Privacy Policy
Effective date October 1, 2026
Alimi (알리미) (the “Company”) provides the DoNow service (the “Service”). To comply with the Personal Information Protection Act (「개인정보 보호법」) and other applicable laws and to handle users’ personal information safely, the Company establishes this Privacy Policy as follows. The Service is designed to store memos on the user’s device first, which keeps the personal information the Company processes to a minimum.
This is an English translation provided for convenience. If it differs from the Korean version, the Korean version prevails.
1. Personal information processed and purposes
| Category | Items | Purpose |
|---|---|---|
| Sign-up and login (Google account) | Google account unique identifier, email address, name | Identifying members, keeping users logged in, responding to inquiries |
| When using sync | Google Drive access token (stored encrypted), sync file identifier, encryption settings (key-derivation value and encrypted key), per-memo identifier and modified/deleted times | Syncing memos across multiple devices |
| When requesting AI classification learning | Body of memos whose category the user corrected, category names before and after the change, daily usage count | Improving memo classification accuracy, managing usage limits |
| Link preview | Link addresses contained in memos, connecting IP address | Looking up a link’s title and preview image, limiting excessive requests |
| Generated automatically while using the Service | Login session information (cookies) | Keeping users logged in and security |
| Collected automatically when using the website (donow.today) | Address of pages visited (excluding everything after ‘?’), page title, visit time, referral source, device, browser and operating system information, approximate region inferred from the IP address, cookie identifier | Usage statistics and service improvement (not for advertising) |
Website usage statistics do not include memo content, memo identifiers, or link addresses that users share or save. Installed apps and admin screens made by the Company are excluded from the statistics.
Memo content such as body, title, category and tags is not stored on the Company’s servers (except for the AI chat connection described below). Memos are stored on the user’s device (browser storage), and even when sync is turned on they are stored, encrypted on the device, in the user’s own Google Drive, so the Company cannot see them. However, only when the user requests AI classification learning, the body of that memo is passed to the vendor in item 4 below.
If you connect an AI chat (claude.ai, ChatGPT, etc.): conversation notes that the AI asks to save are kept on the server, locked with a key only the user can open, until the user opens DoNow, and are then moved and deleted. On the web chat connection screen, ‘Search even when device is off’ is on by default; users can turn it off before allowing the connection, and can turn it off at any time after connecting under Settings > AI connection. For connections where this feature is on, an encrypted copy of the memos in the scope the user has chosen (title, body, category, tags) is kept on the Company’s servers, and the Company’s servers can read this copy in order to answer the AI’s search requests. The copy is refreshed each time DoNow is opened, and is deleted immediately when the feature is turned off, the connection is disconnected, or the connection is automatically released after going unused for 30 days.
2. Retention and use period
- Member information and sync-related information: until the member withdraws. On withdrawal it is deleted automatically and immediately, and is not kept on the server.
- Payment and refund records (where a payment occurs from using a paid plan): in accordance with the Act on the Consumer Protection in Electronic Commerce, etc. (「전자상거래 등에서의 소비자보호에 관한 법률」), records on contracts or withdrawal of offers and records on payment and the supply of goods are kept for 5 years, and records on consumer complaints or dispute resolution are kept for 3 years, and then destroyed without delay. These records are not deleted when a member withdraws; only their link to the member account is severed, and they are kept for the periods above.
- Login session: up to 30 days. When the user logs out, that session is deleted immediately.
- Body of memos in AI classification learning requests: not stored by the Company; only the daily usage count is kept.
- Website usage statistics: kept for the retention period set in Google Analytics (2 months), then deleted automatically.
- Link addresses in link previews: not stored. The connecting IP is handled only temporarily in server memory for rate limiting and is not separately recorded.
Where retention is required under applicable laws, information is kept for the period those laws specify.
3. Provision of personal information to third parties
The Company does not provide users’ personal information to third parties, except where otherwise specifically provided by law.
4. Outsourcing of processing and overseas transfer
The Company outsources the processing of personal information for providing the Service as follows.
| Processor | Outsourced task | Storage location |
|---|---|---|
| HostHatch | Operating the service servers and storing member information | Republic of Korea (Seoul) |
In addition, personal information is transferred overseas when you use the following features.
| Recipient (contact) | Country | Items transferred | Purpose · when · method | Retention period |
|---|---|---|---|---|
| Google LLC (support.google.com/policies) | United States | Google account information, encrypted sync files | Login authentication; storing sync files in the user’s own Google Drive · at login and sync · transmitted over an encrypted network | Until the member withdraws or the user disconnects the Service in their Google account |
| OpenAI, L.L.C. ([email protected]) | United States | Body of memos whose category was corrected; category names before and after the change | Extracting classification keywords · when the user requests AI classification learning · transmitted over an encrypted network | According to OpenAI’s API data policy (kept up to 30 days then deleted; not used for model training) |
| Google LLC (support.google.com/policies) | United States | Website usage statistics items in item 1 | Analyzing usage statistics · on every website visit · sent automatically over an encrypted network (HTTPS) | Until the Google Analytics retention period (2 months) |
Users can refuse overseas transfer by not using sync and AI classification learning. Even then, basic features such as writing and searching memos remain available. Overseas transfer for website usage statistics can be refused by the method in item 8 below.
5. Procedure and method of destroying personal information
Personal information whose retention period has ended or whose processing purpose has been achieved is destroyed without delay. Electronic files are deleted by a method that cannot be recovered.
When a member withdraws from the settings screen, the following are deleted automatically and immediately: member information on the Company’s servers, Google access tokens, login sessions, encryption settings, AI usage counts, sync files stored in the app-only space of the user’s Google Drive, and the memos and settings stored in the browser of the device from which the user withdrew. The Service’s access to the Google account is also revoked at the same time. Memos remaining in the browsers of other devices can be erased by choosing to delete device data when logging out on that device, or by deleting this site’s data in the browser settings. However, payment and refund records are kept for the period set by law under item 2 above and are not deleted immediately on withdrawal.
6. User rights and how to exercise them
Users may at any time request access to, correction of, deletion of, or suspension of processing of their personal information, and can withdraw immediately by themselves from the settings screen. For other requests, contact the Personal Information Protection Officer in item 9 below by phone or through the contact page, and the Company will act without delay. Requests may also be made through a legal representative or an authorized agent.
7. Measures to secure personal information
- Memo sync data is encrypted on the device with AES-256-GCM before transmission, and the encryption key is protected by the user’s password, so the Company cannot know it.
- Google access tokens are stored encrypted with AES-256-GCM, and login sessions are stored only as hash values, not the original.
- All communication is encrypted with HTTPS, and access to servers and databases is limited to the minimum number of people.
8. Cookies and other automatic collection tools
The Company uses the following cookies.
- memo_session: keeping users logged in (up to 30 days)
- oauth_state: preventing forgery during login (10 minutes)
- _ga, _ga_*: cookies used by Google Analytics to distinguish visitors and compile usage statistics (up to 2 years)
The Company does not use advertising cookies and does not use usage statistics for personalized advertising.
You can refuse to store cookies in your browser settings. If you refuse the login cookie, you cannot use features that require login; if you refuse only the Google Analytics cookies, you can still use the Service as before. Google Analytics collection can also be blocked with Google’s ‘Google Analytics Opt-out Browser Add-on’ (tools.google.com/dlpage/gaoptout). In addition, memos, settings, on-device AI analysis results and the like are kept only in the user’s browser storage (IndexedDB, localStorage) and are not sent to the Company.
Voice input uses the speech recognition feature provided by the browser. Voice may be processed by the browser provider (e.g., Google for Google Chrome), and the Company does not collect or store voice.
9. Personal Information Protection Officer
- Name: Hongjun Park (박홍준) (Representative)
- Contact: 070-8095-7012
10. Remedies for infringement of rights
If you need consultation or to file a report about a personal information violation, you may contact the following organizations.
- Personal Information Dispute Mediation Committee (개인정보분쟁조정위원회): 1833-6972 (www.kopico.go.kr)
- Personal Information Infringement Report Center (개인정보침해신고센터): 118 (privacy.kisa.or.kr)
- Supreme Prosecutors’ Office (대검찰청): 1301 (www.spo.go.kr)
- National Police Agency (경찰청): 182 (ecrm.police.go.kr)
11. Children’s personal information
The Service is intended for users aged 14 or older and does not accept sign-ups from children under 14.
12. Changes to this Privacy Policy
This policy applies from October 1, 2026. If its content changes, users will be notified through the Service screen from 7 days before the change takes effect.
Notice of planned change (announced October 27, 2026; effective November 3, 2026)
- Item 1: On the AI chat (claude.ai, ChatGPT, etc.) connection screen, ‘Search even when device is off’ will be on by default. Users can turn it off before allowing the connection, and can turn it off at any time after connecting under Settings > AI connection. For connections where it is on, a copy of the memos in the scope the user has chosen is kept encrypted on the Company’s servers, and the Company’s servers can read it in order to answer the AI’s search requests.
Notice of planned change (announced October 28, 2026; effective November 4, 2026)
- Items 1, 2, 4 and 8: Google Analytics is used for website (donow.today) usage statistics. The address of pages visited (excluding everything after ‘?’), device and browser information, approximate region, and cookie identifier are sent to Google LLC (United States), kept for 2 months and then deleted. Memo content and link addresses that users share or save are not included, and the data is not used for advertising. You can refuse through your browser’s cookie settings or the Google Analytics opt-out add-on.