not process sensitive information. Your step count is processed only on your device (Section 2.3), and the App has no feature that discloses health data such as your step count to other people. Village pictures contain no step counts or other numbers.

2. However, if you add the Home Screen widget, today's steps appear on your device's screen. To keep others from seeing it, remove the widget from your Home Screen.

11. Automatic collection tools and how to refuse them

1. Site — When you first open the Site, a consent banner asks whether analytics tools may be used. Only if you tap "Accept" does the Site load the analytics tools and set the cookies below; if you tap "Decline" or do not answer, it loads no analytics tools and sets no cookies. Your choice is saved in your browser's storage (localStorage) so that you are not asked again; this value is never sent off the Site.

2. App — The App does not use cookies. App data is stored only in the App's own storage (database) on your device and is not sent over the internet. The analytics tool in the App (Google Firebase Analytics) works only if you agree on the consent card or in Settings in the App, and sends only predefined action names and the kinds of things involved (Section 2.2).

3. Collection and use of behavioral information — The Company treats screen and feature use, page navigation and session recordings among the usage records in Section 2.2 as behavioral information and processes it as follows. The Company does not provide targeted advertising and does not use behavioral information for targeted advertising or provide it to other companies.

4. How to refuse or withdraw — You can refuse or withdraw your consent to analytics at any time, and you can still use every feature of the App and the Site.

• Site: choose "Decline" under "Analytics settings" at the bottom of the Site — the analytics tools are no longer loaded and their cookies are deleted. You can also block or delete cookies in your web browser's settings (for example, Chrome — Settings → Privacy and security → Third-party cookies; Safari — Settings → Privacy → Manage Website Data).
• App: in the App, go to Settings → Your data and turn off "Share app usage"

5. Only if you have turned on "Share With App Developers" on your device, Apple provides app developers with app usage statistics and crash reports that do not identify you, under Apple's privacy policy. The Company uses them only to improve the App and its stability. To turn sharing off: Settings → Privacy & Security → Analytics & Improvements → Share With App Developers.

12. Rights of data subjects and legal representatives, and how to exercise them

1. You may at any time ask the Company to let you see, correct or delete, or to stop processing, the personal information it processes (Sections 2.1 and 2.2) (your "rights"), and you can withdraw your consent to the usage records processed with consent (Section 2.2) at any time (Section 11.4).

2. The rights of a child under 14 must be exercised by the child's legal representative. A minor aged 14 or older may exercise their rights personally or through a legal representative.

3. You can exercise your rights by email (Section 13) or in writing (to the business address below). The Company will tell you the result within 10 days of receiving your request. However, usage records (Section 2.2) are not linked to a name or email, so the Company cannot find the records of a particular person. After you withdraw your consent no further records are collected, and records already collected are deleted when the retention period (Section 4) has passed.

4. You may also exercise your rights through an agent, such as your legal representative or a person you authorize. In that case, a power of attorney in the form of Annex 11 to the Notice on Methods of Processing Personal Information (Korea) must be submitted.

5. Requests to see your information or to stop processing may be limited under Articles 35(4) and 37(2) of PIPA, and you cannot ask for deletion where another law specifies that the information must be collected.

6. The Company checks that the person making a request is the data subject or a legitimate agent. If you make the request from the email address you used for your inquiry, the Company confirms it through that address.

7. The Company does not keep the information the App processes on your device (Section 2.3), so you manage it yourself. Deleting the App deletes all of it. You can cut off access to your step count at any time: Settings → Privacy & Security → Health → Step Village. If you do, no new footprints are created, and the village you have already decorated remains.

13. Privacy officer

1. The Company has designated the following privacy officer, who is responsible for all personal information processing and handles complaints and remedies related to it. The Company is a sole proprietorship with no separate department; the privacy officer personally handles privacy work and complaints.

• Privacy officer: Dongha Ko (Representative)
• Contact: wehahee@gmail.com

2. You can send any privacy inquiry, complaint, request for remedy or request to see your information that arises from using the App or the Site to the contact above, and the Company will respond without delay.

14. Remedies

If you need a remedy, such as dispute resolution or counseling, for an infringement of your personal information, you can file a report or ask for counseling with the following Korean authorities.

• Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
• Personal Information Infringement Report Center: 118 (privacy.kisa.or.kr)
• Korean National Police Agency: 182 (ecrm.police.go.kr)

15. App permissions

1. The App uses the following permissions. Each one is requested through the system prompt the first time it is needed, and you can decline. Consent to analytics (Section 11) is asked on a consent card in the App, not as a system permission.

2. You can change any permission at any time in the Settings app. Health is changed through the path in Section 12.7; notifications and photos are changed by finding Step Village in the Settings app.

16. What does not apply

The following do not apply to the Company. If any of them ever applies, the Company will revise this policy first.

• The Company does not process pseudonymized information.
• The Company does not make decisions based on personal information processed by a fully automated system (automated decisions).
• The Company does not operate fixed or mobile video surveillance devices.
• The Company is a business with an address in Korea and is not required to designate a domestic agent under Article 31-2 of PIPA.
• The Company is not an information transmitter subject to requests for transmission of personal information under Article 35-2 of PIPA.

17. Changes to this policy

1. This privacy policy applies from the effective date shown above. This is version 1.2; the previous versions are version 1.1 (October 21, 2026) and version 1.0 (October 14, 2026 – October 20, 2026).

2. Previous versions can be found, with the period each one applied, under "Version history" at the bottom of the Site's privacy policy page.

3. If this policy changes, the Company will give notice in the App and on the Site at least 7 days before the change takes effect (at least 30 days before for changes that significantly affect your rights). Significant changes, such as a change in the personal information processed or the purposes of processing, will also be explained with a comparison of the text before and after the change.

4. Any change that would send data off the device (for example, accounts, sync or analytics tools) will be announced in the App before it takes effect, and your consent will be obtained.

5. This policy was written in Korean and is also provided in English, Japanese, Chinese (Traditional), Spanish, French, German and Portuguese. If a translation differs from the Korean version, the Korean version prevails.

6. The changes in version 1.2 (compared with version 1.1) are as follows.

wehahee · Representative: Dongha Ko · Business registration number 751-02-04369
202, 20 Saeteosan 16-gil, Mapo-gu, Seoul (Seongsan-dong), Republic of Korea · Email wehahee@gmail.com