Tooni Privacy Policy

1. Why we process personal data

We process personal data for the purposes below, and we do not use it for anything else. If a purpose changes, we take the steps required by law before using the data for the new purpose.

• Providing the Service — identifying your account, storing your work (drawings, cuts, projects) and syncing it across your devices
• AI generation — creating characters, poses, backgrounds and panels from the descriptions (prompts), sketches and photos you provide
• Subscription management — checking your plan, counting monthly generations, reflecting payment status
• Answering your questions, diagnosing errors, and statistical analysis to improve the Service
• Preventing abuse — blocking abnormal requests, enforcing the two-device limit per account
• Meeting legal obligations and handling disputes

Intended use: Tooni is a creative tool for drawing comics and webtoons. Its AI features exist only to help you make those drawings. It is not provided for medical, legal, credit-scoring, or any other use that produces legal effects or similarly significant consequences for a person.

2. What we process

We process the following on the basis of performing our contract with you (Article 15(1)(4) of the Personal Information Protection Act). Anything requiring consent is collected only after we ask for it.

• Sign-up — email, password (stored one-way encrypted), display name
• Social sign-in — the account identifier, email and display name provided by Apple, Google or Kakao
• Using the Service — the content you draw or generate (drawings, cuts, project files, generated images), the descriptions (prompts) you enter for AI generation, and photos you choose to upload
• Payment — subscription status and transaction identifiers. We never collect or store card numbers; Apple or the payment processor handles those directly.
• Automatically generated — access time, IP address, device information (model, OS), browser information, usage records (such as generation counts), and error logs
• Support — your email address, your message, and any device details you include

We do not process sensitive data or national identification numbers. Please do not enter your own or anyone else's sensitive or identifying information into prompts or uploaded photos.

3. Personal data in AI generation

When you request an AI generation, the description (prompt) and any reference images in that request — your canvas sketch, a photo you selected — are sent to an external AI model provider and used to produce the resulting image.

• Recipients — Google LLC (Gemini family models) and OpenAI, L.L.C. (image generation models)
• Purpose — strictly limited to fulfilling that generation request
• Retention — prompts and generated results are stored in your account as your work, and are deleted when you delete them or close your account

We do not use your prompts or generated results to train, fine-tune, or otherwise improve AI models. Because of that, there is no training opt-out for you to configure.

If you register your own API key, that request is sent to the model provider under your own account and the provider's policy applies to it as well. Please review each provider's published data practices.

4. Children under 14

The Service is not directed at children under 14, and we do not knowingly collect their personal data. If we learn that we have, we destroy it without delay. A legal guardian may contact us at the address below to review or request deletion.

5. How long we keep data

We destroy your personal data without delay when you close your account, including the work and generated images you created. The following records are kept for the period required by law and then destroyed.

• Records of contracts and withdrawal of subscription — 5 years (Act on Consumer Protection in Electronic Commerce)
• Records of payment and supply of goods — 5 years (same Act)
• Records of consumer complaints and dispute handling — 3 years (same Act)
• Access logs — 3 months (Protection of Communications Secrets Act)

6. How we destroy data

Once the retention period ends or the purpose is fulfilled, we destroy the data without delay.

• Procedure — we identify the data due for destruction and destroy it under the review of our privacy officer. Data we must retain by law is moved to a separate database, kept apart until the retention period ends, and then destroyed.
• Method — electronic records are permanently erased by a method that prevents recovery, including image objects held in our storage (S3). We hold no personal data on paper.

7. Sharing with third parties

We do not provide your personal data to third parties, except where you have consented or where the law requires it.

When you share something you made to another app (Photos, Messages, a social app), that sharing happens through your device's own share sheet, by your action, without passing through our servers. What happens after that is governed by the receiving app's privacy policy.

8. Processors we use

We entrust parts of our processing to the following providers.

Our contracts with these providers set out how personal data must be protected, and we supervise their compliance. If the work or the providers change, we will publish the change in this policy.

9. International transfers

We transfer personal data outside the Republic of Korea as follows.

Domestic payments in KRW (NICE Payments) are processed within Korea and are not transferred abroad.

You may refuse these transfers. If you do, the features that depend on them — AI generation, payment, social sign-in — may become unavailable. Contact us at the address below to refuse.

10. How we keep data safe

• Organisational — an internal management plan, the fewest possible people with access, and managed access rights
• Technical — passwords stored with one-way encryption, HTTPS (TLS 1.2+) throughout, retained access logs, and access-control systems
• Physical — our servers run in our cloud providers' data centres, under their physical safeguards

11. Cookies and automatic collection

The app does not use cookies. Our web pages (payment and information pages) use only the cookies needed to provide the service, such as keeping you signed in. You can refuse cookies in your browser settings, though some features may then stop working.

We do not collect behavioural data for advertising, and we do not allow third parties to collect it.

12. Automated decisions

We do not make fully automated decisions that affect your rights or obligations. AI generation produces images at your request; it is never used to evaluate or judge you.

13. Your rights and how to exercise them

You, or your legal guardian, may exercise the following rights at any time.

• Request access to, correction of, deletion of, or suspension of processing of your personal data
• Delete your account — in the app's settings screen, or by contacting us
• Cancel a subscription — iOS Settings ▸ Apple Account ▸ Subscriptions, or the management link in your payment email for web purchases
• Refuse international transfers of your data

Send your request in writing (email is fine) and we will act on it without delay. A legal guardian or an authorised representative may act for you; we may ask for a document confirming that authority.

14. Privacy officer

We have designated a privacy officer who is responsible for our handling of personal data and for responding to your questions, complaints and remedy requests.

• Privacy officer — Gunhee Kim (CEO)
• Department — Privacy
• Email — victor.kim@twostepsahead.co.kr
• Phone — +82 10-9990-7868

15. Where to seek remedy

If your rights have been infringed, you may apply to the following Korean authorities for mediation or advice.

• Personal Information Dispute Mediation Committee — +82 1833-6972 (www.kopico.go.kr)
• Privacy Infringement Report Centre — +82 118 (privacy.kisa.or.kr)
• Supreme Prosecutors' Office, Cyber Investigation — +82 1301 (www.spo.go.kr)
• National Police Agency, Cyber Bureau — +82 182 (ecrm.police.go.kr)

16. Changes to this policy

If this policy changes, we will announce it in the Service or by email and post it here so you can compare the old and new versions. Significant changes are announced 7 days in advance, or 30 days in advance where the change is unfavourable to you.