Privacy Policy (full text)

StepMeal Privacy Policy

**Effective date: October 7, 2026 (2026-10-07)** **Last revised: October 7, 2026 (2026-10-07)**

StepMeal (the “Company”) establishes and publishes this Privacy Policy as follows in order to comply with applicable laws such as Korea’s Personal Information Protection Act and to process users’ personal information lawfully and transparently.

This policy applies to the StepMeal website (www.stepmeal.com), mobile applications and related services.

1. How processing differs depending on how you use the Service

Some core features of StepMeal can be used without logging in; logging in as a member lets you save and sync your meal plans, weight log and other records.

The specific items of personal information processed can be found in Appendix 1.

2. Principles of processing personal information

① The Company processes the minimum personal information necessary to provide the Service.

② The Company does not use personal information beyond what is necessary for the purposes of processing, and if the purposes change, it follows the procedures required by applicable laws.

③ The items, purposes and retention periods of the personal information actually processed are set out in Appendix 1, entrusted processing in Appendix 2, and overseas transfers in Appendix 3.

3. Information stored in the browser of users who are not logged in

① When you design a meal plan without logging in, what you enter may be stored in your web browser’s storage (localStorage, sessionStorage, etc.), and those meal plan inputs are handled in a way that does not send them to the Company’s server.

② The Company does not collect or manage the browser-stored information in paragraph 1 in a per-member database.

③ Browser-stored information is generally not subject to the same security controls as separately stored server information, and depending on the browser and device environment, others may be able to view it. For example, information may be exposed through use of a shared device, malware infection or browser extensions with access permissions.

④ Deleting browser-stored information may also delete the meal plan inputs stored on that device.

⑤ Existing browser-stored information cannot be used on other devices or other browsers.

4. Member login and account information

① When a user signs up through a social login such as Kakao or Google, the Company processes the information provided during the social login process to identify members and provide the Service.

② The Company does not directly collect or manage a separate StepMeal username and password.

③ For member data, the Company applies database access controls and Row Level Security to prevent members from viewing one another’s information. In addition, no permission to access the tables where member information is stored is granted while not logged in.

④ The Company’s service screens have no feature for the operator to look up members’ personal information. Access to personal information is limited to a single route, the database management tool, and the person with access is the 1 privacy officer.

⑤ The Company accesses personal information only when necessary — for example, to respond to system failures or handle users’ requests to exercise their rights — to the minimum extent, and records and keeps a log of such access.

⑥ Statistics on use of the Service are checked through a separate view that shows only aggregate values that cannot identify individuals, and the Company does not view members’ personal information to check statistics.

5. Personal information collected from sources other than the data subject

① The Company may receive personal information from third-party services such as Kakao or Google in the course of social login.

② The scopes requested in the actual settings of the authentication infrastructure the Company uses were confirmed to be as follows. Whether optional items are actually provided may vary depending on the user’s choice.

③ Email is passed on because of how the social login providers’ authentication works, and the Company cannot narrow the requested scope.

④ The Company **does not store the email it receives in its service database.** It is kept only as account identification information in the authentication infrastructure (Supabase Auth), and the Company does not download it into member profiles or display it on screen.

⑤ The Company does not use email for advertising or marketing, and does not obtain separate consent to receive marketing. If it intends to do so in the future, it will obtain separate consent in accordance with applicable laws.

⑥ Items the Company does not use for service features, such as profile images, may not be used as separate member profile information. However, they may be processed by the systems of the authentication infrastructure provider (Supabase) or the relevant social login provider during social login and authentication.

⑦ Users can check the items provided on the consent screens each provider shows during social login, and can refuse optional items.

⑧ Users may exercise the right to ask the Company about the source from which their personal information was collected, the purposes of processing, and to request suspension of processing.

6. Purposes of processing personal information

The Company processes personal information for the following purposes.

• Identifying members and keeping them logged in
• Saving and viewing meal plan results and records
• Saving and syncing body information and meal plan settings
• Weight logging and progress tracking
• Providing and maintaining the Service
• Service security and prevention of misuse
• Checking system errors and stabilizing the Service
• Responding to customer inquiries and users’ exercise of rights
• **Producing statistics on use of the Service and improving the Service** (processed only in aggregate form that cannot identify individuals)
• Fulfilling obligations under applicable laws

7. Processing of sensitive information

① The Company **does not process** sensitive information under the Personal Information Protection Act.

② Allergy information is information about health and may count as sensitive information. The Company **does not store it on its servers**; it is kept only in the user’s browser storage.

③ The Company does not know the contents of allergy information and does not manage it per member. The Company’s database has no field for allergy information at all.

④ Even when a user logs in, allergy information is not sent to the server. Therefore, if you log in on another device you must enter your allergy information again, and it is deleted along with your browser data.

⑤ Whether body information such as height, weight and goal weight counts as sensitive information is judged by considering the nature of the actual information and the purposes of processing together; where necessary under applicable laws and the guidance of the Personal Information Protection Commission, the Company will change its processing methods and amend this policy in advance.

8. Retention and use periods

① The Company retains and uses personal information for the periods set out in Appendix 1.

② When a member deletes their account, the member information and service records stored in the Company’s active database are deleted without delay, except information that must be retained under applicable laws.

③ Where applicable laws require retention for a certain period, information is kept for the period set by those laws.

④ The Company currently uses the Supabase Free plan and operates no separate backups of its own. Therefore, the Company does not keep deleted personal information in any backup it manages directly.

⑤ However, the Company cannot directly control system-level replicas or technical residual data that entrusted providers may hold on their own for purposes such as disaster recovery. The Company does not separately use such data to provide the Service, and it is handled according to the providers’ policies and contracts.

⑥ If the Company changes its backup policy, it will amend this policy in advance.

9. Provision of personal information to third parties

① In principle, the Company does not sell or provide users’ personal information to separate third parties.

② However, it may provide information in the following cases in accordance with applicable laws.

• Where the user has separately consented
• Where laws have special provisions
• Where investigative agencies or other relevant authorities request it through lawful procedures and methods

③ Entrusted processing and overseas transfers of personal information are disclosed separately in Sections 10 and 11.

10. Entrustment of processing

① To operate the Service, the Company may entrust part of its personal information processing to outside specialist companies; current entrustments are listed in Appendix 2.

② In accordance with applicable laws, the Company includes matters concerning personal information protection and security measures in its contracts with entrusted providers, and manages and supervises their processing.

③ If the entrusted work or providers change, the Company discloses this through this policy.

11. Overseas transfer of personal information

① To provide the Service, the Company may entrust processing or storage of personal information to providers located overseas or make it accessible from overseas; the current actual processing is as shown in Appendix 3.

② The legal basis for overseas transfer and the information provided to users are disclosed in accordance with applicable laws. Where entrusted processing or storage is necessary to conclude or perform a contract and meets the requirements permitted by the Personal Information Protection Act, it may be handled by disclosure in this Privacy Policy without separate consent to overseas transfer.

③ If overseas processing of member information in connection with Supabase concerns you, you can use the Service as a non-member without using member features. However, access information such as IP addresses generated when visiting the website may be processed by overseas providers depending on infrastructure such as service hosting.

④ If personal information is sent to external AI services or the like in the future, the Company will reflect the provider, country, items transferred, purposes, retention periods and required legal procedures in this policy.

12. Rights of data subjects and how to exercise them

① Users may exercise the following rights regarding their personal information in accordance with applicable laws.

• Requesting access to personal information
• Requesting correction of personal information
• Requesting deletion of personal information
• Requesting suspension of processing
• Withdrawing consent where consent was given
• Other rights set by applicable laws, such as requesting notice of the source from which personal information was collected

② Members can check and edit their personal information and delete their account themselves using features provided in the Service. When an account is deleted, the member’s personal information held by the Company is deleted immediately.

③ Requests that are hard to handle with in-service features can be sent to contact@stepmeal.com.

④ The Company handles requests to exercise rights within the period set by applicable laws and informs you of the result.

⑤ Rights may be exercised through a legal representative or a duly authorized agent, and the Company may verify whether the requester is the person or their agent to the extent necessary.

⑥ Where restrictions under applicable laws apply, access, correction, deletion, suspension of processing and the like may be restricted, in which case the Company will explain the reason.

13. Personal information of children under 14

① **Children under 14 cannot sign up.**

② On the sign-up screen, users must confirm that they are 14 or older. Because the Company offers only social login and does not collect dates of birth, age is confirmed by the user’s own confirmation.

③ If the Company learns that personal information of a child under 14 has been collected, it will restrict use of that account without delay and delete the related personal information.

④ If you learn that a child under 14 has signed up, please let us know at contact@stepmeal.com.

⑤ Because StepMeal is a weight management and meal planning service, the medical precautions in Article 8 of the Terms of Service also apply to use by minors. In particular, users under 18 are advised to consult a professional before actually applying a meal plan.

14. Procedures and methods for destroying personal information

① The Company destroys personal information without delay when it is no longer needed because the retention period has passed, the purpose of processing has been achieved, or the like.

② Personal information in electronic file form is deleted so that it is difficult to recover or reproduce.

③ When a member deletes their account, the personal information and records stored in the member database are deleted, except information that must be retained under applicable laws or this policy.

④ Because the Company cannot directly delete information stored only in browsers, users can delete it themselves using their browser’s delete-site-data feature.

15. Measures to ensure the security of personal information

The Company applies the following measures to ensure the security of personal information.

• Minimizing and managing access rights to personal information
• Access control and separation of privileges for the database
• Applying policies that restrict data access between members, such as Row Level Security
• Encryption in transit (HTTPS, etc.)
• Protecting administrator credentials and secrets
• **Generating, retaining and regularly reviewing access logs for the personal information processing system**

The Company limits the route for accessing personal information to a single operator-only screen, and has configured its system so that, when access is made through that screen, the person performing it, the date and time, access location information, the data subject whose information was processed, the task performed and the reason for access are recorded automatically. Records are kept for 2 years or more and reviewed every month according to a separate internal management plan.

※ Members viewing or editing their own personal information is processing by the data subject themselves and is not covered by the access logs above.

• Checking for security vulnerabilities and applying security updates
• A structure in which the Company does not directly store passwords, by offering social login only
• Measures not to expose the administrator key (service_role) in browsers and not to deploy it outside the server
• Measures not to grant access to the tables storing member information while not logged in
• A structure that separates statistics so only aggregate values that cannot identify individuals are viewed
• Contractual and managerial protection measures for entrusted providers

※ The Company is a small service run by 1 person, and the person who can access personal information is the 1 privacy officer. Access to personal information is recorded, kept and reviewed regularly.

16. Automatic collection tools and browser storage technologies

① The Company may use cookies or similar technologies, browser storage and the like to keep you logged in, provide service features and maintain security.

② To operate the Service free of charge, the Company may display ads from advertising providers (such as Google AdSense and Kakao AdFit) **on nutrition guide pages only**. In that case, advertising providers may use their own cookies and the like to show ads. **As of the effective date of this policy, no advertising provider is currently displaying ads**, and if advertising begins, the provider’s name will be stated in this paragraph.

③ The Company does not place advertising providers’ scripts on screens that show users’ personal information or meal plans, such as meal planner inputs and results, the 7-day plan, the weight log, my records and the login screen.

④ The Company uses a visit analytics tool (Vercel Web Analytics) to improve the Service. This tool does not use cookies, and the value used to identify visitors is a hash generated from request information that is discarded after 24 hours. The items collected are the access time, request path, referrer, approximate location (country and city level), device type, operating system and browser information. The Company configures this tool so that it does not receive member identification information, and excludes access to the operator-only screens (/admin) and the query strings of addresses from what is sent.

⑤ Users can restrict the use of cookies or storage technologies through their browser settings, in which case some features such as login may not work properly. If you use an ad-blocking extension or the like, the visit analytics above may also be blocked.

⑥ The Company may post **affiliate links**, such as Coupang Partners links, in shopping lists and the like. Affiliate links are simple links to other sites, and the Company does not run the affiliates’ tracking scripts on its site. Clicking a link takes you to that site, after which that site’s privacy policy applies. The Company does not put member identification information, body information or meal plan information in the link address.

⑦ If the Company introduces additional analytics tools, advertising tools or other tracking technologies in the future, or changes their settings, it will reflect the purposes and items of collection and how users can choose in this policy.

17. Behavioral information and personalized advertising

① The Company does not use users’ body information, health-related information, allergy information or meal plan records to decide who sees advertising, and does not provide them to advertising providers.

② The Company does not itself collect or use behavioral information for advertising purposes.

③ However, if ads are displayed under Section 16 ②, advertising providers may use their own cookies to collect behavioral information such as users’ website visit history and use it for personalized advertising. In that case, before advertising begins, the Company will state in this section the providers collecting behavioral information, the collection methods, the items collected and the retention and use periods.

④ Users can refuse personalized advertising by changing their browser’s cookie settings or in settings provided by advertising providers, such as Google’s “My Ad Center” (myadcenter.google.com).

18. Automated processing and use of artificial intelligence

① The Company may use automated programs or artificial intelligence technology in meal planning and in generating and composing content.

② Currently, the main calculations and composition for meal planning may be operated in a way that is carried out by program computation on the user’s device.

③ Currently, members’ inputs are not sent to external AI services in the meal planning process.

④ If, in the future, members’ personal information is sent to external AI services, or AI uses personal information as input to provide a separate service, the Company will amend this policy in advance and follow the procedures required by applicable laws.

⑤ The Service’s current meal recommendations are different in nature from automated decisions in administration, credit, employment and the like that determine users’ legal rights or obligations; where separate rights apply under applicable laws, the Company guarantees them.

19. Privacy officer

① The Company designates a privacy officer to take overall charge of work related to processing and protecting personal information and to handle privacy inquiries and complaints.

**Privacy officer** Name: Na Yunji Title: Operator (representative) Email: contact@stepmeal.com Phone: 0502-6810-0148

② Privacy inquiries, exercise of rights and requests for remedies can be made through the contact details above or contact@stepmeal.com.

20. Remedies for infringement of rights

Users may contact the following organizations for advice or dispute mediation regarding personal information infringement.

※ Before actual posting, the latest contact details and website addresses of each organization are checked and entered.

21. Changes to this Privacy Policy

① The Company may change this policy in response to changes in laws, service features, personal information processing methods or the security environment.

② Where there are important changes, the Company discloses the changes and the effective date in advance so users can easily check them.

③ Where necessary, the Company may publish previous versions of the policy for a certain period so users can compare the content before and after changes.

Appendix 1. Items, purposes and retention periods of personal information processed

A. Non-member users

**※ Allergy information is stored only in the browser even when you log in as a member. It is not sent to the Company’s server.**

※ For non-member use, the meal planning inputs above are handled in a way that does not send them to the Company’s server. However, separate access information may be processed automatically by infrastructure providers such as Vercel when you visit the website.

B. Logged-in members

※ **Allergy information is not in the table above.** It is not stored on the Company’s server and is kept only in the user’s browser.

※ When a member deletes their account, the items above are deleted immediately without exception. No separate evidentiary records are kept.

C. Information generated or collected automatically

D. Distinguishing browser-stored and server-stored information

Even where non-members’ browser-stored information and members’ server-stored information are mixed, **allergy information is not sent to the server.**

The Company’s database has no field for allergy information at all, and automated checks confirm that the code does not send it. The system is operated so that allergy information is not stored on the server at any point, before or after login.

Appendix 2. Entrustment of personal information processing

※ Kakao and Google are distinguished from entrusted providers to which the Company delegates work, and are listed in Section 5 of this policy as sources other than the data subject. Their legal status will be reconfirmed according to the actual contracts and technical structure.

Appendix 3. Overseas transfer of personal information

1. Vercel Inc.

2. Supabase Inc.

※ Even if the Supabase project is stored in the Seoul region, whether it counts as an overseas transfer may arise where operational or support access by the US corporation or its sub-processors is possible; the Company will finalize this table after a final check of the actual contract (DPA), sub-processor list and support-access settings.

Addendum

① This Privacy Policy takes effect on **October 7, 2026 (2026-10-07)**.

② The previous Privacy Policy (effective 2026-09-16, i.e. September 16, 2026) is abolished when this policy takes effect.

③ Revision history: October 7, 2026 (2026-10-07) — added the scope of ad placement (limited to nutrition guide pages), affiliate links, and the principle of not using health information for personalized advertising (Sections 16 and 17).

Service name: StepMeal (www.stepmeal.com) Operator: Na Yunji Business registration number: not applicable (not yet registered) Address: 134, Deungchon-ro 35-gil, Gangseo-gu, Seoul, Republic of Korea Privacy officer: Na Yunji Privacy inquiries: contact@stepmeal.com Main contact: 0502-6810-0148