Privacy Policy

1. Introduction & Scope

Haechon Electronics Co., Ltd. ("we", "us", "our", or "the Company"), operating the mobile application HEXA (the "App" or "Service"), is committed to protecting your privacy. This Privacy Policy explains what personal information we collect, how we use it, and the choices you have regarding your data.

This policy applies to all users of HEXA worldwide, regardless of country of residence. By creating an account or using the App, you acknowledge that you have read and understood this Privacy Policy and agree to the practices described herein.

HEXA is a social matching and dating application that uses traditional East Asian philosophy (Saju, Bazi, etc.) as one factor in its matching algorithm. The App is available globally and may be subject to additional local privacy requirements depending on your jurisdiction.

2. Information We Collect

2.1 Information You Provide Directly

• Phone number: Used for account verification via SMS OTP (one-time password) authentication.
• Nickname & display name: The name visible to other users.
• Gender & gender preference: Your gender and the gender(s) you wish to match with.
• Date of birth, birth time, and birth location: Used to calculate Saju/Bazi compatibility scores. Birth time may be set to "Unknown" if not available.
• Profile photos: Images you upload for your dating profile.
• Posts and short videos: Content you create and share within the App.
• Bio and interests: Free-text description and selected interest tags.
• Recovery email: Optional email address for account recovery.
• Blocked contacts: Phone numbers from your contact list that you choose to block from seeing your profile.

2.2 Information Collected Automatically

• Location data: Approximate location (city-level) for proximity-based matching. Precise GPS coordinates may be used with your permission for distance calculation only.
• Device information: Device model, operating system version, unique device identifiers, language settings, and timezone.
• Usage data: App interaction logs, swipe actions, chat activity, session duration, and feature usage statistics.
• Crash and performance data: Anonymous crash reports and performance metrics via Firebase Crashlytics.

2.3 Information from Third Parties

• Contact list (opt-in only): With your explicit permission, we access your phone contacts solely to let you block specific people from discovering your profile. Contact data is never used for advertising or shared with third parties.

3. How We Use Your Information

• Account creation & authentication: Verifying your identity via SMS and managing your account.
• Matching: Calculating compatibility scores and suggesting potential matches based on Saju/Bazi data, location, and preferences.
• Communication: Enabling chat, likes, and match notifications between matched users.
• Content display: Showing your profile, posts, and photos to other users.
• Safety & moderation: Detecting fraudulent accounts, harassment, spam, and prohibited content.
• Point system: Tracking earned points through app activities (login, likes, chats, matches) and maintaining point balances.
• Advertising: Displaying ads via Google AdMob and measuring ad performance.
• Service improvement: Analyzing usage patterns to improve features, matching algorithms, and user experience.
• Legal compliance: Responding to legal requests and preventing misuse of the Service.

4. Information Sharing & Third Parties

We do not sell your personal information. We share data only in the following circumstances:

• Other users: Your nickname, age, gender, profile photos, posts, bio, and approximate location are visible to other users for matching purposes. Your phone number, exact birth date, and birth time are never shown to other users.
• Service providers: We use third-party services that process data on our behalf (see Section 5 & 7 for details).
• Legal requirements: When required by law, court order, or government authority, or to protect the rights, safety, or property of our users or the Company.
• Business transfers: In the event of a merger, acquisition, or asset sale, user data may be transferred subject to the protections of this policy.

5. Advertising (Google AdMob)

HEXA displays advertisements through Google AdMob. AdMob may collect device identifiers and usage data to serve relevant ads and measure ad performance. Google's use of advertising cookies is subject to Google's Privacy Policy and advertising policies.

• Banner ads are displayed on login, signup, and various in-app pages.
• Native ads are integrated into content feeds.
• Interstitial (full-screen) ads may appear at natural transition points.

You can opt out of personalized advertising by adjusting your device settings (Google Settings → Ads → Opt out of Ads Personalization on Android; Settings → Privacy → Tracking on iOS). See Google's Advertising Privacy Policy for more information.

6. Point System Data

HEXA features a point reward system. The following data is collected and stored:

• Total points balance: Your cumulative earned points.
• Point history: Records of each point-earning activity, including activity type, points awarded, and timestamp.
• Daily earning limit: A maximum of 100 points per day per user to prevent abuse.

Points have no cash value at this time. The withdrawal feature is not yet available and is displayed as "Coming Soon" in the App. When withdrawal becomes available, additional terms and identity verification will be required, and this policy will be updated accordingly.

7. Cookies & Tracking Technologies

The App does not use browser cookies. However, we and our third-party partners (Google AdMob, Firebase Analytics) use device identifiers and SDK-based tracking to:

• Serve and measure advertisements.
• Collect crash and analytics data.
• Remember login sessions for convenience.

You can manage tracking preferences through your device operating system settings.

8. Data Retention

We retain your data for as long as your account is active. If you delete your account:

• Profile data (photos, posts, bio) is deleted within 30 days.
• Chat messages are deleted within 30 days.
• Matching and swipe data is deleted within 30 days.
• Point data (balance and history) is deleted within 30 days.
• Phone number is retained for 90 days to prevent immediate re-registration abuse, then permanently deleted.
• Legal records may be retained longer if required by applicable law.

9. Data Security

We implement industry-standard security measures to protect your data:

• Encryption in transit: All API calls use HTTPS/TLS encryption.
• Authentication: Firebase Authentication with SMS OTP verification.
• Database security: Supabase with Row Level Security (RLS) ensuring users can only access their own data.
• Access control: Internal access is restricted to authorized personnel only.

No method of transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

10. Your Privacy Rights

Depending on your jurisdiction, you may have the following rights:

10.1 GDPR (European Economic Area & UK)

• Right of access: Request a copy of your personal data.
• Right to rectification: Correct inaccurate or incomplete data.
• Right to erasure ("Right to be forgotten"): Request deletion of your data.
• Right to restrict processing: Limit how we process your data.
• Right to data portability: Receive your data in a machine-readable format.
• Right to object: Object to processing based on legitimate interests.
• Right to withdraw consent: Withdraw consent at any time.

To exercise GDPR rights, contact us at privacy@haechon.one. You may also lodge a complaint with your local data protection authority.

10.2 CCPA / CPRA (California, USA)

• Right to know: What personal information we collect and how it is used.
• Right to delete: Request deletion of your personal information.
• Right to opt-out of sale: We do not sell personal information.
• Right to non-discrimination: Equal service regardless of exercising rights.

To submit a CCPA request, email privacy@haechon.one.

10.3 Other Jurisdictions

• Korea (PIPA): Request data access, correction, or deletion per the Personal Information Protection Act.
• Japan (APPI): Request disclosure, correction, or cessation of use per the Act on the Protection of Personal Information.
• Other regions: Contact us to exercise applicable rights in your jurisdiction.

10.4 Account Deletion

You can delete your account at any time within the App (Settings → Delete Account) or by emailing privacy@haechon.one. Account deletion is irreversible.

11. Children's Privacy

12. International Data Transfers

HEXA is a global service. Your data may be processed and stored in servers located outside your country of residence, including but not limited to:

• Google Firebase: Authentication, analytics, and crash reporting (servers in the US and EU).
• Supabase: User profiles, matching data, chat, and point system (servers in the US, EU, or Asia-Pacific).
• Google AdMob: Advertising services (servers globally).

For users in the EEA/UK, we rely on Standard Contractual Clauses (SCCs) or other valid transfer mechanisms to ensure appropriate safeguards for international data transfers.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of material changes via in-app notification or email at least 30 days before the changes take effect. The "Last updated" date at the top of this page indicates the most recent revision.

Continued use of the App after the effective date constitutes acceptance of the updated policy.

14. Contact Us