This is an English translation of the Korean Privacy Policy. If the two versions differ, the Korean version prevails.
ITHUN Inc. (the "Company") processes the personal information of people who use the Alarmit website (https://alarmit.ithun.kr) and the Alarmit app (together, the "Service") in accordance with the Personal Information Protection Act of Korea and other applicable laws. Alarmit reads Hangul (HWP) or Excel tables, or tables you make yourself, and sends phone notifications at the times you set.
Sign-up and management of the ITHUN integrated account used for login are governed by the ITHUN portal's privacy policy. This policy covers the additional information processed by Alarmit.
1. Personal information we process
| Category | Items |
|---|---|
| Login (people who create alerts) | Member identifier received from the ITHUN account, display name (one of nickname, ID, or email), login session information |
| Workspaces and creating alerts | Workspace names, uploaded files (Hangul, Excel, Word) and table contents, alert titles, messages, and send times, entry codes, photos attached to instant alerts |
| AI table reading (optional) | AI service API keys entered by the user (Gemini, ChatGPT, Claude), images and table contents uploaded for AI reading |
| Receiving alerts (app) | Entry codes entered in the app, device push token for delivering notifications (issued and managed by Google Firebase), a device identifier created by the app |
| "My name on the site" (app, optional) | The name the recipient enters, the device push token and device identifier linked to that name, registration time |
| Document sharing (optional) | Display name of people who join through a share link (nickname if logged in, otherwise a randomly assigned animal name), the cell they are currently editing, a hash of the share password, a random value used to confirm access |
| Alert reports (app, optional) | Report reason, details written by the reporter, the reported alert's message, photo address, and received time, the entry code, an irreversible hash of the device identifier |
| Automatically generated information | Access logs such as IP address, access time, and browser and device information; cookies |
Recipients only need to enter an entry code; no account is required. "My name on the site" is optional. Only if a recipient enters it is the name shown on the code creator's site screen, so the creator can choose that person when sending alerts. The Company does not collect recipients' phone numbers or email addresses.
If the person creating alerts includes personal information such as other people's names in a table or photo, that content is stored and sent as alerts. Please include only what is necessary in alerts.
Alert history and bookmarks in the app are stored only on the user's phone and are not sent to the Company's servers.
When a workspace owner shares a document, the display names of people who joined through the share link and the cells they are editing are shown in real time to everyone viewing the same document. Share passwords are stored only as hashes that cannot be reversed.
2. Purposes of processing
- Verifying login and managing workspaces
- Reading tables to schedule alerts and sending them at the set times to phones that entered the entry code
- If a recipient entered a name, letting the creator choose that person when sending alerts
- Letting several people view and edit a document shared by the workspace owner, and showing who is currently viewing
- Receiving, reviewing, and acting on reports of inappropriate alerts (reports are seen by our team and by the creator of that entry code)
- Reading images and tables with the AI service chosen by the user
- Keeping the Service stable, including preventing abuse and investigating errors
- Answering inquiries and sending notices
3. How we collect it
- Receiving member information from the ITHUN portal when you log in with an ITHUN account
- Files and photos you upload, and information you enter on screen
- When you enter an entry code in the app, the app subscribes to those alerts; if you enter a name, that name and the push token are registered on the server
- Access logs and cookies generated automatically while you use the Service
4. Retention period
| Item | Retention |
|---|---|
| Login session | 14 days after login, or until logout |
| Workspaces, uploaded table contents, alert schedules, entry codes | Until the user deletes the workspace (uploading a new table deletes the previous one immediately). If you delete your ITHUN account, all of it is destroyed on request |
| Photos attached to alerts | Until the user requests deletion by emailing the privacy officer (deleting a workspace does not delete photos automatically) |
| Push token linked to "My name on the site" | Until the name is removed in the app or the entry code is removed. Deleted automatically if alerts can no longer be delivered because the app was uninstalled |
| Share display name and current cell | Only while the document is open. The access confirmation value expires automatically after at most 12 hours |
| Share password hash | Until the owner removes or changes the password, or turns off sharing |
| Alert reports | One year after handling is complete; longer if needed for a dispute or required by law |
| AI API keys | Until the user deletes them on the Settings screen |
| Sent alerts | If the phone is off, Google Firebase keeps them for up to 12 hours before delivery, then discards them |
| Access logs | Per Cloudflare's operating policy (usually a few days) |
Deleting a workspace also deletes its uploaded tables, alert schedules, and entry code, and alerts are no longer sent with that code. If the same entry code is used in another workspace, it remains until that workspace is deleted. Information that must be kept by law is stored separately only for the required period.
5. Provision to third parties
The Company does not provide users' personal information to third parties, except with the user's prior consent, where specifically required by law, or upon a lawful request from investigative or judicial authorities.
If a recipient enters "My name on the site", that name is shown, at the recipient's choice, to the creator of that entry code.
AI table reading sends requests to the AI service chosen by the user, using the user's own API key. Images and table contents sent at that time are handled under the terms and policies between that AI service and the user.
- Google Gemini: https://policies.google.com/privacy
- OpenAI ChatGPT: https://openai.com/policies/privacy-policy
- Anthropic Claude: https://www.anthropic.com/legal/privacy
6. Outsourcing of processing
| Processor | Outsourced task |
|---|---|
| Cloudflare, Inc. | Service hosting, data and photo storage, network operation |
| Google LLC (Firebase Cloud Messaging) | Delivering push notifications to phones (iOS devices via the Apple Push Notification service) |
We will announce any change to the outsourced tasks or processors through this policy.
7. Transfer of personal information abroad
To operate the Service, personal information is processed outside Korea as shown below. If you do not want this transfer, you may stop using the Service or ask the privacy officer to delete your information; in that case you cannot use the Service.
| Recipient | Country | Items transferred | Method and timing | Retention |
|---|---|---|---|---|
| Cloudflare, Inc. (privacy@cloudflare.com) | United States and other countries with Cloudflare data centers | All items in Section 1 | Transmitted over the network while using the Service | Same as Section 4 |
| Google LLC (https://support.google.com/policies) | United States | Alert titles, messages, and photo addresses, entry codes, device push tokens | Transmitted over the network when alerts are sent | Until delivered, or up to 12 hours |
8. Destruction of personal information
When the retention period ends or the purpose has been achieved, we destroy the information without delay. Electronic files are deleted in a way that cannot be recovered.
9. Your rights and how to exercise them
- You may at any time request access to, correction or deletion of, or suspension of processing of your personal information.
- You can edit or delete workspaces, alerts, and AI keys directly in the Service; for other requests, email the privacy officer.
- Removing an entry code in the app stops alerts from that code. You can change or remove "My name on the site" in the app at any time. You can also turn off Alarmit notifications in your device settings.
- Children under 14 must have the consent of a legal guardian to use the Service.
10. Cookies and storage
On the website we use a session cookie (sched_session, up to 14 days) and a re-login check cookie (sched_reauth, 30 minutes) to keep you logged in, and a language cookie (alarmit-lang) to remember your language. Display preferences are stored only in your browser. You can block cookies in your browser settings, but features that require login will not work. The animal name and access value of people who joined through a share link are stored only in their own browser so they can rejoin. The app stores entry codes, received alerts, and bookmarks on the phone. The Company does not use cookies or tracking tools for advertising or behavioral analysis.
11. Security measures
- All communication is encrypted with HTTPS (TLS).
- Session cookies are issued with the HttpOnly and Secure attributes so scripts cannot read them.
- Workspaces and AI keys are stored separately per account so only the logged-in owner can see them, and key values are not shown again.
- Alert photos are stored at random addresses that are hard to guess.
- Document share links use random codes that are hard to guess, and entry is temporarily blocked after repeated wrong passwords.
- Access to personal information is limited to as few people as possible.
12. Privacy officer
- Name: Park Suhun (박수훈), CEO
- Email: admin@ithun.kr
- Address: 전남광주통합특별시 북구 서양로 155, 121-2503, Republic of Korea
You may also report or seek advice about privacy violations from the following Korean organizations.
- Personal Information Infringement Report Center: 118 (no area code), privacy.kisa.or.kr
- Personal Information Dispute Mediation Committee: 1833-6972, www.kopico.go.kr
- Supreme Prosecutors' Office Cyber Investigation Division: 1301 (no area code)
- Korean National Police Agency Cyber Investigation Bureau: 182 (no area code)
13. Changes to this policy
We will announce changes on this page at least 7 days before they take effect, and at least 30 days before for changes that significantly affect users' rights.
Previous versions: v1.1 (October 21, 2026), v1.0 (October 15, 2026, as ItPush)