PRIVACY

Privacy Policy

Effective 2026-11-07

This is the version effective 2026-11-07.It takes effect on 2026-11-07 (announced 2026-10-07). See the current version

This is an English translation of the Korean privacy policy. Where the two differ, the Korean version prevails to the extent permitted by the law that applies to you.

In short

Nawi (sole proprietor Gidong Lee, “we”) runs Five Seats and processes the personal information below. The core of it is your email address, the name you choose to show, what you say in your room, and who reached out to whom and when. We do not collect your location, contacts or advertising identifier. Your IP address is used only in irreversible form to prevent sign-in abuse, andunder the Protection of Communications Secrets Act the original is kept locked (encrypted) for 3 monthsas an access record (section 1, Communication records). Message contents are not part of that record.

We do not sell or hand over your personal information. We only entrust the work needed to run the service to outside providers (section 4), with the only other exceptions being requests made through legal procedures (section 4, “When we give information to others”).

1. What we process, why, and for how long

Account

Email address — to sign you in and confirm it is you. Kept until you delete your account.
Display name — starts as the part of your email before the @, and you can change it any time. Kept until you delete your account.
The record that you confirmed “I am 14 or older and agree to the Terms” when signing up (the version of the terms and the time) — to prove consent. Kept until you delete your account.

Room

Which room you belong to, your seat colour, and when you took that seat
Days together — counted from when the room was made, shown as one number inside the big balloon number, the same for everyone in the room. The days counted from when you took your seat appear only to you, in the “leave the room” confirmation.
The room light (from app 1.0.2) — whether the lamp in the room is on and when it turns itself off. It is a room-level state; we do not record who turned it on or off. It turns off half a day after being turned on and is deleted by the next nightly clean-up.
When you last opened the app and when you last spoke — used to show who is “here now” in the room
When you last opened the chat — used only to decide whether a message has been seen by everyone, which sets when it disappears. It is not shown to anyone.

Kept until you leave the room or delete your account.

Room codes

The code the inviting person creates and when it was created. The code is passed on in person and typed in by the invitee, so we collect nothing about the invitee in advance. A code works for 10 minutes. Used or expired codes are deleted within a day.
Inviting by email address was removed on 16 September 2026, and all email invitation records left from before were deleted that day.

Messages and nudges

What you say in the room and when you sent it. We use message content only to show it to the people in your room — we do not read it except when reviewing a report (see “Reports”). Kept until one day after everyone in the room has opened the chat after that message, and no longer than 7 days after it was sent.
When a message was seen by everyone in the room — used only to decide when to delete it. Who read what and when is never shown anywhere. Kept as long as the message.
Who reached out to whom and when. We also record whether the recipient saw that trace on screen, but this is never returned to the sender — it only stops the same trace being shown twice. Kept until you leave the room or delete your account.

Customisation and purchases

The jelly shape and accessory you chose — to draw them on the screens of people in your room. Kept until you leave the room or delete your account.
Today’s mood (such as sleepy, excited, blank or busy; from app 1.0.2) — to draw it on the screens of people in your room. Kept until midnight of the day you chose it (your time zone); then it leaves the screen and is deleted by the next nightly clean-up.
Pranks (from app 1.0.2, available from 5 November 2026) — putting one of a fixed set of pictures (mustache, blush, squid ink, smoke, vanish) on a friend’s jelly for a day. We store only two things. ① On the pranked person: what is on their jelly and when it wears off — to draw it on the screens of people in the room. It leaves the screen after a day or when they remove it, and is deleted by the next nightly clean-up.② On the person who played it: whether they played one that day (one a day) — deleted by the nightly clean-up after that day. We never record who pranked whom — not even we can tell. No text can be added.
Items you can use — so we can give them back when you change devices or reinstall. Kept until you delete your account. If, after deleting your account, you sign up again with the same Apple account (iPhone) or the same Google account (Android) and restore purchases, we check the remaining purchase record (below), make the item usable on the new account, and move that record’s account link to the new account.
Purchase records — the transaction number issued by Apple (iPhone) or the order number and purchase token issued by Google (Android), the product, the time of purchase, the payment platform, the payment environment (a real purchase or an Apple or Google test purchase), the time of any refund or cancellation, and your account identifier. Used to confirm purchases and handle withdrawals and disputes. Kept for 5 years from the date of purchase (section 3), even after you delete your account.
Your card number and payment details never reach us — Apple (iPhone) or Google (Android) takes the payment.

Room name and background photo

The room name, and who changed it and when. Kept until the room is gone.
Background photo — visible only to people in the same room. When you pick a photo, it is resized on your device before upload, which strips the location and device information (EXIF). Deleted as soon as a new photo is set or the photo is taken down, and together with the room when the room is gone. Photos are kept in the same database as our other records (section 4).

Blocking

The email address of someone you blocked and when — so you are never seated in or invited to the same room. Kept until you unblock them or delete your account.

Sign-in and devices

Sign-in codes — stored only in a form that cannot be reversed. A code works for 10 minutes. Expired records are deleted within a day.
IP address, for sign-in abuse prevention — turned into an irreversible value and used only to count whether too many sign-in codes are requested from one place. Kept as long as the sign-in code. (The original IP is kept, locked, only in the Communication records below.)
Sessions — a transformed value, not the original, and part of the browser type (User-Agent) that created it. Kept for 30 days from last use; expired records are deleted within a day.
App notifications (from app 1.0.2, only if you allow notifications) — the token of the device that receives them (a value Apple gives each iPhone, or Google gives each Android device) and your notification settings (instant, once a day or off, and the tone of the wording). Used to tell you a friend has sent a message. A notification contains only the sender’s display name and never the message contents. Deleted as soon as you turn notifications off, sign out or delete your account, or when Apple or Google tells us the token can no longer be used.
Web notifications are not turned on, so we do not receive push addresses. If we turn them on, we will add them here first.

Communication records (Protection of Communications Secrets Act)

As a value-added telecommunications service, Five Seats must cooperate with lawful requests from investigative authorities under Article 15-2 of the Korean Protection of Communications Secrets Act, and keeps the following communication confirmation data under Article 41 of its Enforcement Decree. Message contents are not included — room messages disappear as described above.

That a message, nudge or jelly flick (from app 1.0.2 — flicking your jelly so it rolls on everyone’s screen) was sent — the sender’s account identifier, the room, the account identifiers of the others in the room at that time, and the time. Nothing else is stored for a jelly flick (its direction and strength go to the screens in the room at that moment and are not kept). Kept for 12 months from sending.
The time of sign-ins, access and sending, with the original IP address at that time — the IP is locked (encrypted) with a separate key and opened only for a lawful request. Access is recorded at most once an hour per person and IP. Kept for 3 months.
If you delete your account, who that account identifier belonged to (your email address) — so the records above can still be attributed while they are kept. Kept for 12 months from deletion.
If we provide data to an authority, the register (requesting body, document number, legal basis, period, time provided) and the request — kept for 7 years from provision (Article 13(7) of the same Act).

These records are used only to respond to requests set by law and are not opened for running the service or any other purpose. We keep them from 1 November 2026.

Reports

The email addresses and account identifiers of the person reporting and the person reported, the reason, and anything you wrote
The room conversation at the time of the report (up to the latest 50 messages)
Who set the background photo shown at the time of the report, and when (the photo itself is not copied)

Used to review reports and prevent repeat harm. Kept for 1 year after review; a report nobody has reviewed is kept for 1 year after it was received.The chat copy includes only messages that were still on screen when you reported (messages that had already disappeared are not included).

If you delete your account, the link between the report and your account is removed. The author identifiers and messages captured as evidence, and the reported person’s email address, may remain until the report’s retention period ends — they are needed to handle the case. Payment and refund disputes are handled as inquiries, not reports, and kept separately under the rule below (3 years).

Restrictions

When an account was suspended and why — to stop accounts that broke the Terms and to handle appeals. Kept until the restriction is lifted, and deleted with the account.

Inquiries

Your email address and message — to answer you and handle disputes.
- General questions and suggestions — kept for 6 months after we finish handling them
- Consumer complaints and disputes (including payment and refund disputes) — kept for 3 years after we finish handling them (records required by the Korean Act on Consumer Protection in Electronic Commerce, section 3)

2. What we do not collect

Location, address book or contacts, advertising identifier, device serial numbers, microphone, or your activity on other services. We do not show ads and do not include third-party tracking tools. We read only the single photo you pick as a background from your photo library.

We do not collect unique identifiers such as national ID numbers, or sensitive information such as health or beliefs, and we do not create or process pseudonymised information.

3. Legal basis and retention required by law

The processing above is done to the extent necessary to perform the service contract you enter into when you sign up (Korean Personal Information Protection Act, Article 15(1)(4)). Report records and rate limits are kept to run the service safely (same paragraph, item 6). Communication records are processed because a law specifically requires it (same paragraph, item 2; Protection of Communications Secrets Act, Article 15-2, and its Enforcement Decree, Article 41).

The following are kept separately as required by law even after you delete your account, and used for nothing else.

Contract, withdrawal, payment and supply records (the purchase records above) — 5 years (Korean Act on Consumer Protection in Electronic Commerce, Article 6, and its Enforcement Decree, Article 6)
Consumer complaint and dispute records (inquiries above that are complaints or disputes) — 3 years (same provisions)
Communication records (section 1) — messages, nudges and jelly flicks sent 12 months, sign-in and access times with IP 3 months, identification of deleted accounts 12 months (Enforcement Decree of the Protection of Communications Secrets Act, Article 41), provision register 7 years (Article 13(7) of the Act)

We do not use your information for advertising, profiling, sale to others, or model training.

4. Service providers, international transfers, and disclosure

We entrust the following work to outside providers to run the service. Transfers to providers abroad are processing and storage necessary to perform the service contract, and are made by disclosing them in this policy (Korean Personal Information Protection Act, Article 28-8(1)(3)(a)). Under each provider’s data processing terms, they may not use the information for anything other than the work entrusted.

Cloudflare — running the service, storing data, forwarding support email

Recipient — Cloudflare, Inc. (privacy contact: dpo@cloudflare.com)
Countries — United States (headquarters, operations and support). Where data is actually stored and processed:
- Database (account, room, messages, background photos, purchase records and most items in section 1) — we set its storage region to Cloudflare’s Asia-Pacific region, and the location we observe in operation is Cloudflare’s data centre in Incheon, South Korea. This is what we observe: Cloudflare does not disclose or guarantee the country or city of the database. We check the location every day and will update this policy if we learn it has moved outside South Korea.
- Real-time connections (a signal that a room has news) — each room’s connection point is created in a data centre near the first person who connects (usually South Korea when used from South Korea). While connected it handles only your account identifier; message contents do not pass through it and connection logs are not kept. Cloudflare does not guarantee the exact location.
- Request handling — the data centre nearest to you. From South Korea this is usually in South Korea.
- Forwarding support email — email sent to our support address passes through Cloudflare and is forwarded to the mailbox listed under providers in South Korea below. Cloudflare does not disclose where it is processed while being forwarded.
Under Cloudflare’s data processing terms, this information may be processed in the countries where Cloudflare has data centres (list: cloudflare.com/network).
Items transferred — everything in section 1 (support email only while being forwarded)
When and how — sent over an encrypted network and stored each time you use the service.
Retention — the same as section 1, except that deleted data can remain in database recovery records for up to 30 days before it is gone. Recovery records are used only to restore the database after a failure.

Resend — sending sign-in code emails

Recipient — Plus Five Five, Inc. (service name Resend, privacy contact: support@resend.com)
Countries — United States (storage and main processing), Japan (sending servers in Tokyo — used only as a route, not for storage)
Items transferred — the recipient’s email address and the email content (the sign-in code)
When and how — sent over an encrypted network each time a sign-in code is sent.
Retention — sending logs are kept for 30 days and then deleted, and remain in backups for 7 more days. They are gone from Resend at most 37 days after sending.

Apple — delivering app notifications (from app 1.0.2)

Recipient — Apple Inc. (Apple Push Notification service)
Country — United States
Items transferred — the receiving device’s token and the notification wording (the sender’s display name; message contents are never sent)
When and how — sent over an encrypted network each time we send a notification.
Retention — if the device is off, Apple keeps the notification until the expiry we set (one day) and then discards it.

Google — delivering Android app notifications

Recipient — Google LLC (Firebase Cloud Messaging)
Country — the United States and other countries where Google has data centres. Google does not fix where this service processes data and states it may process it in any of its data centres.
Items transferred — the receiving device’s token, an identifier Firebase creates for each app installation (Firebase installation ID), and the notification wording (the sender’s display name; message contents are never sent)
When and how — sent over an encrypted network when you allow notifications and each time we send one.
Retention — if the device is off, the notification is kept until the expiry we set (one day) and then discarded. We ask Google to delete the Firebase installation ID when you turn notifications off, sign out or delete your account, and Google deletes it, including from backups, within 180 days of the request.

Providers in South Korea

NAVER Corp. — the mailbox that receives and stores support email (support@five-seats.com)

If you do not want your data transferred

The service cannot run without these providers. Before signing up, you can simply not use it; after signing up, you can delete your account in settings or ask us at the support address. Transfers then stop, and stored information is deleted according to the retention periods above and the legal retention rules in section 3. If you refuse a required transfer, we cannot provide the service. If a provider changes, we will say so in this document before the change.

A separate note — payments by Apple and Google

When you buy something in the app, Apple takes the payment on iPhone and Google (Google Play) on Android. We receive back only what was bought, the transaction number (for Google, the order number and purchase token) and the time of purchase. Who paid and with which card never reaches us. To check that an Android purchase is genuine and whether it was refunded or cancelled, we ask Google about the purchase token Google gave us, and Google tells our server directly about refunds and cancellations. No personal information beyond what Google already has is passed on in doing so.

When we give information to others

Apart from the providers above, we give your personal information to no one. The only exceptions are:

When you have separately agreed in advance
When an investigative authority or court requires it through a procedure set by law (including requests for communication confirmation data under the Protection of Communications Secrets Act; we record each provision in a register kept for 7 years), such as a warrant — we give only the minimum within what was requested. As a rule we do not provide records deleted after their retention period. Recovery records (up to 30 days, above) are used only to fix failures; we may use them only to the extent of a request we are legally bound to follow, such as a court order, made within that period.
When there is an urgent danger to someone’s life or body, protection is needed, and consent cannot be obtained (Korean Personal Information Protection Act, Article 18(2)(3))

5. How information is deleted

Personal information whose retention period has ended or whose purpose is fulfilled is deleted without delay.The following happen automatically, without a request.

When you delete your account — your account, messages you left, nudge records, sessions, sign-in codes, usable items, block list and consent record are deleted together. This cannot be undone. A room you created stays if others are still in it.
When the last person leaves a room — the room, its messages and its background photo are deleted together.
When a period ends — a clean-up job runs every day at 3 a.m. Korean time and deletes expired messages, sign-in codes, sessions, room codes, reports and purchase records. A message that has reached its time disappears from the screen and downloads immediately, and the record is deleted by the next clean-up.

How a room message disappears: (1) when its time comes, it leaves the chat and downloads at once and no one can see it again; (2) the next nightly clean-up deletes it from the database; (3) it may then stay in recovery records for up to 30 days (used only to recover from failures). As an exception, a message reported before it disappeared stays in the report copy for the report retention period (section 1, Reports).

Deletion means removing the record itself from the database, and files such as photos are removed from storage. Data may remain in database recovery records and providers’ backups for the extra periods listed in section 4. We keep no personal information on paper.

What remains after you delete your account

Purchase records — 5 years as required by law (section 3). Deleting your account does not cancel or refund a purchase — please ask for a refund through the withdrawal procedure in the Terms. If you sign up again with the same Apple account and restore purchases, the item can be used again through this record (section 1).
Communication records — messages, nudges and jelly flicks sent 12 months, sign-in and access times with IP 3 months, who you were (email) 12 months from deletion (section 1)
Reports you made — your identity is removed; the content is kept for the report retention period
Your messages and email address inside reports made by others — for that report’s retention period
Your email address in other people’s block lists — until they unblock you or delete their account
Messages you left before leaving a room, if they had not yet disappeared — they stay in the room until they disappear (the conversation belongs to the others too). They are deleted when you delete your account.

6. Your rights and how to use them

You can ask at any time to access, correct, delete or stop the processing of your personal information, and withdraw consent. You can also do this through a legal representative or someone you authorise.

Download (access) — sign in on the web (five-seats.com) and download your account, room, messages, nudges and block records as JSON from settings. The apps (iPhone and Android) do not have this yet; ask at the address below and we will send it.
Delete — you can delete your account in the app and web settings (section 5).
Correct — you can change your name and seat colour in settings at any time.
For anything else, write to the address below.

We handle requests within 10 days, or tell you why if the law does not allow part of it. If you ask through a representative, please include a power of attorney.

While a correction is pending, we do not use or share that information.
Information we must keep by law (such as the purchase records in section 3) cannot be deleted before that period ends even if you ask, and is kept apart so it is not used for anything else.

7. Cookies and similar technologies

Web — one cookie keeps you signed in (fs_session). Scripts cannot read it and it lasts 30 days. Your chosen tone and colours are kept only in browser storage (fs-tone, fs-skin) and are not sent to our server.
Apps (iPhone and Android) — sign-in information and display settings (tone, colours, whether you saw the guide) are kept in the device’s secure storage.
We do not use advertising, analytics or tracking cookies.
You can block cookies in your browser settings, but if you block the sign-in cookie you will not stay signed in and cannot use the service.

8. Security measures and their limits

Administrative

Only one operator handles personal information. Admin functions require a separate secret token.
We do not open conversations except to review reports.

Technical

All traffic is encrypted (HTTPS).
Sign-in codes and sessions are stored only in irreversible form. The original IP in communication records is encrypted with a separate key that only the operator opens for a lawful request.
Background photos are served only to people in the same room; requests from anyone else are refused.
Sign-in code requests and attempts are rate-limited to stop guessing.

Physical

We run no servers of our own. Data is stored in access-controlled data centres of our provider (Cloudflare, section 4), and we keep no personal information on paper.

However, messages in a room are not end-to-end encrypted — the service operator can technically access them. In practice we look only when reviewing a report.

We make no automated decisions that significantly affect you without human involvement.

9. Children under 14

People under 14 may not use the service. We ask you to confirm you are 14 or older when signing up, and we delete information without delay if we learn it belongs to someone under 14.

10. Privacy officer

The person below is responsible for handling personal information and your questions and complaints.

Privacy officer — 이기동
Contact — support@five-seats.com · +82 10-5918-9128

If you need more help with a privacy violation in South Korea, you can contact the Personal Information Infringement Report Center (118) or the Personal Information Dispute Mediation Committee (1833-6972). You may also contact the data protection authority in your own country.

11. Changes

We post changes on this page 7 days before they take effect. Changes that are unfavourable to you or important are announced 30 days in advance and also sent to your email. Earlier versions are kept for comparison.

Effective date of this version — 2026-11-07 (announced 2026-10-07, also sent to your email)

What changed from the previous version (2026-11-05)

We added the Android app. On Android, Google (Google Play) takes the payment, and purchase records now include Google’s order number and purchase token (section 1; section 4, ‘A separate note’).
Android app notifications are delivered through Google (Firebase Cloud Messaging), so Google is added to overseas transfers — the device token, the Firebase installation ID and the notification wording (sender’s name only, never message contents) (section 4).
Purchase restore, downloads and device storage are now described for both iPhone and Android.

See the previous version (2026-11-05) · See the version before that (2026-11-01) · See the 2026-10-08 version · See the first version (2026-09-22)

12. Contact

support@five-seats.com