Nouvelle Vague Intelligence
1. Purposes of processing
The Operator processes personal information only to the extent needed for the following purposes.
- Sign-up with a Google account; sign-in with a Google account or with a handle/email and password; identity verification and account recovery
- Managing profiles and friendships, friend search and friend requests
- Posting photos you choose, providing the friends feed, and providing per-object likes and comments
- Showing your profile photo, if you register one, to your friends
- Service security, prevention of misuse, incident response, handling of reports and inquiries
- Recording and managing agreement to the Terms of Service and acknowledgement of the privacy notice after the consent-record feature launches (planned)
2. Information processed, how it is collected, and retention
Consent records and in-app reports are proposed for future features and are not currently collected through those features. Report retention will also be confirmed before this draft takes effect.
A. Information processed and stored on your device
| Information | Purpose | Retention |
|---|---|---|
| Photos you take or select, recognition results and cut-out images, object labels, captions, capture time, theme | Photo diary features such as CAM, FIELD and REPORT | Until you delete the item, erase all data in the app, or uninstall the app |
| Local copies of profile and friend information, app settings | Offline use and keeping your preferences | Until you erase all data in the app or uninstall the app |
Object recognition and mask generation happen on your device. seesun does not perform facial recognition or biometric analysis to identify people. Photos and analysis results you have not saved (posted) are not sent to the server.
B. Information processed on the server when you sign in or share
| Category | Information | How collected | Retention |
|---|---|---|---|
| Account | Email address; for Google sign-in, the display name and email of your Google account; account password (stored one-way hashed by the authentication service); internal user identifier; authentication session data | When you sign up or sign in with Google, set a password during sign-up or in settings, or sign in with handle/email and password | Until account deletion is completed |
| Consent records (planned) | Document version and time of your agreement to the Terms of Service, acknowledgement of the privacy notice, and confirmation that you are 14 or older | After launch of the feature, created when you confirm or agree during sign-up or after an amendment | Until account deletion is completed |
| Profile | Display name, username (@handle), profile photo (if you register one) | Entered or registered by you, or prefilled from your Google account and confirmed | Until account deletion is completed; profile photo until you replace or remove it |
| Posts and social | Photos you post and cut-out images, object labels, captions, theme, capture time, friend request/accept/remove records, per-object like records, comment text and time | When you use posting, friend, like or comment features | Until you delete the post, friendship, like or comment, or delete your account |
| In-app reports (planned) | Reported item (post, comment or user), reason, time, reporter identifier | When you use the in-app report feature after it launches | One year after the report is resolved, for objections and dispute handling |
| Automatically generated | Access logs such as IP address, access time, request records, device or app connection details | Generated automatically when the app connects to the server | As long as needed for security and incident response (proposed maximum: 3 months; subject to confirmation of operational settings) |
You may decline to provide this information. Because seesun is an account-based service, you will not be able to use the app in that case.
C. Legal bases (information processed without consent)
| Basis | Information | Explanation |
|---|---|---|
| Performance of a contract (Korean Personal Information Protection Act, Art. 15(1)(4)) | Account, consent records, profile, posts and social, reports, device-only information | Needed to provide the account and friend-sharing service you chose. Processed without separate consent; the items and purposes are explained through this Policy at sign-up. |
| Legitimate interest (Art. 15(1)(6)) | Automatically generated access logs | Processed to the minimum extent needed for security and incident response. |
| Consent (Art. 15(1)(1)) | None at present | If optional processing such as marketing is introduced, separate optional consent will be requested. |
The Operator does not collect personal information for marketing or personalized advertising and does not use your photos or posts to train artificial-intelligence models. It does not use cookies, advertising identifiers, analytics SDKs or other automatic collection tools. The Service makes no automated decisions that materially affect your rights or obligations.
3. App permissions
| Permission | Required? | Purpose |
|---|---|---|
| Camera | Optional | Taking photos in the app. If declined, you can still import photos through the system photo picker and use other features. |
| Notifications | Optional | A notification generated on your device when your weekly report is ready. No server push (external push service) is used. If declined, the report is still available in the app. |
| Internet | Needed for account sign-in and sync | Sign-in, friendships, uploading posts and syncing the friends feed |
Gallery import uses the Android system photo picker, so the app does not request access to your whole photo library and reads only the photos you select. Location, contacts and microphone permissions are not requested.
4. Disclosure to third parties
The Operator does not sell or provide your personal information to third parties. When you post a photo, the following information is shown to your accepted friends.
| Recipient | Purpose | Information | Period |
|---|---|---|---|
| seesun friends you accepted or who accepted you | Friends feed and interaction features | Display name, @handle, profile photo, posted photos, object images and labels, captions, theme, capture time, per-object likes, comments | Until the friendship, post, like or comment is deleted |
Personal information may be disclosed where required by law or by a lawful request from investigative or other authorities. When you post a photo showing another person, you must obtain any necessary consent and avoid infringing that person's rights.
Photos and captions you post may reveal sensitive information such as health, religion or political views. Posts are visible only to friends you have accepted; you can choose not to post, or delete a post at any time. The Operator does not analyze your posts to extract or otherwise use sensitive information.
5. Outsourcing of processing
| Processor | Task |
|---|---|
| Supabase Pte. Ltd. | User authentication, database, file storage, real-time sync, security logs and server infrastructure |
| Google LLC | Account selection and sign-in authentication when you choose Google sign-in |
Through contracts and service settings, the Operator ensures that processors comply with legal requirements, including the prohibition of use for other purposes, technical and organizational safeguards, management of sub-processors, and deletion of personal information.
6. International transfer
When you use the Service, your personal information is transferred to cloud services outside Korea as described below. To refuse the transfer, do not sign up, erase all data in Settings, or request account deletion through the contact below. Because seesun's account and friend-sharing features are provided only through these servers, you cannot use the Service if you refuse the transfer.
| Recipient | Country / location | Information | Purpose | When and how | Retention |
|---|---|---|---|---|---|
| Supabase Pte. Ltd. privacy@supabase.com |
Japan (AWS Tokyo region) | Account, profile, posts and social information and access logs listed in Section 2.B; consent and report records only after those features launch | Authentication, database and file storage, sync and security operations | Sent over encrypted connections (HTTPS) when you sign in, post or sync | For each item's retention period; backups and logs are deleted automatically after the service's retention period |
| Google LLC Google Privacy Policy |
United States and other countries where Google operates | Google sign-in request data, one-time nonce and authentication tokens | Google account sign-in authentication | Sent over encrypted connections when you choose Google sign-in | Until the authentication purpose is fulfilled or per Google's retention policy |
The legal basis for the transfer is Article 28-8(1)(3) of the Korean Personal Information Protection Act: disclosure in this Policy of outsourcing and storage needed to perform the contract with you.
7. Destruction of personal information
The periods below are proposals. Current retention is described in the current policy. Actual log and backup settings and report-handling procedures must be confirmed and announced before this draft takes effect.
- Personal information is destroyed without delay once its retention period ends or its purpose is fulfilled.
- Electronic files are deleted so that they cannot be recovered; any paper records are shredded or incinerated.
- On-device information can be destroyed by deleting individual items, erasing all data in Settings, or uninstalling the app.
- Posts on the server can be deleted individually; profile, posts and friendships can be destroyed by erasing all data or requesting account deletion.
- Copies remaining in backups or security logs are isolated, used only for recovery or security, and deleted automatically after the processor's retention period.
After account deletion, the following information is kept for the periods below and then destroyed. All other information is destroyed immediately on deletion; nothing is kept to prevent re-registration.
| Information | Period (proposed) | Purpose |
|---|---|---|
| Access logs (IP address, access time, request records) | Up to 3 months | Security incident investigation and incident response |
| Reports | One year after resolution | Objections and dispute handling |
| Backup copies | Processor's retention period (up to 30 days) | Disaster recovery |
8. Your rights and how to exercise them
Current account and data deletion procedure
You may request access to, correction or deletion of, or suspension of processing of your personal information, and may withdraw consent.
| Right | How to exercise |
|---|---|
| Access | Settings → profile and account screens; FIELD and REPORT screens show your information and posts |
| Correction | Settings → edit name, handle and profile photo |
| Deletion / suspension | Delete posts, likes and friendships; request comment deletion by email. Settings → Account → Erase all data removes service data; email to also delete the authentication account |
| Withdrawal of consent | Currently requested by email. Consent history in Settings → Terms & policies is planned for a future release |
For requests that cannot be handled in the app, email the contact below from the address you signed up with. After verifying your identity, the Operator handles access, correction and suspension requests within 10 days, and account and data deletion requests within 7 days of confirming the request unless there are special circumstances. The legal guardian of a minor aged 14 or older may exercise these rights the same way.
"Erase all data" in the app deletes device data and the service data on the server (profile, posts, friendships and similar). To also remove the account identifiers held by the authentication service, request account deletion by email at the address below.
9. Children under 14
seesun is not directed at children under 14, and an age-14 confirmation step is planned for sign-up. The Operator does not knowingly collect personal information from children under 14 without a legal guardian's consent. If the Operator learns that a user is under 14, it deletes the account and its data without delay.
10. Security measures
- Encrypted connections to the server (HTTPS); plaintext connections blocked
- Authentication sessions and key local settings encrypted with the device's secure storage
- Account passwords stored as one-way hashes by the authentication service
- Per-user access control and least privilege for server data and files
- Device data excluded from operating-system backups and device transfer
- No advertising, tracking or analytics SDKs
- If a data breach becomes known, affected users are notified without delay (in principle within 72 hours), and incidents meeting legal reporting criteria are reported to the relevant authorities
11. Privacy officer and contact
Send inquiries about processing, exercising your rights, complaints or remedies to:
- Privacy officer: Nam Yoonji (representative, nouvelle vague intelligence)
- Email: yoon7k3@gmail.com
You may also contact the following Korean bodies about privacy infringements:
- Personal Information Infringement Report Center: 118 · privacy.kisa.or.kr
- Personal Information Dispute Mediation Committee: 1833-6972 · www.kopico.go.kr
- Korean National Police Agency cybercrime reporting: 182 · ecrm.police.go.kr
12. Additional information for users outside Korea
- Storage location: your server data is stored on Supabase servers in Tokyo, Japan, and Google processes sign-in data in the United States (Section 6).
- On-device image analysis: seesun runs image analysis on your device to detect and outline everyday objects (for example "cup", "plant" or the outline of a person) so you can turn them into stickers. It does not perform facial recognition, does not generate scans of face or hand geometry, faceprints or any other biometric identifier or template capable of identifying a person, and does not infer health, religious, ethnic or other sensitive characteristics. Object-recognition computation is performed on your device; saved frames, object images and labels are synced as described in Section 2.
- Do Not Track: seesun does not respond to "Do Not Track" signals because it does not track users across third-party websites or services, and no third party collects information about your activity across sites or services through seesun.
- U.S. state privacy rights: regardless of where you live, you can access, correct or delete your data in Settings or by emailing the address above (Section 8). The Operator does not sell personal information, does not share it for targeted advertising, and does not profile you.
- Service messages: the Operator may send messages about your account, security, friend requests, comments and the weekly report by email or device notification. You can turn off device notifications in your device settings. The Operator does not send marketing email.
- Children under 13: seesun does not accept sign-ups from anyone under 14 (Section 9). If the Operator learns of an account held by a child under 13, it deletes the account and its data. Parents or guardians may report such an account at the email above.
- Non-consensual intimate images: anyone, whether or not a member, may request removal at the email above; valid requests are handled within 48 hours (proposed response time, subject to confirmation of the handling procedure before this draft takes effect).
- How changes are notified: see Section 13, including the change history.
13. Changes to this Policy
This is a v2.0 draft with no effective date. It does not replace the current policy. Once the changes and date are finalized, notice is planned at least 7 days before implementation, or 30 days for changes materially affecting your rights, through the app or public website.
Change history
- v2.0 draft: prepared September 25, 2026; reviewed for the website September 26. Clarifies comments, profile photos, notifications, legal bases, rights and international information; proposes consent records, reporting and age confirmation.
- July 31, 2026: current policy first effective.