Privacy Policy

Effective October 12, 2026

This policy explains what personal information Thegram (“we”) handles when you use thegram.one, the Thegram web viewer at viewer.thegram.one, the Thegram web app at vault.thegram.one, and the Thegram apps for Mac, iPhone, and iPad (the “Services”), and what you can ask us to do with it. We follow the Personal Information Protection Act of the Republic of Korea.

Operator: Hyunmin Kim (김현민)
Privacy officer: Hyunmin Kim (김현민), roy@thegram.one, +82 10-8000-2203

1. What we handle

The moving mark on our home page remembers its own path inside your browser tab to draw the animation. That record never leaves your browser and disappears when you close the tab.

The web viewer, and the web app while you are signed out, do not save your file on our servers, write it to logs, or create a link to it. The web viewer stores nothing in your browser. Whether or not you sign in, the web app keeps some things only in your browser and never sends them to us: display settings and language, panel layout, the titles of the last 8 documents you opened, and, if you choose a folder on your device, the browser’s permission to open it again. Clearing the site’s data in your browser removes them.

Signed-in use, including Google Drive and the Google API Services User Data Policy, is described in detail in the web app privacy policy.

2. Why we use it

• To run the Services, show you the files you open, and keep your Vaults and Drive connections working.
• To keep the Services secure and investigate abuse.
• To count how many people visit thegram.one and download the Mac app. The counts are daily totals and cannot identify you.
• To answer your questions and requests, and to send sign-in codes and security notices from noreply@thegram.one. We do not send marketing email unless you ask for it.

We do not use personal information for advertising or profiling, and we do not use your files to train AI models.

3. How long we keep it

• Files opened while signed out: not kept. They are discarded once the response is sent.
• Account information and the record of which terms you agreed to: until you delete your account.
• Sessions and desktop devices: until the session ends or is revoked, at most 30 days.
• Vault documents and their history: while the Vault exists. A deleted Vault stays in the trash for 30 days and is then purged. Encrypted backups are kept for up to 14 days.
• Technical logs: up to 90 days, unless we need them longer to investigate a security incident or the law requires it.
• Visit and download counts: the daily totals are kept indefinitely and contain no personal information. The in-memory value used to recognize returning visitors is discarded at the end of each day (Korea time) or when the server restarts.
• Support emails: until your request is resolved, then up to 1 year, unless you ask us to delete them sooner or the law requires us to keep them longer.

4. How we delete it

When the retention period ends or the purpose is met, we delete the information without delay, using methods that prevent recovery.

5. Sharing

We do not sell personal information. We do not give it to third parties unless the law requires it, for example when a court or an investigative authority makes a lawful request.

We entrust the following processing to other companies:

• Plus Five Five, Inc. (Resend), USA, delivers sign-in code emails. It receives your email address and sign-in code message over an encrypted connection each time a code is emailed, to deliver it; it deletes them under its retention rules once delivered. You can avoid this transfer by signing in with Google or Apple.
• Google LLC, USA, stores encrypted backup archives of vault data (account records, vault documents, and Drive connection records) uploaded daily over an encrypted connection for disaster recovery. The operator alone holds the encryption key. Backups are kept 14 days; this transfer cannot be refused separately, and deleting your account removes its data from backups within 14 days.

These are transfers abroad under Article 28-8(1)(iii)(a) of the Personal Information Protection Act. For Plus Five Five, Inc. (Resend), USA (privacy contact: privacy@resend.com), the items transferred are your email address and sign-in code message, sent each time a code is emailed over an encrypted connection; the purpose is email delivery; retention is under Resend’s retention rules and the items are deleted once delivered. You may avoid this transfer by using Google or Apple sign-in. For Google LLC, USA (privacy contact: Google privacy form), the items are encrypted backup archives of vault data, including account records, vault documents, and Drive connection records; uploaded daily over an encrypted connection for disaster recovery and kept 14 days. This transfer cannot be refused separately; account deletion removes data from backups within 14 days.

Google and Apple sign-in, and Google Drive, are services you connect to directly and are governed by those companies’ policies. We do not provide personal information to third parties except where the law requires it.

Our pages link to X, Telegram, and LinkedIn. Their privacy policies apply when you visit them.

6. Your rights

You can view or correct your profile, sign out sessions, disconnect Google Drive, see your agreement record, and delete your account in Settings › Account › Delete account on the web app, Mac, iPhone, or iPad at any time. Vaults you own move to trash and are erased after 30 days; other members lose access. Memberships in other vaults are removed, Drive connections are disconnected and tokens revoked, and agent working copies are erased. You may also email the privacy officer, roy@thegram.one, to request access, correction, deletion, or suspension; we respond within 10 days. If you have no account, tell us the email address you used or roughly when you contacted us so we can find the information.

7. Security

• We collect as little as we can.
• Connections to our sites use HTTPS.
• Files opened in the web app while signed out stay in memory and are never stored.
• Sessions, device tokens, and email sign-in codes are stored only as hashes.
• Only the people who run Thegram can access logs and support email.

8. Cookies

thegram.one does not use cookies, and neither does the web app while you are signed out. When you sign in, the web app sets a cookie that keeps you signed in and a short-lived cookie used only during sign-in. We do not use advertising or analytics cookies. Visit counts use no cookies or other storage in your browser; if your browser or a content blocker blocks thegram.one/api/visit, your visit is not counted.

9. Children

You must be at least 14 years old to create an account. At sign-up we ask for your date of birth only to confirm this. We do not store it; we keep only the fact that the check passed and when. If you are under 14, the account and everything entered for it are deleted at once and we collect nothing further. If you believe a child under 14 has sent us personal information, contact us and we will delete it.

If you leave without finishing sign-up, we immediately delete the sign-in account and record. Accounts that never finish sign-up and hold no vault, vault membership or Drive connection are automatically deleted once 7 days have passed.

10. Contact and help

For help with a privacy complaint in Korea, you can also contact:

• Personal Information Dispute Mediation Committee: 1833-6972, www.kopico.go.kr
• Personal Information Infringement Report Center (KISA): 118, privacy.kisa.or.kr
• Supreme Prosecutors’ Office: 1301, www.spo.go.kr
• Korean National Police Agency: 182, ecrm.police.go.kr

11. Changes to this policy

Changes that disadvantage you will be posted at least 7 days before they take effect. Other changes take effect when posted. Previous versions stay readable: October 11, 2026; the signed-in web app keeps every version of its policy at its own address (for example its October 11, 2026 version).

Change note: This version identifies the operator and privacy officer, updates contact and account-deletion information, explains unfinished sign-up deletion and overseas transfers, and updates complaint remedies.