Privacy Policy

The Company collects the following information to provide the Service: 1. Required: social login identifiers provided by Google, GitHub, and LinkedIn; email address; username; and display name. 2. Optional: profile photo, short biography, social links such as websites, Twitter/X, GitHub, and LinkedIn; and Maker verification evidence such as domain ownership records and portfolio links. 3. Automatically collected: IP address, browser type and version, operating system, device information, access times, usage history, activity logs used by recommendations, cookies, and anonymous Google Analytics 4 (GA4) event data.

The Company collects information through: 1. Profile information supplied by Google, GitHub, or LinkedIn during OAuth login within the scope of the Member's consent. 2. Information entered by Members in onboarding, Settings, posts, Maker verification requests, and other Service features. 3. Information automatically generated during use, including cookies, access logs, GA4 events, and rate-limit counters.

The Company uses personal information for: 1. Registration, identity verification, OAuth authentication, and session maintenance. 2. Community features, including product registration, posts, comments, cheers, likes, saves, follows, and subscriptions. 3. Maker verification and Maker-specific features. 4. Coins, reputation, bounties, rankings, and recommended feeds. 5. Notifications about likes, comments, follows, coin awards, moderation outcomes, and related activity. 6. Statistics, quality improvement, and new feature development. 7. Abuse prevention, report handling, dispute resolution, and legal obligations. 8. Security incident response, audit logs, and threat detection and blocking.

1. In principle, personal information is retained until membership ends and then destroyed without delay. During the 30-day deletion grace period under Article 13, some information may be retained in encrypted form for recovery and legal obligations. 2. Information that must be retained under applicable law is stored separately as follows: - Usage records and access logs: 3 months to 3 years under the Korean Protection of Communications Secrets Act and Electronic Commerce Act. - Contract, cancellation, and payment records, where applicable: 5 years under the Electronic Commerce Act. - Consumer complaints and dispute records: 3 years under the Electronic Commerce Act. - Restriction records for abuse prevention: up to 3 years under the internal retention policy.

1. The Company does not generally disclose Members' personal information to third parties. 2. Exceptions may apply when a Member has consented, disclosure is specifically required by law or a lawful investigative request, or disclosure is unavoidable to prevent imminent harm to a Member's or another person's life, physical safety, or property, including child-safety threats.

The Company entrusts the following processing to service providers. Personal information is transferred to and stored in the United States where these providers operate. 1. Supabase Inc. (United States): database, authentication, and file storage hosting; retained until the processing contract ends. 2. Vercel Inc. (United States): web application hosting and CDN; retained until the processing contract ends. 3. Google LLC (United States): Google OAuth and anonymous GA4 statistics; retained until the processing contract ends. 4. GitHub, Inc. and LinkedIn Corporation (United States): GitHub and LinkedIn OAuth; retained until the processing contract ends. 5. OpenAI, L.L.C. (United States): AI content moderation through the Moderation API; retained until the API call completes and, in principle, not used for training. 6. Microsoft PhotoDNA, Cloudflare, and similar services (United States): CSAM image hash scanning and content safety checks where enabled; retained until verification completes. Under Article 26 of the Korean Personal Information Protection Act, the Company documents and supervises contractual responsibilities, including purpose limitations, technical and organizational safeguards, restrictions on subcontracting, supervision of processors, and liability for damages.

1. Individuals may request access, correction, deletion, suspension of processing, and export of their data in a structured format. Deletion includes the procedure in Article 13. 2. In Settings under Security, Members can enable or disable two-factor authentication, view and terminate active login sessions, download their personal data as JSON, and request or cancel deletion during the grace period. 3. Members may exercise their rights through customer support or the privacy officer. The Company will act without delay.

Under Article 29 of the Korean Personal Information Protection Act, the Company applies the following safeguards: 1. HTTPS/TLS encryption in transit and encryption of stored data. 2. Least-privilege access controls and role-based permissions, including row-level security (RLS). 3. Administrator audit logs recording major administrative actions. 4. Two-factor authentication and OAuth-based login. 5. Per-IP rate limiting to prevent automated attacks and abuse. 6. IP blocking and suspicious access detection. 7. Access log retention, tampering prevention, and regular checks. 8. Privacy training and permission reviews for internal staff.

1. The Company uses cookies to maintain authentication sessions, improve the Service, and analyze usage. 2. Essential cookies support features such as login sessions; rejecting them may limit use. Analytics cookies support anonymous GA4 statistics and can be rejected in the cookie consent banner. 3. Visitors can choose whether to allow optional cookies on their first visit and can also reject storage through browser settings.

1. The Company uses GA4 to collect anonymized visit statistics for Service improvement and user-experience analysis. 2. GA4 applies IP masking by default and collects aggregate data that does not directly identify individual users. 3. The Company does not send user event data to GA4 when analytics cookies are rejected or the browser's Do Not Track setting is enabled.

1. The Company uses AI-based automated content review, including the OpenAI Moderation API, to maintain a healthy community. 2. Member text, including posts, comments, and product descriptions, is submitted to an AI model to assess risk categories such as hate, violence, sexual content, and self-harm. The data is not used for purposes other than moderation. 3. Content identified as risky may be blocked or hidden automatically. Administrators make the final determination through review.

1. The Company has zero tolerance for child sexual abuse material (CSAM) and content threatening minors' safety. 2. Uploaded images may undergo hash-based scanning by external safety services such as Microsoft PhotoDNA or Cloudflare. Confirmed CSAM is removed or blocked immediately and reported to law enforcement and specialist organizations as required by law. 3. Registration by children under 14 is restricted.

1. Members may request deletion in Settings under Security. Requests are processed after a 30-day grace period. 2. Members may cancel at any time during that period. Afterward, the Company performs the following actions: - Permanently anonymize or destroy identifying information, including email, username, profile photo, social links, and IP data. - Anonymize authorship of public Content. Content itself may remain anonymously to preserve community context. - Remove held coins and private data. 3. Personal information cannot be restored after anonymization or destruction.

1. The Company appoints the Oh My Product operations team as its privacy officer to oversee processing, handle complaints, and assist with remedies. Contact: support@ohmyproduct.com. 2. Individuals may direct privacy questions, complaints, and remedy requests to that contact. The Company will respond and act without delay. 3. Individuals in Korea may also contact these organizations: - Personal Information Infringement Report Center, Korea Internet & Security Agency: 118 within Korea; privacy.kisa.or.kr. - Personal Information Dispute Mediation Committee: 1833-6972 within Korea; www.kopico.go.kr. - Supreme Prosecutors' Office Cyber Investigation Division: 1301 within Korea; www.spo.go.kr. - Korean National Police Agency Cyber Investigation Bureau: 182 within Korea; ecrm.cyber.go.kr. 4. Individuals outside Korea may contact the privacy officer above and may also have rights under the data protection laws of their own country.

1. This Policy applies from its effective date. Additions, deletions, or changes arising from laws or policy changes will be announced in Service notices or on this page at least 7 days before taking effect, or 30 days for material changes. 2. For material amendments, the Company may request renewed consent when a Member accesses the Service. Members may continue after agreeing to the changes. 3. This English edition (version 3, published September 21, 2026) is a translation of the Korean Privacy Policy that took effect on April 11, 2026. It does not change the substance, effective date, or consent status of that Policy. Where the English and Korean texts differ, the Korean text governs. The Korean text is available from the Company on request.

This Privacy Policy took effect on April 11, 2026. That revision incorporated two-factor authentication, session management, data export, the account deletion grace period, cookie consent, GA4, AI moderation, CSAM scanning, administrator audit logs, per-IP rate limiting, Maker verification, cheers, reports, blocks, and follows. The English edition was published on September 21, 2026.