allob
Privacy Policy
Version 1 · Effective: 2026-10-22
This is a past version of this document. See the current version
Summary
- What: account information (email), sign-in and access records, business information, connections to outside services and the business data fetched through them, product and bookkeeping records, encrypted items you keep in the vault, activity records, and support emails.
- Worth noting: allob also receives and stores usage events and payment notices from your products, and comments on social accounts you connect. We process this information on your instructions, and you, as the user who runs the product, inform those people through your own privacy policy.
- Why: sign-in, providing the service, tasks you ask us to run on outside services, notifications, security, and answering questions.
- Who and where: servers and storage Cloudflare, Inc. (United States), connection relay Oracle Corporation (Japan), support email NAVER Corp. (South Korea). We do not disclose personal data to third parties.
- Google and Meta: we use information from the Google and Meta accounts you connect only to show it to you and to carry out what you ask.
- How long: most data until you delete your account. Usage events are deleted 3 months after they are received, social comments 30 days after a reply or after they are fetched, and access logs within 7 days.
- Your rights: you can ask to access, correct, delete, or stop processing your data, and you can delete your account yourself in Account settings.
Controller and privacy contact
The controller of allob (https://allob.app) is winterlog studio ("we", "us"), and the privacy contact is our owner, Hyungu Kang. Send requests, questions, and complaints about this policy to the contact details below.
- Address: 5-12 Gwangmyeong-ro 347beon-gil, Jungwon-gu, Seongnam-si, Gyeonggi-do, Republic of Korea
- Phone: +82 10 9688 1157
- Email: support@allob.app
- Business registration number: 577-24-02412
Purposes and legal bases
We process personal data on the legal bases below, not on consent.
| Purpose | Data used | Legal basis |
|---|---|---|
| Sign-up, sign-in, and keeping you signed in (including CLI and agent device sign-in) | Account information, sign-in records | Performance of a contract (Personal Information Protection Act, Article 15(1)4) |
| Providing the service, such as products, boards, books, and legal document drafts | Account information, business information, fetched business data, products and records | Performance of a contract |
| Connecting outside services and running the tasks you ask for (fetching data, changing ads, publishing posts, generating images and videos) | Connection information, fetched business data, image and video requests | Performance of a contract |
| The vault | Vault items | Performance of a contract |
| Sign-in code and alert emails, and web push notifications | Account information, web push subscriptions | Performance of a contract |
| Processing data about the users of your products (receiving and totaling events and payment notices, passing payment events to the ad and analytics tools you turn on, showing social comments) | Data about the users of your products, social comments | Processing entrusted by you (Personal Information Protection Act, Article 26) — we act as your processor |
| Security (activity records, request limits, access logs) | Activity records, access logs | Legitimate interest: protecting accounts and the service from unauthorized access and abuse (Personal Information Protection Act, Article 15(1)6) |
| Answering questions | Support emails | Performance of a contract |
What we collect
| Data | Source |
|---|---|
| Account information (email address, sign-up and last sign-in time, display language setting) | You enter it when you sign up or sign in, and it is created as you use the service |
| Sign-in records (sign-in sessions, device name and country of access when you sign in a device) | Created automatically when you sign in |
| Business information (business name, owner name, business registration number, business address, public email and phone number, mail-order business number, D-U-N-S number) | You enter it |
| Connection information (connection tokens and API keys, ID, name, and email of the connected outside account) | Provided by the outside service when you connect it |
| Fetched business data (sales and payment totals, ad accounts, campaigns, ad creatives, ad spend and results, analytics reports, ad earnings, social posts, engagement stats, and comments with commenter names) | Fetched from the services you connect |
| Products and records (product details and event schemas, release and change records, progress records, bookkeeping records of sales, payouts, and expenses and tax filing materials, legal document drafts and published documents, email of the person who created a record) | You enter them, or they are created as you use the service |
| Vault items (encrypted signing keys and documents, passkey public keys and names) | You upload them |
| Image and video generation (request text, reference images, generated results) | You enter or upload them |
| Activity records (email, device name, country, and time of the person who acted, and what they did) | Created as you use the service |
| Web push subscriptions (browser push address, device name) | Created by your browser when you turn on notifications |
| Access logs (IP address, browser information, requested address, time) | Created automatically when you visit |
| Data about the users of your products (usage events, random device identifier, country, language, referral source, payment notices, and the IP address, browser information, and ad click markers sent along when passing events to ad and analytics tools) | Sent by your products and your payment services |
| Support emails (email address, message) | Emails you send us |
We use cookies to keep you signed in and to protect the process of connecting outside services. Both are necessary for the service, and if you clear them you will need to sign in again. The docs pages (allob.app/docs) load font files from jsDelivr, so opening the docs sends your IP address and browser information to jsDelivr.
Disclosure to third parties and connected services
We do not disclose personal data to third parties.
You can connect Google (Analytics, AdMob, Google Play), Apple (App Store Connect), RevenueCat, Meta (ads), Instagram, Threads, TikTok, Dodo Payments, and fal with your own accounts or keys. We use information received through these connections only to show it to you and to carry out what you ask, and we do not use it for advertising, sale, or AI training.
Tasks you ask for (turning ads on or off and changing budgets, publishing posts and replies, image and video generation requests, passing payment events) are sent to that service. What that service receives is governed by its own terms and privacy policy.
- Google: from a Google connection we receive your account ID, email, and name (to show which account is connected), and read-only Google Analytics and AdMob reports. Analytics report results are stored as a copy of the board, replaced each time the board is recalculated, and deleted when you remove the Google connection or delete the account. AdMob ad earnings are stored by day.
- Meta, Instagram, and Threads: we receive the campaigns, ad sets, ads, ad creatives, ad spend, and results of the Meta ad accounts you connect, and the posts, engagement stats, and comments (including commenter names) of the Instagram and Threads accounts you connect. We use them only to show them on your boards and to carry out the ad changes, posts, and replies you ask for.
- People read this data only when you ask us to, or when needed for security or to comply with the law.
allob's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements: https://developers.google.com/terms/api-services-user-data-policy
How to disconnect or delete this data is described in the account deletion section below.
Data that stays in your browser and device
The email address you are signing in with (briefly, after a code is sent) and your display settings are kept only in your browser's storage. Vault items are encrypted in your browser or the CLI before upload, and the keys that open them (unlocked by your PIN, passkey, or recovery code) are not kept on our servers. CLI sign-in details are kept in a settings file on your computer and in your operating system's key store. This data is not sent to our servers, and it is gone when you clear your browser data or sign out of the CLI.
Data about your products' users and other people
allob receives usage events of your products' users from the allob SDK and server code you add to your products (web, app, server), payment notices from the payment providers you connect (Dodo Payments, RevenueCat), and comments on posts from the social accounts you connect.
The purpose is to show you your products' usage, payments, and ad results, and to pass payment events to the ad and analytics tools you turn on (Meta, TikTok, Google Analytics). We do not store IP addresses with events, only the country, and we do not store names or email addresses with payment notices. When passing payment events to ad and analytics tools, we send the IP address, browser information, and ad click markers from the purchase along with them, but we do not store them and use them only for request limits and for passing the events.
We process this information as a processor on your instructions. The allob user who runs the product informs those people and gets any consent needed, through their own privacy policy. We do not receive their contact details, so we do not notify them separately. Please send requests about this information to the allob user who runs the product. If you ask us, we will tell you which product the information came from.
Retention periods
| Data | Retention period |
|---|---|
| Account information | Until you delete your last account yourself or ask us to delete it |
| Sign-in records | Until you sign out, or 30 days after sign-in on the web and 90 days for CLI and agent devices |
| Business information, fetched business data, products and records, vault items, image and video generation, activity records, payment notices from your products | Until you delete the account |
| Connection information | Until you disconnect (connection tokens and API keys are deleted as soon as you disconnect). The connected account name is kept until you delete the account |
| Generated images and videos you did not mark "Keep" and did not use in ads | 30 days after creation |
| Social comment text and commenter names | 30 days after you reply or skip, or 30 days after they are fetched if not replied to |
| Usage events from your products | 3 months after they are received |
| Web push subscriptions | Until you sign out or turn off notifications |
| Access logs | Within 7 days |
| Support emails | 1 year after we reply |
We do not keep any personal data separately to meet a legal retention duty.
Deletion and deleting your account
When a retention period ends or the purpose is met, we delete the data without delay so that it cannot be recovered.
- Delete an account: the account owner can delete an account in the web app under Account settings › Delete account. Products, connection information, business information, fetched business data, vault items, records, payment notices, and images and videos are deleted at once and cannot be restored. Usage events already received are deleted 3 months after they were received. If the person deleting has no other accounts, their sign-in email record, sign-in sessions, device sign-ins, and web push subscriptions are deleted too, and they are signed out.
- Disconnect only: press "Disconnect" on the Connections screen to delete that service's connection tokens and API keys at once. You can also revoke the access you gave at the outside service (Third-party connections under Security in your Google Account, Business integrations in Meta business settings, or Website permissions in Instagram and Threads settings).
- Ask by email: to delete a sign-in record left after you no longer belong to any account, to delete only the data received from Google or Meta, or if you cannot use the app, contact us at the details above. We delete it after checking your request and tell you when it is done.
Use of processors
We use the processors below. Our contracts with them do not allow them to use personal data for anything other than the work we give them.
| Processor | Work |
|---|---|
| Cloudflare, Inc. | Servers, databases, and file storage; storing and totaling usage events; sending sign-in code and alert emails; forwarding support emails |
| Oracle Corporation | Relaying requests through a server in Tokyo to our origin servers so the site opens quickly in Korea (nothing is stored) |
| NAVER Corp. | Support email inbox |
Web push notifications are delivered through your browser's push service (Apple, Google, Mozilla, Microsoft). The notification content is encrypted, so those companies cannot read it.
International transfers
To provide the service, we need to send personal data abroad to be stored and processed as below (Personal Information Protection Act, Article 28-8(1)3).
| Recipient (contact) | Country | Data | When and how | Purpose | Period |
|---|---|---|---|---|---|
| Cloudflare, Inc. (https://www.cloudflare.com/privacypolicy/) | United States (servers worldwide) | All data under "What we collect" | Over the network each time you use the service | Servers, storage, sending email | Same as "Retention periods" |
| Oracle Corporation (https://www.oracle.com/legal/privacy/services-privacy-policy/) | Japan (Tokyo server) | Requests to allob.app | Over the network each time you visit | Connection relay | Not stored |
| jsDelivr (https://www.jsdelivr.com/terms/privacy-policy) | Servers in a country near you | IP address, browser information | Directly from your browser when you open the docs | Sending font files for the docs | As set out in that company's policy |
If you do not want your data transferred abroad, you can delete your account and stop using the service. We cannot provide the service without these transfers.
Children
allob is a service for adults who run a business, and only people aged 19 or older in Korea (18 or older elsewhere) may use it. We do not collect personal data from children under 14, and we do not show targeted advertising to children.
Your rights
You can ask to access, correct, delete, or stop processing your personal data. A legal representative or someone you authorize can also make a request.
- Access: you can see your account, business information, connections, and records in the app. For anything else, contact us at the details above.
- Correction: edit your business information on the My business screen.
- Deletion: use Account settings › Delete account or "Disconnect" on the Connections screen, or contact us at the details above.
- Stopping processing: contact us at the details above.
We respond within 10 days of receiving a request, as required by Article 41 of the Enforcement Decree of the Personal Information Protection Act.
Security
- All connections are encrypted in transit.
- Connection tokens, API keys, and full business addresses are stored encrypted with a separate key for each account.
- Vault items are encrypted on your device, so even we cannot open them.
- Sign-in codes work only for a short time, and we limit sign-in requests and code attempts.
- Only we can handle account data, and important actions in an account are recorded.
Complaints and remedies
If you need advice or a remedy for a privacy violation, you can contact the organizations below.
- Personal Information Dispute Mediation Committee: 1833-6972, https://www.kopico.go.kr
- Personal Information Infringement Report Center: 118, https://privacy.kisa.or.kr
- Supreme Prosecutors' Office: 1301, https://www.spo.go.kr
- Korean National Police Agency: 182, https://ecrm.police.go.kr
Changes to this policy
This is the first version of this policy, effective 2026-10-22. If we change it, we will post the changes and the effective date on this page before they take effect.
Language
This document was originally written in Korean. Translations are provided for convenience. If they differ, the original prevails, unless the law of the country where you live says otherwise.