Effective date: 2026-10-21
Article 1 (General Provisions and Purposes of Processing)
Arka Labs (the "Company") treats Users' personal information with care in operating "TarotHands" (the "Service"), a work tool app for tarot readers, and complies with the Personal Information Protection Act and other applicable laws. The Company processes personal information only for the following purposes. If a purpose changes, the Company will take the necessary measures, such as obtaining separate consent under Article 18 of the Personal Information Protection Act.
- Arka Labs account sign-in and member management: identity verification and sign-in using email verification codes, member identification, prevention of fraudulent use, and processing of account deletion
- Sync between devices: keeping a Member's display name, My spreads and spread list settings in sync across devices signed in with the same account
- Retention of records of agreement to the Terms and handling of disputes
- Customer support: receiving and answering inquiries, and handling requests to exercise rights regarding personal information
- Ensuring service stability: identifying and fixing the causes of app errors, server security and incident response
- Fulfilling legal obligations
The core features of the Service can be used without signing in. If you do not sign in, the Company does not receive member information such as your email address; only the error reports and communication information described in Article 2, Section 2 are processed. In addition, the Company does not receive consultation content such as reading history, notes or reading notes (Article 3).
The Service is operated in the Republic of Korea. Even if Users use the Service outside the Republic of Korea, the personal information the Company receives is stored and processed on the Company's servers located in the Republic of Korea (for overseas processors, see Article 7). This Policy has been prepared in accordance with the laws of the Republic of Korea, and the Company may also provide translations into other languages to aid understanding. If a translation differs from the Korean original, the Korean original prevails.
Article 2 (Personal Information Processed and How It Is Collected)
1. If you sign in (optional)
| When | Information processed |
|---|---|
| When you request a verification code | Email address, sign-in verification code (6 digits) |
| When you sign in for the first time and start using the Service | Basic Arka Labs account information (member ID number, email address, sign-up method, sign-up date and time), date and time you started using the Service, records of agreement to the Terms (type and version of the documents agreed to, date and time of agreement, IP address and device/app information (User-Agent) at the time of agreement) |
| When you use the Service while signed in (sync) | Display name, My spreads (name, description, tags, placement, order and orientation of card positions, position names and position meaning notes, times created, edited and deleted), spread list settings (order and hidden status of built-in spreads and My spreads) |
| When you sign in and while you stay signed in | Sign-in records (IP address, device/app information (User-Agent), dates and times of sign-in, last use and expiry), hash values of the tokens used to keep you signed in |
- Even if you sign in with an Arka Labs account you already used for Saju Todak, Dosabang or other services, the Service uses only the member ID number and email address from that account's information. Information processed by other services is governed by each service's own privacy policy.
- If no Arka Labs account exists for your email address when you first sign in, a new Arka Labs account is created with the above information, and this account can also be used on the Company's other services.
- The Company does not collect passwords, names, phone numbers, dates of birth, resident registration numbers or similar information through the Service.
2. Information processed whether or not you sign in
- Error reports: error details and device information when the app crashes, freezes or encounters a screen error. Nothing is sent if there is no error, and nothing is sent if you turn off Settings › About › "Send error reports" in the app. The details are given in Article 7, item 2.
- Communication information: the IP address, device/app information (User-Agent), access date and time, and request address when the app communicates with the Company's servers, such as for sign-in, sync or viewing the Terms in the app. The Company's server log files record only the request date and time, the request type and address path, and, for some processing records, the member ID number; they do not record request or response bodies or IP addresses.
3. How information is collected
- Entered directly by the User during sign-in or sync, or sent to the server by the app
- Generated and collected automatically while the app and the server communicate
- Sent automatically through an error reporting tool (Sentry) when an app error occurs
Article 3 (Information Stored Only on Devices — Information the Company Does Not Receive)
The following information is stored only on the User's device (in the app's storage) and is not sent to the Company's servers or anywhere outside the device. The Company cannot see this information and does not keep it.
- Reading history: date, spread used, cards drawn and their upright/reversed orientation
- Question notes, card notes, reading notes such as set readings and overall readings, and extra question sets
- Text entered by voice dictation
- Result images and copied result text
- My spreads and display names created while not signed in, and app settings such as appearance, sound effects and vibration
Voice dictation converts speech to text using only the device's on-device speech recognition. Your voice (audio) is not stored and is not sent to the Company or to any external server. If the device does not support on-device recognition (for example, Android versions below 13), dictation will not start. If an Android device does not have speech recognition data for the language used in the app, the device may download recognition data from the operating system provider, but even then your voice is not sent. The keyboard microphone (dictation) feature that the app may suggest as an alternative is a feature of the keyboard app you use, not of the Service, and is handled according to that keyboard app's policies.
When you share result images or text, they are delivered directly to the app you choose (such as a messenger) through the device's share feature, and the Company does not receive the shared images or text. What happens after sharing is governed by that app's policies. Result images you save to the photo library are stored in the device's photo library.
On-device information is deleted from the device when you delete it in the app or delete the app. If you have turned on your device's backup feature (such as Google or Apple account backup), on-device information may be backed up to your own backup space, but the Company does not receive these backups.
Even if a User writes a Client's information in question notes or reading notes, that information is stored only on the device. The User must obtain any consent needed to receive and use that information.
Article 4 (Retention and Use Period of Personal Information)
The Company destroys personal information without delay once the purpose of processing has been achieved. However, the information below is retained for the periods set out in the table.
| Item | Retention period | Basis |
|---|---|---|
| Basic Arka Labs account information (email address, etc.) | Until account deletion | Member management |
| Display name, My spreads, spread list settings | Until account deletion. My spreads a Member deletes are kept together with their deletion time so other devices can be told about the deletion, and are deleted upon account deletion | Sync between devices |
| Sign-in verification code | 10 minutes after issuance (deleted immediately once used to sign in) | Identity verification |
| Records of agreement to the Terms (type and version of the documents agreed to, date and time of agreement) | 5 years after account deletion. The IP address and device information at the time of agreement are deleted upon account deletion | Proof of agreement and handling of disputes (Company internal policy) |
| Deletion records (member ID number, date and time of deletion) | 6 months after account deletion | Proof of deletion processing and prevention of fraudulent use (Company internal policy) |
| Sign-in records (IP address, device/app information, dates and times of sign-in and last use) | 3 months | Protection of Communications Secrets Act |
| Server log files (request date and time, type, address path) | 30 days | Service stability and security (Company internal policy) |
| Error reports (Sentry) | Up to 90 days | Service stability (Company internal policy) |
| Inquiry records (email address used for the inquiry, content of the inquiry) | 3 years after the inquiry is resolved | Customer support and handling of disputes (Company internal policy) |
Personal information retained under the law is used only for the purposes prescribed by that law and is destroyed without delay once the retention period expires.
Article 5 (Provision of Personal Information to Third Parties)
The Company does not provide Users' personal information to third parties. The exceptions are cases permitted by the Personal Information Protection Act, such as where a law specifically provides otherwise, where an investigative agency requests it following the procedures and methods prescribed by law, or where it is necessary for the urgent protection of the life, body or property of the data subject or a third party. Outsourcing and overseas transfers for providing the Service are governed by Articles 6 and 7.
The display name, My spreads and spread list settings processed by the Service are not used by the Company's other services that share the Arka Labs account (such as Saju Todak and Dosabang).
Article 6 (Outsourcing of Personal Information Processing)
To provide the Service, the Company outsources personal information processing tasks as follows. When concluding an outsourcing contract, the Company sets out in writing, in accordance with Article 26 of the Personal Information Protection Act, matters such as the prohibition on processing personal information for purposes other than the outsourced work, technical and administrative safeguards, restrictions on re-outsourcing, management and supervision of the processor, and liability including compensation for damages, and it supervises whether the processor handles personal information safely.
| Processor | Outsourced work |
|---|---|
| Plus Five Five, Inc. (service name: Resend) | Sending sign-in verification code emails |
| Functional Software, Inc. (service name: Sentry) | Collecting and storing app error reports and providing an analysis dashboard |
| Cloudflare, Inc. | Relaying and securing communication between the app and the Company's servers |
All of the above processors process personal information overseas, so the details (recipient, country, items, timing, method, retention period, how to refuse, etc.) are given for each processor in Article 7.
The servers and databases that store member information are operated directly by the Company in Korea and are not entrusted to external hosting (cloud) providers. If the outsourced work or the processors change, the Company will notify Users through this Policy without delay.
Article 7 (Overseas Transfer of Personal Information)
In accordance with Article 28-8 of the Personal Information Protection Act, the Company transfers personal information overseas as follows as part of the outsourcing needed to provide the Service, and discloses these matters through this Policy.
- Email delivery (Resend)
- Recipient (processor): Plus Five Five, Inc. (operator of the email delivery service Resend)
- Recipient's contact: support@resend.com (the address Resend has published for privacy inquiries)
- Destination country: United States
- Timing and method of transfer: When a User requests a sign-in verification code, by encrypted (HTTPS) transmission over an information and communications network
- Personal information transferred: Email address, sign-in verification code (included in the email subject and body)
- Recipient's purpose of use: Sending sign-in verification code emails
- Recipient's retention and use period: Until the purpose of sending the email is achieved; the Company does not retain it separately. The processor's data processing and retention, such as keeping delivery logs, follow Resend's policies.
- App error reports (Sentry)
- Recipient (processor): Functional Software, Inc. (operator of the error reporting service Sentry)
- Recipient's contact: compliance@sentry.io (the address Sentry has published for privacy inquiries)
- Destination country: Germany (Sentry's EU data center in Frankfurt). The recipient is located in the United States.
- Timing and method of transfer: Only when the app crashes, freezes or encounters a screen error, by encrypted (HTTPS) transmission over an information and communications network. Error reports that could not be sent are kept briefly on the device and sent the next time the app is opened.
- Personal information transferred: Error details (error message, location in the code where the error occurred), a record of app activity just before the error (server request addresses and response statuses, records of the app moving to the foreground or background, network connection changes, etc.), device information (device model and manufacturer, operating system type and version, screen size, memory and storage status, language and time zone settings, etc.), app version, and an identifier randomly generated for each app installation (installation ID)
- Information not sent: The Service is configured not to send member information such as email addresses and member ID numbers, screenshots, screen structure, console logs, or text written by Users such as readings, notes and reading notes. Sentry is configured not to store the IP addresses it learns during communication.
- Recipient's purpose of use: Storing app error reports and providing an analysis dashboard (used by the Company to find and fix the causes of errors)
- Recipient's retention and use period: Deleted automatically once Sentry's retention period (up to 90 days) has passed.
- Communication relay and security (Cloudflare)
- Recipient (processor): Cloudflare, Inc. (provider of content delivery network (CDN) and security services)
- Recipient's contact: dpo@cloudflare.com (the address Cloudflare has published for privacy inquiries)
- Destination country: United States. Communications may be processed at whichever of Cloudflare's data centers around the world is close to the User.
- Timing and method of transfer: When the app communicates with the Company's servers (sign-in, sync, viewing the Terms in the app, etc.), by encrypted (HTTPS) transmission over an information and communications network
- Personal information transferred: IP address, device/app information (User-Agent), access date and time, request address and communication content (email address, sign-in verification code, sign-in token, and synced information such as the display name and My spreads). For security processing, communications are decrypted once on Cloudflare's network and then re-encrypted before being delivered to the Company's servers. The on-device information described in Article 3 is not sent to the server and is therefore not delivered to Cloudflare either.
- Recipient's purpose of use: Relaying communication between the app and the Company's servers, and security such as blocking malicious access
- Recipient's retention and use period: Until the purposes of relaying communication and security are achieved; the Company does not retain it separately. The processor's data processing and retention follow Cloudflare's policies.
Users may refuse the above overseas transfers. To refuse, do not use the relevant feature, or send your refusal to arkalab79@gmail.com. Each transfer is necessary for the relevant feature to work, so refusing will limit your use as follows.
- Email delivery (Resend): You cannot sign in. Even without signing in, you can still use core features such as readings, spread editing, history and sharing results.
- Communication relay and security (Cloudflare): You cannot use features that communicate with the server, such as sign-in, sync and viewing the Terms in the app. Features that work without signing in remain available.
- App error reports (Sentry): If you turn off Settings › About › "Send error reports" in the app, error reports are no longer sent from that point on. Even with it turned off, all features of the Service remain available.
In accordance with Article 28-8(4) and Article 28-9 of the Personal Information Protection Act, the Company includes personal information protection measures for overseas transfers (compliance with personal information protection principles, security measures, guarantee of data subjects' rights, etc.) in its outsourcing contracts and takes the necessary measures to ensure that processors handle personal information safely.
Article 8 (Consent at Sign-in and the Right to Refuse)
When a Member first signs in and starts using the Service, the Company asks for consent to "(Required) Collection and use of personal information". Its content is as follows.
| Category | Details |
|---|---|
| Purposes of collection and use | Arka Labs account sign-in and member management, sync between devices, retention of records of agreement to the Terms, customer support |
| Items collected | Email address, basic Arka Labs account information, records of agreement to the Terms, display name, My spreads, spread list settings, sign-in records (Article 2, Section 1) |
| Retention and use period | Until account deletion; however, information for which Article 4 sets a separate period is kept until the end of that period |
Users have the right to refuse this consent. If you refuse, you cannot use sign-in and sync, but you can still use the features that work without signing in (reading table, built-in spreads, creating My spreads, history, sharing results, etc.).
Article 9 (Rights and Obligations of Data Subjects and How to Exercise Them)
Users (data subjects) may exercise the following rights against the Company at any time.
- Request access to personal information
- Request correction of errors and the like
- Request deletion
- Request suspension of processing
- Withdraw consent to the processing of personal information and delete your account
You can edit or delete your display name and My spreads directly in the app, and you can delete your account from the app's settings screen. If you want to delete only the information stored by the Service while keeping your Arka Labs account, please send a request by contact email.
Other rights may be exercised in writing, by email or by similar means to arkalab79@gmail.com, and the Company will act within 10 days of receiving the request, in accordance with the Enforcement Decree of the Personal Information Protection Act, and inform you of the result. If you request correction or deletion, the Company will not use or provide the personal information concerned until the correction or deletion is complete.
Users may exercise their rights through a representative (a legal representative or a person the User has authorized); in this case, the Company may request documents confirming the authorization. The Company verifies that the person exercising the rights is the data subject or a legitimate representative.
Requests for access and for suspension of processing may be restricted under Article 35(4) and Article 37(2) of the Personal Information Protection Act, and requests for deletion may be restricted for personal information that other laws require to be retained.
Because the Company does not hold the on-device information described in Article 3, Users can delete it themselves in the app or by deleting the app.
Article 10 (Personal Information of Children Under 14)
Children under 14 cannot register (sign in) as Members of the Service, and the Company does not knowingly collect the personal information of children under 14. If it is confirmed that the personal information of a child under 14 has been collected, the Company will destroy it without delay.
Article 11 (Procedures and Methods for Destroying Personal Information)
The Company destroys personal information without delay once its retention period has expired or the purpose of processing has been achieved. Personal information that must continue to be retained under other laws is stored separately from other personal information.
1. What happens when you delete your account
- The display name, My spreads (including spreads marked as deleted) and spread list settings on the server are deleted immediately.
- The email address is replaced with a value that cannot identify anyone, and the email sign-in link information is deleted.
- The IP address and device information in the records of agreement to the Terms are deleted, and only the fact of agreement (type and version of the document, date and time of agreement) is kept for the period set out in Article 4.
- You are signed out on all devices, and sign-in records are kept for the period set out in Article 4 and then destroyed.
- Because deletion applies to the entire Arka Labs account, information processed by the Company's other services (such as Saju Todak and Dosabang) is also handled in accordance with each service's privacy policy.
- On-device information (Article 3) is not held by the Company and therefore remains on the device after account deletion.
- Information remaining in database backups (for disaster recovery) is deleted in turn according to the backup retention cycle, and is completely deleted no later than 90 days after account deletion.
2. Methods of destruction
- Information in electronic files is deleted using technical methods that make the records unrecoverable.
- Personal information recorded on paper is destroyed by shredding or incineration.
Article 12 (Measures to Ensure the Security of Personal Information)
In accordance with Article 29 of the Personal Information Protection Act, the Company takes the following measures.
- Encryption in transit: Communication between the app and the server is encrypted with HTTPS.
- Protection of authentication information: Sign-in verification codes and the tokens used to keep you signed in are stored on the server as hash values (values that cannot be reversed) rather than as the original values. Verification codes are subject to limits on request intervals, number of requests and number of incorrect attempts.
- Protection of sign-in information on devices: Sign-in tokens kept on the device are stored in the device's secure storage (iOS Keychain, Android Keystore).
- Protection of personal information in logs: Request and response bodies, verification codes and text written by Users are kept out of server log files and error reports.
- Management of access rights: The Company keeps the number of people who can access the personal information processing system to a minimum and manages the granting, changing and revoking of access rights.
- Access control: Servers and databases are operated on facilities in Korea managed directly by the Company, with measures in place to block unauthorized access from outside.
On-device information is protected by the device's security settings, such as the screen lock, so please set a lock on your device.
Article 13 (Device Permissions and Automatic Collection Tools)
The Service requests each permission only when you use the feature that needs it, as listed below. Even if you do not allow a permission, you can still use the rest of the Service, and you can turn off any permission you have granted at any time in your device's settings.
| Permission | When requested | Purpose | Required or optional |
|---|---|---|---|
| Microphone | When you first tap the voice dictation button | Converting your spoken reading into text on the device | Optional |
| Speech recognition (iOS) | When you first tap the voice dictation button | On-device speech recognition | Optional |
| Add photos (iOS), write to storage (Android 12 and below) | When you save a result image to the photo library | Saving result images to the photo library | Optional |
- The microphone is used only while listening after you tap the dictation button, and no recording files are created or stored.
- The Service does not request permission to read photos in your photo library.
- Apart from these, the Service uses basic functions unrelated to personal information, such as the internet connection and vibration.
- The Service does not use location, contacts, the camera or advertising identifiers, and does not include advertising tools or usage behavior analytics tools.
- The Service does not use cookies. The information that keeps you signed in is kept in the secure storage described in Article 12 and is deleted when you sign out.
Article 14 (Chief Privacy Officer and Contact)
In accordance with Article 31 of the Personal Information Protection Act, the Company has designated a Chief Privacy Officer as follows, to take overall responsibility for personal information processing and to handle Users' complaints and provide remedies for damage related to the processing of personal information.
- Chief Privacy Officer: 박우현
- Contact (email): arkalab79@gmail.com
- Operator: Arka Labs (Representative: 박우현)
- Address: 서울특별시 양천구 오목로 118-2
Users may direct any inquiries, complaints or requests for remedies concerning personal information protection that arise while using the Service to the Chief Privacy Officer, and the Company will respond and handle them without delay.
Article 15 (Remedies for Infringement of Rights)
To obtain remedies for an infringement of personal information, Users may apply to the following organizations for dispute resolution, counseling and the like.
- Personal Information Dispute Mediation Committee: 1833-6972 (no area code needed) / www.kopico.go.kr
- Personal Information Infringement Report Center (KISA): 118 (no area code needed) / privacy.kisa.or.kr
- Supreme Prosecutors' Office, Cyber Investigation Division: 1301 (no area code needed) / www.spo.go.kr
- Korean National Police Agency, Cyber Investigation Bureau: 182 (no area code needed) / ecrm.police.go.kr
Article 16 (Changes to This Privacy Policy)
This Privacy Policy applies from its effective date. If the Company adds, deletes or modifies content due to changes in laws, policies or security technology, it will announce the reasons for and details of the changes through a notice in the Service starting 7 days before the changes take effect.
However, if there are material changes to Users' rights, such as changes to the personal information items collected, the purposes of use, or the recipients or countries of overseas transfers, the Company will give notice starting 30 days before the changes take effect and, where necessary, obtain Users' consent again.
- Date of announcement: 2026-10-21
- Effective date: 2026-10-21
Business Information
- Company name: Arka Labs (아르카랩스)
- Representative: 박우현
- Business registration number: 796-39-01319
- Mail-order business report number: 제 2026-서울양천-0800 호
- Address: 서울특별시 양천구 오목로 118-2
- Chief Privacy Officer: 박우현
- Contact email: arkalab79@gmail.com