Privacy Policy

At a glance

winterlog studio ("we", "us") runs the camera app Sloshy. This policy explains how we handle personal data in the iOS and Android apps and on our website (sloshy.bang9.dev).

• You use the app without signing up or signing in.
• Your camera view, the sound of videos, your phone's tilt, and the photos and videos you take are handled only on your device. When you tap Save, they are added to your device's photo library.
• To improve the app, we send a random device ID and app usage records to our own analytics system.
• The app shows Google AdMob ads. In the EEA, the UK and Switzerland, we request ads and send usage records only as you choose in Google's consent form.
• Purchase checks (RevenueCat), ads (Google) and our website and analytics storage (Cloudflare) are US companies, so personal data is transferred internationally (sent to, or viewed from, another country).

Privacy contact

We are the controller of personal data for this app, and our privacy contact is the owner, Hyungu Kang. Send privacy questions, requests to see or delete your data, and complaints to:

• Business name: winterlog studio
• Owner: Hyungu Kang
• Address: 5-12 Gwangmyeong-ro 347beon-gil, Jungwon-gu, Seongnam-si, Gyeonggi-do, Republic of Korea
• Email: support@bang9.dev
• Phone: +82 10 9688 1157

What we use data for

We rely on consent only for ads and our statistics in the EEA, the UK and Switzerland, and for the advertising ID on iOS (IDFA) when you allow tracking; everything else uses the bases above. You can withdraw consent at any time as described in Device storage and SDKs.

What data we get and where from

• Usage records (sent by the app): device analytics ID (random), app opens, features you tap and their results (short values such as take, save, share, pick a theme, watch an ad), device type and app language, country of access determined from your IP address (the IP address isn't stored)
• Purchases: store receipt (product, store, amount, country, time), RevenueCat anonymous ID, device analytics ID to link purchase records, device info the payment SDK sends with it (OS, app version, language, IP address). Only the stores see your card details
• Ads (Google AdMob SDK): advertising ID, approximate location estimated from your IP address, ad views and taps, device and app info and diagnostics, ad consent status. The SDK sends this straight from your device to Google
• Visiting our website: IP address, access time, requested URL, browser info (used by our website provider for delivery and security; we don't store it)
• Support email: your email address and what you write

Data kept only on your device

Your camera view (photos and video), the sound while you record a video, and your phone's tilt are used on your device only while the screen is drawn; they are not stored or sent. Even if people appear on screen, the app doesn't look for or recognize faces.

Photos and videos you take are kept briefly in the app's folder on your device. When you leave the result screen, everything except the most recent one is deleted. When you tap Save, they are added to your device's photo library, and when you tap Share, they go through your device's share sheet to the app you choose.

App settings, which theme packs you own, and ad counts are stored on your device. When you delete the app, data on your device is erased; your ad consent status may remain in Google's consent tool (UMP) on your device.

How long we keep data and how we delete it

Where the law sets a retention period, the legal basis is shown in the table, and we keep those records separately and only for that period. When the retention period ends or the purpose is fulfilled, we delete the data without delay so it can't be recovered.

• Our statistics records are linked only to a device analytics ID; they can't be deleted one by one, and are deleted automatically when the retention period ends.
• Support emails are deleted from our inbox.

Who receives your data (third parties, processors, international transfers)

Third parties The companies below also use the data they receive for their own purposes, so this can count as disclosure to third parties.

• The app stores are ones you choose and have your own agreement with, so their privacy policies apply.
• If the law requires it, for example a court warrant, we disclose data only as far as the law requires.

Processors We entrust work to the providers below, and their data processing terms require our processors (those who do the processing on our behalf) to protect personal data to the same standard as this policy. Their sub-processors are listed by each provider, and if we change providers or what they do for us, we will update this policy.

We treat the ad work done by Google AdMob as work we entrust to it, so it is in the table above. In the EEA, the UK and Switzerland we only request ads after you consent, but the ad SDK starts first to show the consent form, and at that point it may send device and app information to Google.

International transfers

• When and how: whenever you use the app or website, over an encrypted connection.
• Legal basis: Korean PIPA Art. 28-8(1)(3) (processing and storage needed to perform our contract, disclosed in this policy). For users in the EEA and the UK, data is protected by the adequacy decisions for Korea and, for US providers, by the EU-US Data Privacy Framework or standard contractual clauses.
• To refuse: turn off ad tracking on your device and don't buy paid products. Outside the EEA, the UK and Switzerland, you can tell us to stop usage records. You can still use the camera features if you refuse.

Device storage and SDKs

The app stores settings and a random device analytics ID on your device. It includes SDKs for ads (Google AdMob) and purchase checks (RevenueCat).

How Google uses information from partner apps is explained in How Google uses information from sites or apps that use our services. Google may use information collected in this app and elsewhere to measure ads and choose personalized ads, and you can opt out in your device's ad settings.

Consent and how to turn things off

• EEA, UK and Switzerland: after you first save a photo, we ask for consent for ads and usage records through Google's consent form (UMP); you can change or withdraw it in the app's Settings → Ad privacy choices. Ads and usage records are used only after you answer, as you choose.
• Korea: sending data for ads and analytics is disclosed in this policy as entrusted processing, and we don't ask for separate consent.
• United States: to opt out of sale or sharing, see Your Privacy Choices.
• iOS Allow Tracking (ATT): after you first save a photo, we ask through the App Tracking Transparency prompt; if you don't allow it, we don't use the IDFA. You can change this in Settings → Privacy & Security → Tracking.
• Advertising ID: on Android, go to Settings → Google → Ads → Delete advertising ID; on iOS, Settings → Privacy & Security → Tracking → turn off Sloshy. When it's off, you see non-personalized ads.
• If you don't consent or turn things off, you can keep using the app as usual.

Information on external transmission (Japan)

Under Article 27-12 of Japan's Telecommunications Business Act, we explain what the app sends from your device to other companies.

Children's data

This app is not directed at people under 13 (under 14 in Korea; in the EEA, under the age at which you can consent to data processing on your own in your country — 13–16, depending on the country). We don't ask for your age and don't collect names or contact details. If we learn that we have collected personal data from someone below this age, we delete it. Ads are shown the same way regardless of age, and you can turn off personalized ads in your device's ad settings. Parents and guardians can ask to see or delete data through Privacy contact, and can block purchases and tracking with the store's parental controls.

Your rights and how to use them

You can ask at any time to see, correct or delete your personal data, or to stop processing it, and you can withdraw consent; where the law provides, you can also ask for a copy to take elsewhere (portability) and object to processing.

• Erase data on your device: delete the app
• Change ad consent or turn off the advertising ID: Device storage and SDKs
• Other requests (see, delete or stop processing data): Privacy contact

We reply within the time the law requires. The app has no accounts, so to find your statistics or purchase records we may ask for your device analytics ID or store order number. You can also make a request through a legal guardian or someone you authorize.

Your Privacy Choices

If you live in California or another US state with a similar law, you can opt out of the sale or sharing of your personal information as described below.

Do Not Sell or Share My Personal Information We don't sell personal information. When app ads (Google AdMob) send your advertising ID and ad interactions, this can count as "sharing" under some US state laws. There is no sale or sharing on our website. To opt out:

• On your device: turn off your advertising ID (Device storage and SDKs).
• In the app: if you see Settings → Ad privacy choices, opt out there.
• Tell us: send "Do Not Sell or Share" to Privacy contact.

Global Privacy Control (GPC) Our website doesn't sell or share, so a GPC signal changes nothing. The app doesn't receive GPC signals, so please opt out as described above.

Appeals If we deny your request or you aren't happy with our answer, send "Appeal" to Privacy contact. We review it again within the time the law requires and tell you the result and our reasons; if it still isn't resolved, you can complain to your state's Attorney General.

App permissions

How we keep data safe

• All communication between the app and servers is encrypted.
• Your camera view and the photos and videos you take are handled only on your device.
• Only we can access provider dashboards. Passwords and keys are kept in an encrypted secrets store.
• We collect only what we need.

Where to get help

If you need help with a privacy problem in Korea, you can contact:

• Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
• Personal Information Infringement Report Center (KISA): 118 (privacy.kisa.or.kr)
• Korean National Police Agency, Cyber Bureau: 182 (ecrm.police.go.kr)
• Supreme Prosecutors' Office: 1301 (www.spo.go.kr)

Users in other countries can complain to the authorities listed in the country sections below.

Changes to this policy

This policy (version 1) was announced on October 26, 2026 and takes effect on October 26, 2026. When we change it, we announce what changed on this page, side by side with the previous version, before the change takes effect (on the effective date at the latest); if a new purpose or recipient is added, we tell you before that processing starts and ask for consent where the law requires it. Previous versions: None

Language

This document was originally written in Korean. Translations are provided for convenience. If they differ, the original prevails, unless the law of the country where you live says otherwise.

EEA, UK and Switzerland

• We are the controller (Privacy contact), and the legal bases are in the purposes table above: contract (GDPR 6(1)(b)), legitimate interests (6(1)(f)) and consent (6(1)(a)).
• You can object at any time to processing based on legitimate interests (service security) under GDPR Art. 21; if you do, we stop unless we have compelling grounds.
• Your rights: access (Art. 15), rectification (16), erasure (17), restriction (18), portability (20), objection (21) and withdrawal of consent. Send requests to Privacy contact.
• Complaints: you can complain to the data protection authority where you live (in the UK the ICO, in Switzerland the FDPIC). UK users: if you send a complaint to us, we acknowledge it within 30 days, as the Data (Use and Access) Act 2025 requires.
• We don't make automated decisions or profiles that have legal effects on you.
• Switzerland: you have the same rights under the Federal Act on Data Protection, and transfers to US providers are protected by the Swiss-US Data Privacy Framework or standard contractual clauses.

United States (California and other state laws)

• Categories collected in the last 12 months: identifiers (device analytics ID, advertising ID, RevenueCat anonymous ID), commercial information (purchase records), internet activity (app usage records, ad interactions), approximate location (country, estimated from IP). Sources, purposes, recipients and retention are as in the tables above.
• Selling and sharing: we don't sell personal information for money. App ads (Google AdMob) can count as "sharing"; to opt out, see Your Privacy Choices. We don't knowingly sell or share personal information of anyone under 16.
• Your rights: to know, delete, correct, and opt out of sale or sharing. We won't discriminate against you for using them, you can use an authorized agent, and we may ask you to verify your identity. To appeal a denial, follow Your Privacy Choices.
• Do Not Track: our website has no third-party tools for ads or analytics, so nothing changes based on your browser's DNT signal.
• When we update this policy, we show the effective date.

Other countries

Users in the countries below have the rights their country's law gives them. Send requests and complaints to Privacy contact. Purposes and legal bases are in the purposes table above, and international transfers in the transfer table above.

• Japan: the business handling personal information is winterlog studio (represented by Hyungu Kang; address in the privacy contact section). Security measures are in How we keep data safe, and external transmission in Information on external transmission (Japan). Foreign systems: we are in Korea, which has the Personal Information Protection Act; our providers are in the United States, which has no comprehensive federal privacy law but has state laws such as the California Consumer Privacy Act. Our providers' data processing terms set out security measures.
• Brazil: the controller (controlador) is winterlog studio, and the data protection officer (encarregado) is Hyungu Kang (Privacy contact). Legal bases (LGPD Art. 7): performance of a contract (V), legitimate interest (IX), consent (I, for ads that require consent). International transfers: International Transfers of Personal Data (Brazil).
• Mexico: the data controller (responsable) is winterlog studio (address in the privacy contact section). Primary purposes are providing the camera features and checking purchases; secondary purposes are our statistics and ads. You can object to secondary purposes by telling us or through your device's ad settings.
• Canada and India: our privacy officer (in India, grievance officer) is the owner, Hyungu Kang (Privacy contact).

International Transfers of Personal Data (Brazil)

Personal data of users in Brazil is transferred outside Brazil as follows.

• Recipients: us (winterlog studio, Korea) and the providers in the table (United States).
• Mechanism and legal basis: transfers needed to perform our contract (LGPD Art. 33, IX), providers' data processing terms and standard contractual clauses (Art. 33, II), and consent for ads that require it (Art. 33, VIII).
• Purposes and duration: see the purposes and retention tables in the Privacy Policy.
• Responsibility: we are responsible for protecting the transferred data.
• Your rights: you have the same LGPD Art. 18 rights; send requests to support@bang9.dev.
• Onward transfers: providers can pass data to their own sub-processors and the same level of protection is required by contract.