Privacy Policy

Effective date: 2026-04-14

ClubX is a mobile service that helps university clubs and student organizations run events, manage memberships, chat, share photos and tickets, and coordinate peer-to-peer settlements between members. This Privacy Policy describes what personal information ClubX collects, why we collect it, how long we keep it, with whom we share it, and the choices you have.

1. Scope of This Policy

This Privacy Policy applies to the ClubX mobile application (iOS and Android), the associated backend services, and any related support channels (collectively, the "Service"). The Service is operated by the ClubX team (the "Operator", "we", "us"). This Policy is drafted to comply with the Personal Information Protection Act of the Republic of Korea (PIPA), the Act on Promotion of Information and Communications Network Utilization and Information Protection, and Apple App Store and Google Play policies.

2. Personal Information We Collect

We collect the minimum personal information necessary to provide the Service. Categories are grouped below by the moment of collection.

At account creation (required)

Username, legal name, email address, password (stored only as a salted hash, never in plain text), and agreement records for these Terms and this Privacy Policy, including the timestamp of agreement.

During profile completion (optional)

Profile image (JPEG, PNG, WebP, or GIF; up to 5 MB), nationality, and gender. You may leave these blank and still use the Service.

When joining a club that requires verification

Student ID or equivalent affiliation identifier, supplied at the time you request to join a specific club. Club administrators review this information to approve or reject your membership request. ClubX itself does not verify student IDs against any external registry.

When you register a settlement account

Bank name, bank account number, and account holder name. This information is used only to display your account details to other users inside peer-to-peer settlement flows and to pre-fill deep links into external payment apps (Toss, KakaoPay). It is never transmitted to any payment processor by ClubX.

When you use chat or create events

Message content (text and image attachments), payment request metadata (amount, participants, status), event posters, event titles, descriptions, times, and event locations (including latitude and longitude you enter when creating an event).

Automatically collected

Expo push notification token (if you grant notification permission), device model and OS version for crash diagnostics, IP address and request timestamps in server access logs, and app version. A refresh token and short-lived access token are stored on-device in secure storage to keep you signed in.

Location data

Approximate device location (while the app is in use only) when you open event discovery features that display nearby events or sort by distance. Precise location is not stored on our servers; it is used ephemerally on your device and discarded.

Camera data

The camera is activated only when you tap a scan action (event check-in, group invite). The camera feed is processed locally on-device to decode the QR or barcode. No raw images or video frames are uploaded to our servers.

3. Purpose of Processing

Your personal information is processed only for the purposes listed below. We will not use it for any other purpose without obtaining your separate consent.

Creating and authenticating your account and keeping you signed in across sessions.
Displaying your profile (username, image, and, if provided, nationality) to members of clubs and chat rooms you have joined.
Enabling club administrators to review membership applications and verify affiliation.
Delivering chat messages, event updates, friend-request notifications, and payment-status updates through push notifications you have opted into.
Generating rotating CODE128 barcodes (OnePass) that serve as your event entry ticket, and recording check-in timestamps when an administrator scans your pass.
Facilitating peer-to-peer settlement between users through deep links to Toss and KakaoPay; ClubX displays amounts and statuses only and does not process funds.
Preventing abuse, investigating reports of prohibited content or conduct, and enforcing our Terms of Service.
Complying with legal obligations (tax, accounting, law-enforcement cooperation under valid orders).
Diagnosing crashes and improving reliability using aggregated, non-identifying technical metrics.

4. Legal Basis

We process personal information under the following legal bases defined by PIPA and, where applicable, the GDPR: (a) your informed consent, given at sign up and, separately, before we send marketing messages; (b) performance of the contract between you and ClubX (the Terms of Service); (c) compliance with legal obligations; and (d) our legitimate interests in securing the Service and preventing abuse, provided those interests are not overridden by your fundamental rights.

5. Retention and Deletion

While your account is active

We retain your profile, messages, event registrations, and settlement records for as long as your account exists, so the Service can function.

When you delete your account

You can delete your account at any time from Settings → Delete Account. Upon deletion, we remove personal identifiers (username, email, legal name, profile image, nationality, gender, student ID, bank information, push token) within 30 days. Messages you sent in group chats are replaced with an anonymized placeholder and an "Unknown User" label instead of being hard-deleted, to preserve conversation context for other participants.

Records retained for legal reasons

Payment-related event records (amount, timestamps, bank account last four digits) are retained for five years to comply with the Commercial Act of Korea and electronic-finance record-keeping obligations. Server access logs are retained for up to three months for security analysis, then deleted.

Backups

Personal data may persist in encrypted backups for up to 30 days after deletion from the primary database, after which backups are overwritten in the normal rotation.

6. Third-Party Sharing and Processors

We do not sell personal information. We share information with the following processors and service providers solely to operate the Service. Each processor is bound by a data-processing agreement and limited to the purposes below.

Railway (infrastructure)

Hosts our backend application. Receives all information you submit to the Service.

Supabase (database)

Hosts our primary PostgreSQL database. Data is stored in the region configured for our project.

Expo (push notifications)

Delivers push notifications through the Expo Push Notification Service, which relays to Apple Push Notification service (APNs) and Firebase Cloud Messaging (FCM). The push token and notification payload (title, body, deep-link data) are transmitted.

Naver Cloud Platform (maps)

Renders map tiles and geocodes event locations inside the app. Receives map view coordinates and event location strings. Naver does not receive your account identifiers.

Google Places (geocoding)

When you search for an event venue, your query text is sent to Google Places to retrieve matching locations. Google does not receive your account identifiers.

Apple / Google (app distribution)

Receive crash diagnostics and app update delivery telemetry under each store's own privacy policy.

Toss and KakaoPay (deep links)

When you tap "Open Toss" or "Open KakaoPay" inside a settlement flow, the app launches the external payment app with the amount and recipient bank information pre-filled. The payment itself occurs entirely within the external app under that provider's privacy policy. ClubX does not transmit your credentials or financial account data to those providers.

7. Overseas Transfer

Expo Push Notification Service and its downstream providers (Apple APNs in the United States, Google FCM in the United States) operate servers outside the Republic of Korea. By using notifications, you consent to the transfer of your push token and the notification payload to those servers. You may revoke this consent at any time by disabling notifications in Settings or in your device settings.

8. Security Measures

Passwords are stored as salted, iterated hashes (bcrypt); we cannot recover your plain-text password.
All network traffic between the app and the backend uses HTTPS/TLS 1.2 or higher.
Access to the production database is restricted to authorized operators and protected by multi-factor authentication.
Uploaded files are validated for type (JPEG, PNG, WebP, GIF) and size (5 MB limit); their real content type is verified via magic-byte sniffing to block executable or MIME-spoofed uploads.
Access and refresh tokens stored on-device are scoped to the app sandbox and invalidated at logout or account deletion. Logged-out access tokens are revoked server-side via a token blacklist.
We monitor unusual login patterns and notify you of material security incidents as required by PIPA.

9. Your Rights

Under PIPA, and where applicable the GDPR and CCPA, you have the following rights with respect to your personal information.

Access — request a copy of the personal information we hold about you.
Correction — update information that is inaccurate or incomplete (directly via Edit Profile, or by contacting us).
Deletion — delete your account and associated personal identifiers (Settings → Delete Account).
Restriction — ask us to pause processing while a dispute is being resolved.
Withdrawal of consent — disable notifications or revoke location/camera permissions at any time; doing so may limit related features.
Objection — object to processing based on legitimate interests.
Portability — request export of the information you provided in a structured, machine-readable format.
Lodging a complaint — file a complaint with the Personal Information Protection Commission of Korea (privacy.go.kr) or your local supervisory authority.

10. Children

The Service is intended for users aged 14 and older. We do not knowingly collect personal information from children under 14. If you are a parent or guardian and believe your child has created an account, please contact us and we will remove the account.

11. Automatic Data-Collection Tools

The Service does not use advertising identifiers, third-party advertising SDKs, or cross-site tracking. We do not embed analytics providers such as Firebase Analytics, Mixpanel, or Amplitude at this time. If we add analytics tooling in the future, we will update this Policy in advance and, where required, request your consent.

12. Data Breach Notification

If we become aware of a personal-information breach that is likely to result in harm to you, we will notify you in the app and by email within 72 hours, describe the nature of the breach and the categories of data affected, the measures we have taken, and the steps you can take. We will also notify the Personal Information Protection Commission of Korea when required by law.

13. Data Protection Contact

For any privacy-related inquiries, to exercise your rights, or to report a suspected incident, contact the ClubX Data Protection contact listed below. We will respond within 10 business days.

14. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes (such as adding a new category of collected data or a new processor) will be announced inside the app at least 7 days before the effective date, or 30 days in advance if the change is materially unfavorable to you. The effective date at the top of this page always reflects the latest version.

Contact

hi.danleedev@gmail.com