alike Privacy Policy

This Privacy Policy explains how JoCoding, Inc. ("we", "us", "our") collects, uses, and protects your personal data when you use alike (the "Service") — a two-person camera app where you pair with a friend, see each other live, and capture the same instant on a synchronized countdown, with both photos saved to a gallery shared only by the two of you.

Effective Date: July 10, 2026
Last Updated: July 10, 2026

For users in the Republic of Korea, the Korean version of this policy, drafted under the Personal Information Protection Act (PIPA), is the authoritative version.

1. Controller and Contact

Data Controller: JoCoding, Inc. (Representative: Donggeun Cho)
Address: 136 Yanghwa-ro, Mapo-gu, Seoul, Republic of Korea
Business Registration No. (KR): 641-17-01133
Email: highball@jocoding.net

2. Personal Data We Collect

Account data

Items: email address and sign-in identifier from Apple or Google, or a passkey public-key credential; a display name you choose.
Source: provided by you (or by your sign-in provider) at registration.

Data created by using the Service

Pair records (who you are paired with)
Photos you capture — end-to-end encrypted on your device before upload; we cannot view their contents
Your encryption public keys and an encrypted key backup protected by a recovery phrase that only you know
Push notification tokens (per device)
Live-request ("knock") and missed-call records

Automatically collected data

IP address, device information (OS, model), and service/access logs. We do not use cookies, advertising identifiers (ADID/IDFA), analytics trackers, or any behavioral-advertising technology.

Special categories of data

We do not process special categories of personal data. Your photos may contain faces, but they are encrypted on your device before storage so we cannot access their contents, and we do not process them for biometric identification. The app's expression-analysis feature runs entirely on-device, is currently inactive, and never transmits analysis data off your phone.

3. Purposes and Legal Bases

Account creation and management (identification and authentication, fraud prevention) — legal basis: performance of a contract (GDPR Art. 6(1)(b)).
Providing the Service (pairing, live video preview connection, synchronized capture, encrypted photo storage and sharing with your pair partner, push notifications such as live requests) — legal basis: performance of a contract (Art. 6(1)(b)).
Safety and security (access logs, rate-limiting of pair-code attempts) — legal basis: legitimate interests (Art. 6(1)(f)) in keeping the Service secure.

We do not use your data for marketing, advertising, profiling, or automated decision-making, and we do not sell it.

4. Recipients and Data Sharing

We do not share your personal data with third parties, except with the processors listed below and where required by law. Note that your display name, online status, and the photos you capture together are visible to your pair partner — that sharing is the core function of the Service.

We use the following processors:

Processor	Purpose	Location
Supabase, Inc.	Database, authentication, and storage hosting (data is stored in the Seoul, South Korea region)	United States (operator) / South Korea (data at rest)
Cloudflare, Inc.	Website hosting and live-video relay (TURN — relays encrypted streams only, stores nothing)	United States (global edge)
650 Industries, Inc. (Expo)	Push notification delivery	United States

5. International Transfers

Our Service is operated from the Republic of Korea, and photo/database storage is located in Seoul, South Korea. Transient processing by Cloudflare (encrypted live-video relay) and Expo (push delivery) occurs in the United States and on global edge networks. Where GDPR applies, transfers rely on the processors' EU Standard Contractual Clauses and, where applicable, EU–US Data Privacy Framework certification. The Republic of Korea benefits from an EU adequacy decision (Art. 45). Copies of applicable safeguards are available on request at highball@jocoding.net.

6. Retention

Account data — until you delete your account.
Encrypted photos and key backups — until you delete them or delete your account; deleting your account also removes photos shared with your pair partner.
Push tokens — until sign-out, account deletion, or token refresh.
Access logs — 3 months (Korean Protection of Communications Secrets Act).
Pair-code attempt records (rate limiting) — 1 hour.

After the retention period, data is deleted irreversibly.

7. Your Rights

Depending on your jurisdiction (including under GDPR Arts. 15–22 and Korean PIPA), you have the right to access, rectify, erase, restrict or object to the processing of your personal data, the right to data portability, and the right to withdraw consent at any time where consent is the basis. To exercise any right, email highball@jocoding.net or use the in-app settings screen (display-name change, account deletion). We respond within one month.

If you are in the EU/EEA, you may lodge a complaint with your local supervisory authority (https://edpb.europa.eu/about-edpb/about-edpb/members_en). In Korea, you may contact the Personal Information Dispute Mediation Committee (1833-6972, www.kopico.go.kr) or the KISA Privacy Center (118, privacy.kisa.or.kr).

8. Cookies and Tracking

We do not use cookies, trackers, or non-essential data-collection technologies — neither in the app nor on this website.

9. Security

End-to-end encryption of photos — photos are encrypted on your device; only the two members of a pair can decrypt them. We cannot.
Encryption in transit — all traffic uses TLS; live video uses DTLS-SRTP.
Access control — database row-level security restricts every record to you and your pair partner; photo storage is a private bucket accessed only via short-lived signed URLs.
Organizational measures — minimal personnel access, permission management, and access logging.

10. Children

The Service is not intended for children under 14 (Korea) or under 16 (EU/EEA), and we do not knowingly collect personal data from them. If we learn that such an account exists, we will delete it and its data without delay.

11. Changes to This Policy

We may update this Policy. Changes are announced at least 7 days before taking effect (30 days for material changes), via the Service or this website.

Revision History

2026-07-02 — Version 1 (initial pre-release version)
2026-07-10 — Full revision: end-to-end encrypted storage, live-video relay, push notifications, and international transfers reflected

This Privacy Policy takes effect on July 10, 2026.

This document is a reference draft, not legal advice; review by qualified counsel is required before production deployment.

alike — take a photo together, apart. Contact: highball@jocoding.net