Privacy Policy

Effective October 13, 2026

This policy explains what personal information Thegram (“we”) handles when you use thegram.one, the Thegram web viewer at viewer.thegram.one, the Thegram web app at vault.thegram.one, and the Thegram apps for Mac, iPhone, and iPad (the “Services”), and what you can ask us to do with it. We follow the Personal Information Protection Act of the Republic of Korea.

Operator: Hyunmin Kim (김현민)
Privacy officer: Hyunmin Kim (김현민), roy@thegram.one, +82 10-8000-2203

1. What we handle

The moving mark on our home page remembers its own path inside your browser tab to draw the animation. That record never leaves your browser and disappears when you close the tab.

The web viewer, and the web app while you are signed out, do not save your file on our servers, write it to logs, or create a link to it. The web viewer stores nothing in your browser. Whether or not you sign in, the web app keeps some things only in your browser and never sends them to us: display settings and language, panel layout, the titles of the last 8 documents you opened, and, if you choose a folder on your device, the browser’s permission to open it again. Clearing the site’s data in your browser removes them.

Signed-in use, including Google Drive and the Google API Services User Data Policy, is described in detail in the web app privacy policy.

2. Why we use it

• To run the Services, show you the files you open, and keep your Vaults and Drive connections working.
• To keep the Services secure and investigate abuse.
• To count how many people visit thegram.one and download the Mac app. The counts are daily totals and cannot identify you.
• To answer your questions and requests, and to send sign-in codes and security notices from noreply@thegram.one. We do not send marketing email unless you ask for it.

We do not use personal information for advertising or profiling, and we do not use your files to train AI models.

3. How long we keep it

• Files opened while signed out: not kept. They are discarded once the response is sent.
• Account information and the record of which terms you agreed to: until you delete your account.
• Sessions and desktop devices: until the session ends or is revoked, at most 30 days.
• Vault documents and their history: while the Vault exists. A deleted Vault stays in the trash for 30 days and is then purged. Backups retain up to 14 archives by count, not by a fixed 14-day period; historical copies and interrupted cleanup may remain longer.
• Technical logs: up to 90 days, unless we need them longer to investigate a security incident or the law requires it.
• Visit and download counts: the daily totals are kept indefinitely and contain no personal information. The in-memory value used to recognize returning visitors is discarded at the end of each day (Korea time) or when the server restarts.
• Support emails: until your request is resolved, then up to 1 year, unless you ask us to delete them sooner or the law requires us to keep them longer.

4. How we delete it

We delete records from active storage when their retention period ends. Deletion does not guarantee secure erasure of historical backups or residual disk blocks.

5. Sharing

We do not sell personal information. We do not give it to third parties unless the law requires it, for example when a court or an investigative authority makes a lawful request.

We entrust the following processing to other companies:

• Plus Five Five, Inc. (Resend), USA, delivers sign-in code emails. It receives your email address and sign-in code message over an encrypted connection each time a code is emailed, to deliver it; it deletes them under its retention rules once delivered. You can avoid this transfer by signing in with Google or Apple.
• Google LLC, USA, stores backup archives of account records, Vault documents and Drive connection records. The backup job is configured to attempt daily uploads over HTTPS for disaster recovery; the latest recorded attempts failed with an authorization error (invalid_grant), so successful transfer is not confirmed. Archives created after the P3 rollout use AES-256-GCM; older backups and storage remnants have not all been erased. The operator’s key is not stored with Google. Backups retain up to 14 archives by count, and interrupted cleanup may leave historical copies longer; this transfer cannot be refused separately.

These are transfers abroad under Article 28-8(1)(iii)(a) of the Personal Information Protection Act. For Plus Five Five, Inc. (Resend), USA (privacy contact: privacy@resend.com), the items transferred are your email address and sign-in code message, sent each time a code is emailed over an encrypted connection; the purpose is email delivery; retention is under Resend’s retention rules and the items are deleted once delivered. You may avoid this transfer by using Google or Apple sign-in. For Google LLC, USA (privacy contact: Google privacy form), new backup archives of account records, Vault documents and Drive connection records are encrypted with AES-256-GCM before transfer over HTTPS. The job is configured to attempt daily uploads; the latest recorded attempts failed with an authorization error (invalid_grant), so successful transfer is not confirmed. Owned Vaults remain in trash for 30 days before purge and may be included in backups during that period. Backups retain up to 14 archives by count, not on a fixed 14-day schedule; historical copies and interrupted cleanup may remain longer, so deletion does not guarantee removal from every backup within 14 days.

Google and Apple sign-in, and Google Drive, are services you connect to directly and are governed by those companies’ policies. We do not provide personal information to third parties except where the law requires it.

Our pages link to X, Telegram, and LinkedIn. Their privacy policies apply when you visit them.

6. Your rights

You can view or correct your profile, sign out sessions, disconnect Google Drive, see your agreement record, and delete your account in Settings › Account › Delete account on the web app, Mac, iPhone, or iPad at any time. Vaults you own move to trash and are erased after 30 days; other members lose access. Memberships in other vaults are removed, Drive connections are disconnected and tokens revoked, and agent working copies are erased. You may also email the privacy officer, roy@thegram.one, to request access, correction, deletion, or suspension; we respond within 10 days. If you have no account, tell us the email address you used or roughly when you contacted us so we can find the information.

7. Security

• Connections to our sites use HTTPS. Session tokens and email sign-in codes are stored as hashes.
• Active Vault data and backups created after the P3 rollout are encrypted at rest with AES-256-GCM. Earlier backups and old node-disk/PVC copies have not all been erased; this does not mean all historical copies are encrypted.
• Vault content is decrypted in server memory and tmpfs while Core and MCP process it. This is at-rest encryption, not end-to-end encryption; the running service can access plaintext.
• The key-encryption key is held in a cluster Secret and a copy on the operator’s Mac, not an external KMS. This does not protect against theft of an entire node disk or access to a running server.
• Vault MCP agent access is scoped per OAuth client_id as none, read, write or delete. Each client’s first connection defaults to write for a Thegram Vault the user owns; other Vaults default to none. Vault access is subject to the user grant and Vault role. Personal Google Drive access is controlled by a separate setting.
• Only the people who run Thegram can access logs and support email.

8. Cookies

thegram.one does not use cookies, and neither does the web app while you are signed out. When you sign in, the web app sets a cookie that keeps you signed in and a short-lived cookie used only during sign-in. We do not use advertising or analytics cookies. Visit counts use no cookies or other storage in your browser; if your browser or a content blocker blocks thegram.one/api/visit, your visit is not counted.

9. Children

You must be at least 14 years old to create an account. At sign-up we ask for your date of birth only to confirm this. We do not store it; we keep only the fact that the check passed and when. If you are under 14, the account and everything entered for it are deleted at once and we collect nothing further. If you believe a child under 14 has sent us personal information, contact us and we will delete it.

If you leave without finishing sign-up, we immediately delete the sign-in account and record. Accounts that never finish sign-up and hold no vault, vault membership or Drive connection are automatically deleted once 7 days have passed.

10. Contact and help

For help with a privacy complaint in Korea, you can also contact:

• Personal Information Dispute Mediation Committee: 1833-6972, www.kopico.go.kr
• Personal Information Infringement Report Center (KISA): 118, privacy.kisa.or.kr
• Supreme Prosecutors’ Office: 1301, www.spo.go.kr
• Korean National Police Agency: 182, ecrm.police.go.kr

11. Changes to this policy

Changes that disadvantage you will be posted at least 7 days before they take effect. Other changes take effect when posted. Previous versions stay readable: October 12, 2026 and October 11, 2026; the signed-in web app keeps every version of its separate policy at its own address (from October 23, 2026: October 23, 2026, which states the same count-based backup retention as this page).

Change note: This version clarifies offline use and automatic Vault/Drive sync, active-storage encryption and server plaintext processing, historical backup and disk remnants, count-based backup retention and upload failures, and per-client Vault MCP permissions.