Privacy Policy

Language and Interpretation

This localized document is provided so users can understand Mulbyul in their preferred language. It is written as service-ready legal copy for this locale, not as a word-for-word translation.

If this localized document conflicts with the Korean version, the Korean version will govern to the extent permitted by applicable law. Nothing in this document limits mandatory consumer, privacy, or safety rights that cannot be waived under local law.

1. Data We Process

2. Purposes of Use

• Providing core functions such as dry-training routine creation, editing, display, and timer progress
• Saving session records, reviewing step-by-step records, and managing completion or stop history
• Displaying Apple Watch and HealthKit-based heart rate data, record charts, and workout records when authorized by the user
• Supporting routine and session record sync according to the user's Apple account and iCloud settings
• Providing reference routine suggestions based on AI routine generation requests
• Requesting and displaying Google AdMob native ads, selecting personalized, non-personalized, or limited ads, frequency control, measurement, analytics, and fraud prevention
• Checking regional consent requirements, gathering consent, and managing advertising privacy choices through Google User Messaging Platform (UMP)
• Analyzing Apple, Android, and Web feature journeys, training start-to-save conversion, drop-off points, and failure locations to improve product usability and stability
• Analyzing crashes and non-fatal errors, reviewing diagnostic logs, measuring affected installations, and improving app stability through Firebase Crashlytics
• Preserve local Web routines, records, and settings; provide manual backup and restore; remember language; and deliver content securely
• Responding to support inquiries, investigating errors, preventing abuse, protecting rights, and responding to disputes
• Complying with laws, App Store review, security, and platform policies

2-1. Web App, Browser Storage, and Cookies

Web routines, training records, reflections, and settings remain in IndexedDB and other browser storage for the current site origin. They are not automatically synced to an account, cloud service, or another device and may disappear when site data is cleared, private browsing is used, storage is restricted, or the site origin changes.

A user-initiated backup is stored on the device as a .mulbyulbackup file. It is a binary format intended for compatible Mulbyul apps, but it is not a password-encrypted secure vault. Users must manage file access and sharing securely.

Mulbyul uses the mulbyul-language cookie for up to one year to remember the display language. The Web app loads Firebase Analytics only after the user allows analytics, and Google Analytics _ga-family cookies may then be used for up to 180 days. The Web app does not include Google AdMob or another advertising SDK, and analytics information is not used for advertising personalization.

Cloudflare may process IP address, requested URL and time, user agent, and routing information while delivering and protecting the Web app. The contents of browser-local routines, records, and notes are not part of this request metadata unless the user backs them up or attaches them to an inquiry.

3. HealthKit and Apple Watch

Mulbyul processes HealthKit or Apple Watch-related data only when the user grants the relevant permissions on iOS or watchOS. Some basic routine features remain available without permission, but heart rate display, workout session integration, Apple Health storage, and related features may be limited.

HealthKit and Apple Watch data is supplemental information for training reference and record review. Mulbyul does not diagnose or predict heart conditions, oxygen deficiency, fainting risk, blackout, disease, or injury. Users can change permissions or manage stored health data at any time in Apple Health or iOS Settings.

Mulbyul does not use HealthKit, Apple Watch, heart-rate, or workout data for advertising, marketing, cross-app or cross-site tracking, data sale, data-broker disclosure, or health-data mining. The heart-rate summary disclosed under Usage Analytics is, however, processed through Google Analytics for Firebase for product-feature and stability analysis.

3-1. Google AdMob, UMP, IDFA, and Advertising Consent

Mulbyul uses the Google Mobile Ads SDK (Google AdMob) to provide native ads on Android and iOS, and User Messaging Platform (UMP) to present advertising privacy choices appropriate to the user's region and applicable requirements. Google's advertising services may process the technical information above for ad delivery, measurement, analytics, security, and fraud prevention.

Personalized ads may be provided depending on the user's region, UMP choices, device settings, and applicable law. On iOS, Apple's App Tracking Transparency (ATT) permission is also required when access to IDFA or tracking across other companies' apps and websites is needed. If ATT is denied, IDFA is unavailable, and non-personalized, limited, or technical ads may still appear depending on UMP and device settings.

When UMP requires a privacy-options entry point, users can refuse, change, or withdraw consent through ‘Ad privacy options’ or ‘Privacy Options’ in the app settings. iOS tracking permission can be managed in Settings > Privacy & Security > Tracking, and the Android Advertising ID can be managed through the device's ad privacy or advertising ID settings. Menu names may vary by OS and device manufacturer.

Mulbyul does not add routines, session records, notes, AI input, HealthKit, Apple Watch, heart rate, or other workout and health data to ad requests or use them as criteria for personalized advertising. This workout and health data is separate from the device and advertising technical information processed by the ad SDK. Refusing or withdrawing advertising consent does not restrict core functions such as routines, timers, or workout records, although ad personalization or availability may change.

3-2. Usage Analytics with Firebase Analytics

Mulbyul on Apple, Android, and Web uses Google Analytics for Firebase. Each platform collects app or Web launches and feature interactions, with custom-event fields differing by platform.

Android custom events do not contain free-form input, routine titles or descriptions, session notes, AI requests, routine/session/record identifiers, exact heart rate, or exact training duration. They record only controlled categories and duration or count ranges.

Apple custom training events include a routine identifier, step index and type, exact target, actual and elapsed training time, pause durations and counts, contraction durations and counts, completion rate, heart-rate presence, sample count, average, minimum, maximum and change, and Health workout presence. They do not include free-form routine titles or descriptions, session notes, or AI requests.

Web custom events record only a screen category, display language, Web platform, training start, finish and result save, preset or custom routine classification, and completion range. They do not send routine, session, or record identifiers from dynamic URLs; exact training duration, count, or completion rate; routine content; notes; or other free-form input.

Separate from custom events, the Google Analytics SDK may process an app-instance identifier, app, device, OS and language information, timestamps, automatically collected events, and other basic usage information. Mulbyul uses this information for product analysis and usability improvement, not as a criterion for advertising personalization.

On Android, analytics is enabled in the EEA, UK, and Switzerland only after consent through UMP and can be changed or withdrawn in app settings. It is collected by default in other regions without a separate analytics toggle. Apple Analytics is not governed by this Android UMP analytics-consent control and currently has no separate analytics toggle. Web applies a consent-first basic mode in every region: before consent it does not load the Firebase Analytics SDK or send analytics data. The user can allow or withdraw analytics in Web settings at any time; withdrawal stops subsequent collection and removes _ga-family cookies accessible to the current site. Requests to restrict processing or delete data can be sent to the contact below, and no choice restricts core features.

3-3. Firebase Crashlytics Error and Diagnostics

The Mulbyul Apple and Android apps configure Firebase at launch and use Firebase Crashlytics. Crashlytics may process crash stack traces, relevant application state, app version, device model and OS, installation and session identifiers, and diagnostics. Apple event names, errors, custom keys or logs, and Android controlled event-name breadcrumbs or privacy-redacted exceptions, may be attached to a crash report.

Firebase Analytics is used for usage analytics in both the Apple and Android apps. The Crashlytics error diagnostics described here are separate from Firebase Analytics usage analytics.

Crashlytics diagnostics are used only for error analysis and app stability, not advertising personalization. Mulbyul does not add routine contents, session notes, HealthKit, Apple Watch, heart-rate, or workout records to ad requests, and does not instruct Google to combine Crashlytics diagnostics with advertising profiles.

3-4. Additional Notice for EEA, UK, and Swiss Users

InnoSquad processes core app functions and user-requested support for contract performance (GDPR Article 6(1)(b)), legal obligations under point (c), Crashlytics security, error diagnostics, and stability under the legitimate interest in operating a reliable and secure app under point (f), and personalized advertising, advertising identifiers, and storage or access requiring consent under point (a). Basic limited-ad delivery, security, and fraud prevention may rely on legitimate interests where permitted by applicable law.

The legitimate interests are detecting and fixing app errors and operating the service and ad delivery securely. InnoSquad balances these interests against user rights and limits processing to what is needed. Users may withdraw consent at any time, object to processing based on legitimate interests, and lodge a complaint with a supervisory authority in their residence or workplace.

Restricted European transfers by Google may use the applicable EU-U.S. Data Privacy Framework or the Standard Contractual Clauses incorporated into Google's Firebase Data Processing Terms, together with supplementary measures. Users may request a copy or further information about applicable safeguards from InnoSquad.

4. iCloud and CloudKit Sync

Some Mulbyul records sync through iCloud/CloudKit when the user's Apple account, iCloud settings, OS state, and app feature support conditions are met. In that case, the data is processed through Apple platform storage connected to the user's Apple account, not through a separate server operated by the company.

iCloud/CloudKit availability, sync delays, conflicts, account restrictions, network conditions, backups, and recovery depend on Apple's policies and the user's account settings. Users are responsible for managing Apple account security, iCloud access, and device lock settings.

5. AI Routine Generation Input

Mulbyul's AI routine generation feature creates reference dry-training routine suggestions based on the user's request. Generated results are general reference materials and should not be interpreted as medical judgment, professional coaching, safety assurance, or a guarantee of competitive or diving performance.

Users should not enter diagnoses, treatment records, medication information, government identification numbers, contact details, third-party personal information, or other sensitive or unnecessary information into the AI input field. Users must review generated routines for their own health condition and training environment and consult a professional when necessary.

6. Retention and Deletion

• Routines, session records, and settings on the device may be retained until the user deletes them in the app or deletes the app.
• Data synced to iCloud/CloudKit may remain until the user deletes records in the app or manages the related data through Apple account and iCloud settings.
• Data stored in HealthKit or Apple Health can be managed directly by the user in Apple Health or iOS Settings.
• Inquiry data is retained for the period necessary to handle the inquiry, respond to disputes, protect rights, and comply with legal obligations, and is then deleted or de-identified.
• Web local data remains in that browser until the user removes it through Mulbyul data management or browser settings, or the browser removes the site's storage.
• The mulbyul-language cookie lasts up to one year. The Web analytics-consent choice remains locally until the user changes it or clears browser storage, and _ga-family cookies set after consent may last up to 180 days. Cloudflare access and security metadata is processed for periods determined by the applicable service agreement, security purpose, and Cloudflare policy.
• The Google Analytics property is configured to retain user-level and event-level data for 14 months. This setting may not apply to standard aggregated reports. Requests for deletion or restriction can be sent to the contact below.
• Firebase states that Crashlytics keeps crash stack traces, extracted minidump data, and associated identifiers for 90 days before starting removal from live and backup systems. Raw NDK minidump data is retained only temporarily while a crash session is processed.
• If a legal retention obligation applies, data may be retained for the period required by applicable law.

7. Third-Party Sharing and Processing

Mulbyul does not sell or provide user routines, session records, HealthKit data, Apple Watch data, or heart rate data to advertising networks, data brokers, or marketing companies.

Apple platform functions such as iOS, watchOS, HealthKit, Apple Health, iCloud, CloudKit, and the App Store are used to provide app features. Data processed by Apple is governed by Apple's terms, privacy policies, and the user's Apple account and device settings. If the user contacts us through email or another external channel, that service provider's policies may also apply.

Google LLC and the Google entity applicable to the user's region process advertising and consent information as providers of the Google Mobile Ads SDK and UMP. Google retains and deletes this information under its own privacy policy, the user's consent and ad settings, and applicable law; InnoSquad does not determine Google's specific retention period.

Google LLC and applicable Google affiliates and processors process Apple, Android, and Web usage analytics as providers of Google Analytics for Firebase. InnoSquad determines platform-specific custom-event fields and purposes and manages the Analytics property's retention and deletion settings.

Google LLC and applicable Google affiliates and subprocessors process error and diagnostic information as processors for Firebase Crashlytics. Firebase privacy inquiries can be submitted at https://firebase.google.com/support/privacy/dpo.

Cloudflare, Inc. processes access and security metadata to host, deliver, route, and protect the Web app. Cloudflare's privacy policy also describes its processing and data-subject request channels.

8. International Processing and External Platforms

Mulbyul operates without a separate company-operated membership server or in-app account function. However, external platforms such as Apple iCloud/CloudKit, the App Store, and email services process data domestically or internationally according to their own infrastructure and policies. Users should also review each platform's privacy practices and account settings.

The table below details international processing for Google advertising and consent services and Firebase Crashlytics. Google services use global infrastructure rather than one fixed country, so processing may occur in the United States and other countries where Google or its disclosed subprocessors maintain facilities. Publishing this table does not itself replace any separate consent required for an international transfer; InnoSquad must separately satisfy the applicable legal basis and consent requirements.

9. User Rights

• Users can view, edit, and delete routines and session records in the app.
• Users can change permissions such as HealthKit, Apple Watch, and notifications in iOS Settings.
• Users can view and delete workout or health data stored in Apple Health.
• Users can manage sync status and stored data through iCloud settings and Apple account settings.
• When required by UMP, users can refuse, change, or withdraw advertising consent through ‘Ad privacy options’ or ‘Privacy Options’ in the app settings.
• To the extent applicable advertising data processing constitutes a ‘sale,’ ‘sharing,’ or targeted advertising under applicable U.S. state law, residents of covered states may opt out through Settings > Privacy Options. UMP records and communicates the choice using the Global Privacy Platform (GPP). Opting out does not restrict Mulbyul’s core features.
• Users can revoke ATT permission in iOS tracking settings and reset or delete the Android Advertising ID in device settings. Refusal or withdrawal does not restrict core workout features.
• Users can delete Web local data through Mulbyul data management or the browser's site-data controls. Downloaded backup files must be deleted separately from the user's device or file storage.
• Requests regarding personal data processing, access, correction, deletion, or suspension of processing may be sent to the contact below.

To request deletion or restriction of Firebase Analytics usage data, email contact@innosquadcorp.com . Because the app has no account, we may provide additional instructions to identify the affected app instance and request scope.

10. Children and Minors

Mulbyul is not intended to knowingly collect personal information from children under 14. If a minor uses Mulbyul, a guardian should review the user's health condition, training intensity, training location, HealthKit and iCloud settings, and record storage status.

11. Sensitive Information and Safeguards

Heart rate, workout, and health-related information may reveal a person's physical condition and may be sensitive. Mulbyul requests necessary permissions, processes data only within the authorized scope, and is designed to minimize unnecessary server transmission.

Users are responsible for managing device lock settings, Apple account security, iCloud access, and Apple Health sharing permissions. We recommend not entering diagnoses, treatment details, identification information, financial information, or third-party personal information in app notes or AI input fields.

Heart-rate, workout, and other health-related information may be sensitive personal information. App or OS permission does not itself replace any separate consent or international-transfer basis required by applicable law; the required legal basis and procedure must also be satisfied. Users may decline health permissions and continue to use core local training features without heart-rate integration.

12. Policy Changes

If data processing practices, app features, advertising SDKs, external platform integrations, applicable laws, or Apple or Google policies change, we will update the version and effective date of this page. For material changes, we may provide notice through the app settings screen, website, App Store, Google Play, or other appropriate means.

13. Contact

• Person responsible for personal information protection: Changwoo Son
• Email: contact@innosquadcorp.com

For questions about this Privacy Policy or Mulbyul data processing, contact contact@innosquadcorp.com . For disputes or record errors, including the app version, OS version, device model, occurrence time, related screen, routine, or session record information can help us review the issue.