Effective date: May 22, 2026

Canary (the "Service") values users' personal information and complies with the Personal Information Protection Act and related laws. This policy explains the information the Service collects, its purposes of use, retention periods, and users' rights.

1. Personal Information Collected
- Email address (Apple / Google social login)
- Unique social account identifier (User ID) (Apple / Google social login)
The Service does not collect any personal information beyond the items above. Payment information, location data, and contacts are not collected.

2. Purposes of Collection and Use
- Member identification and maintaining login state
- Providing overseas food recall alert services
- Handling service-related inquiries

3. Retention and Use Period
Collected personal information is retained until the user withdraws from the Service or revokes consent. Upon a withdrawal request, information is destroyed without delay, except where law requires retention, in which case it is kept for the applicable period before destruction.
- Act on Consumer Protection in Electronic Commerce – records of contracts/withdrawal of offers: 5 years
- Act on Consumer Protection in Electronic Commerce – access logs: 3 months

4. Outsourcing of Personal Information Processing
To operate the Service smoothly, the following processing is outsourced.
- Supabase, Inc.: database and authentication infrastructure operation (United States)
- Google LLC: Google social login authentication (United States)
- Apple Inc.: Apple social login authentication (United States)
Processors may not process personal information for purposes other than those entrusted, per contract.

5. Provision to Third Parties
The Service does not provide personal information to third parties without the user's consent, except where required by law.

6. User Rights and How to Exercise Them
Users may exercise the following rights at any time.
- Request to view personal information
- Request to correct or delete personal information
- Request to suspend processing of personal information
- Withdraw from the Service (delete account)
Requests sent to the Data Protection Officer's email below will be processed without delay.

7. Automatic Collection Devices
The Service does not use advertising identifiers (IDFA/GAID), cookies, behavioral tracking SDKs, or any other device that automatically collects personal information.

8. Children Under 14
The Service does not intentionally collect personal information from children under 14. Use of the Service by children under 14 is restricted.

9. Data Protection Officer
- Officer: Jaehyun Kim
- Email: seongpilryu@gmail.com
- Contact hours: weekdays 09:00–18:00 (excluding public holidays)

Reports and inquiries related to personal information infringement may be directed to the following agencies.
- Personal Information Infringement Report Center: privacy.kisa.or.kr / 118
- Personal Information Dispute Mediation Committee: kopico.go.kr / 1833-6972
- Supreme Prosecutors' Office Cyber Investigation Division: spo.go.kr / 1301
- National Police Agency Cyber Bureau: ecrm.cyber.go.kr / 182

10. Changes to This Policy
This policy may be revised due to changes in law or the Service. Changes will be announced in-app or by email 7 days in advance.

This policy is effective as of May 22, 2026.