Privacy Policy

Jinjja Labs Inc. (주식회사 진짜랩스, "Jinjja", "we") operates the Jinjja app, jinjja.io and the Jinjja partner portal. This Privacy Policy explains how we process personal information in accordance with the Personal Information Protection Act of Korea (PIPA), the Act on the Protection and Use of Location Information, and other applicable laws. Our servers and databases are located in the Republic of Korea.

• Account: name, email address, password (stored only as a one-way hash), username, sign-in provider and account ID (Google, Apple, Kakao or Naver, if you use them), passkeys and two-factor settings.
• Profile (you choose what to add): profile photo, date of birth, gender, bio, country, preferred languages, home currency, social links, taste preferences and dietary needs, and visibility settings.
• Your activity and content: reviews and ratings, photos and videos, saved places, routes and trips, tables, events and crawls you host or join, messages in table, event and crawl chats, reports and blocks, place suggestions, AI concierge conversations, menu photos you scan and their translations, and rewards and stamps you collect.
• Location: your device location when you allow it (see section 11).
• Device and technical: IP address, device and OS type, app version, a randomly generated device identifier, push notification token, session records and crash diagnostics.
• Purchases: subscription status, product, store transaction identifiers and renewal dates (card details are handled by Apple or Google and never reach us).
• Partners: for venue or team claims, the contact person's name, phone number and email, business registration number and supporting documents.
• Support: what you write to us and our replies.

• To create and secure your account, sign you in and keep you signed in.
• To provide the Service: recommendations, guides, maps and routes, tables, events, crawls and chat, the AI concierge and menu translation, and rewards.
• To keep the community safe: confirming you are at least 14, applying table settings chosen by hosts (such as gender-specific tables), handling reports, blocking and moderation, and preventing fraud and reward abuse.
• To process Premium purchases and restore them across devices.
• To send service messages such as verification codes, security alerts and notifications you enable.
• To understand how the app is used and fix problems, through app analytics (which you can switch off) and crash reports.
• To meet legal obligations and respond to lawful requests.

We process information on the basis of your consent, to perform our contract with you, or where the law requires or permits it. We do not sell personal information and do not use it for third-party advertising.

We keep personal information only as long as needed for the purposes above, then destroy it.

• Account, profile and content: until you delete your account. Deletion is immediate: your profile, photos, reviews, routes, tables, events, AI conversations and other content are permanently deleted. Places or dishes you suggested that were accepted into the public catalogue remain without your name.
• Menu scans: 30 days. Push tokens: deleted after 60 days without use. Session records: until you sign out or the session expires.
• Coordinates recorded with a reward scan: 30 days, then erased. The reward or stamp itself stays until you delete your account.
• Reports and the evidence attached to them: as long as needed to handle the report and prevent repeat abuse.
• Records we must keep by law, even after deletion: location use and provision records (2 years, Act on the Protection and Use of Location Information); records of contracts, payments and supply of goods (5 years) and consumer complaints and disputes (3 years) (Act on the Consumer Protection in Electronic Commerce); website access logs (3 months, Protection of Communications Secrets Act).

Destruction: electronic records are deleted in a way that cannot be restored. We do not keep paper records of user information.

We do not provide your personal information to third parties except as described here:

• Other users see what the Service is designed to show: your public profile (subject to your visibility settings), reviews, the tables, events and crawls you join, and messages you send in those chats. If you switch on live crawl sharing, members of that crawl see your position until it ends.
• Venues see a reward redemption code when you claim a reward, not your profile.
• We disclose information when required by law, such as a valid court order or a request from an investigative authority under applicable procedures.

We entrust some processing to service providers bound by contract to use the data only on our behalf. Providers in Korea: Kakao Corp. and NAVER Corp. (sign-in, if you choose them, and place and address search). Providers outside Korea are listed in section 7. Where Google or Apple sign-in, the app stores and maps act under their own terms, their processing is governed by their privacy policies.

Some providers process data outside Korea. The data is transferred over encrypted connections when you use the related feature, and is kept for as long as the provider needs to perform the service or until the end of our contract with them, unless stated otherwise below.

Cloudflare, Inc.United States and Cloudflare data centres worldwide

Network traffic including IP address; uploaded photos and videos (storage, delivery and video streaming). Purpose: security, content delivery and media storage.

OpenRouter, Inc. and the AI model providers it routes toUnited States and other provider locations

AI concierge messages and context you provide (such as taste and dietary preferences or a location), and menu photos you scan. Purpose: generating answers and translations. Requests are restricted to zero-data-retention providers that do not store or train on them.

Google LLC (Firebase, Google Sign-In, Google Maps Platform)United States

Push notification token and notification content; app usage events linked to your account ID (only if app analytics is on); Google sign-in identifiers if you use them; place search queries. Purpose: notifications, analytics, sign-in and place data.

Apple Inc.United States

Sign in with Apple identifiers if you use it; App Store purchases. Purpose: sign-in and payments.

Resend, Inc.United States

Email address, name and the content of service emails (verification codes, password resets, account notices). Purpose: email delivery.

Functional Software, Inc. (Sentry)Germany (EU)

Crash and error diagnostics including IP address, device information and your account ID. Purpose: finding and fixing errors.

RevenueCat, Inc.United States

Your account ID, subscription status and store transaction identifiers. Purpose: managing Premium subscriptions.

Mapbox, Inc.United States

Map tile requests including IP address; coordinates for walking directions and place-search queries. Purpose: maps and navigation in the app.

650 Industries, Inc. (Expo)United States

App update requests including IP address, device platform and app version. Purpose: delivering app updates.

You can refuse overseas transfer by not using the related feature (for example, turning off app analytics or not using the AI concierge), or by deleting your account. Some core features cannot work without these providers.

You can access, correct, delete or suspend the processing of your personal information, and withdraw consent, at any time:

• Edit your profile and visibility settings in the app.
• Download a copy of your data in the app (Privacy settings → Download my data).
• Delete your account in the app (Account → Delete account), which deletes your data as described in section 4.
• Turn app analytics off in Privacy settings, and location or notification permission off in your device settings.
• For anything else, email [email protected]. We respond within 10 days. A legal representative or someone you authorise may also make a request on your behalf.

The jinjja.io website does not use advertising or analytics cookies. It stores only small preferences in your browser, such as which hero scene you last saw. The partner portal uses cookies to keep you signed in and remember your settings; blocking them will sign you out.

The app uses on-device storage for your session and preferences, a random device identifier (sent to us only as a one-way hash for reward fraud prevention), and Firebase Analytics, which you can switch off in Privacy settings. We do not use advertising identifiers or cross-app tracking.

We protect personal information with technical, administrative and physical measures, including: encryption in transit (HTTPS/TLS) and encrypted storage of your session and data on your device; one-way hashing of passwords and device identifiers; role-based access for staff with logging of administrative access and actions; separate databases for sign-in data and app data; and minimising what we collect and deleting it on schedule.

If you allow it, we use your device location to:

• show nearby places, events and tables and rank what you see — used for that request and not stored with your account;
• answer location-aware AI concierge questions;
• verify that you are at the venue when you scan a reward tag — the scan's coordinates are stored with that stamp or redemption to prevent fraud (erased after 30 days);
• share your live position with the members of a food crawl, only while you have sharing switched on (including in the background, for up to 8 hours).

As the Act on the Protection and Use of Location Information requires, we keep a record each time location is used or provided, storing a coarse area rather than your exact position, for 2 years. You can withdraw location permission in your device settings at any time; the Service still works without it, though nearby results, reward verification and crawl sharing will not.

Location Information Manager: Li Vladislav, CTO, Jinjja Labs Inc. — [email protected].

The Service is not intended for children under 14 and we do not knowingly collect their personal information. We check age at sign-up. If we learn that a child under 14 has created an account, we delete it. If you believe this has happened, contact us.

Under Article 31 of PIPA, our Chief Privacy Officer is responsible for protecting personal information and handling complaints and requests:

Chief Privacy Officer: Li Vladislav, CTO, Jinjja Labs Inc. — [email protected]

If you need further help with a privacy complaint, you can contact the Personal Information Infringement Report Center (privacy.kisa.or.kr, 118), the Personal Information Dispute Mediation Committee (kopico.go.kr, 1833-6972), the Supreme Prosecutors' Office Cyber Investigation Division (spo.go.kr, 1301) or the Korean National Police Agency Cyber Bureau (ecrm.police.go.kr, 182).

We will announce changes to this Privacy Policy in the Service at least 7 days before they take effect, and at least 30 days before for significant changes to how we collect or use your information. Previous versions are available on request.