PALJA CHECK Privacy Policy
Effective September 15, 2026
This English version is a translation. If it differs from the Korean version, the Korean version prevails.
PALJA CHECK (“we”) provides the PALJA CHECK service (the “Service”). This policy explains what personal information the Service processes, why, on what legal basis, for how long, who else handles it, and how you can see, correct or delete it, as required by Korea's Personal Information Protection Act (the “Act”).
At a glance
- We keep your date of birth, optional time of birth and display name to calculate your daily score.
- If you don't sign in, your records are deleted 7 days after your last visit. Signed-in records stay until you delete them.
- We don't sell your information. We use Google Analytics to count visits and to see how our own ads on Google perform, and you can block or clear its cookies in your browser. Usage records for improving the Service stay on our own server.
- Account & settings → “Delete my data” deletes the record you have open. For your other records or your Google account link, write to contact@otoworks.ai.
1. Why we process personal information
We process personal information only for these purposes:
- Calculating your daily score, sector scores and 30-day chart from your date and time of birth.
- Keeping your records and streak when you sign in with Google, so the Service opens where you left off.
- Sending the daily reminder you turned on.
- Making the share cards and compatibility scores you ask for.
- Limiting how many new records one network can create in a short time, to prevent abuse.
- Counting how the Service is used, such as how many results were opened, to fix problems and improve it.
- Seeing how our own ads on Google perform, by counting whether a visitor who arrived from one of them opened a result.
- Building lists of people to show our ads to again (remarketing; see section 11).
2. What we collect and on what legal basis
| Kind | Items | When | Legal basis |
|---|---|---|---|
| Required | Date of birth (solar calendar), display name | When you ask for a score | Performance of the service contract (Art. 15(1)4 of the Act) |
| Optional | Time of birth | If you enter it | Performance of the service contract (Art. 15(1)4 of the Act) |
| Optional | Another person's date of birth, time of birth and name | If you run a compatibility check | Performance of the service contract (Art. 15(1)4 of the Act) |
| Optional | Google account identifier, email address and whether Google verified it | If you sign in with Google | Performance of the service contract (Art. 15(1)4 of the Act) |
| Optional | Push subscription (a delivery address issued by your browser, with its encryption keys) and your reminder hour | If you turn on reminders | Performance of the service contract (Art. 15(1)4 of the Act) |
| Created automatically | Record key issued to your browser, sign-in token (stored only as a hash), share cards (names and scores, no date of birth) | While you use the Service | Performance of the service contract (Art. 15(1)4 of the Act) |
| Created automatically | Usage records (which screens and actions, and when) | While you use the Service | Our legitimate interests (Art. 15(1)6 of the Act) |
We don't process any of these items on the basis of consent.
We don't collect your real name, phone number, location, contacts or payment details. Your IP address is not stored in the service database. To limit how many records one network can create, we keep a value converted from your IP address and the current hour, on the basis of our legitimate interests (Art. 15(1)6 of the Act); a daily job deletes it once it is older than 2 hours.
3. How long we keep it
| Information | Kept until |
|---|---|
| Records made without signing in (date and time of birth, name, scores, compatibility checks, share cards, reminders) | 7 days after your last visit, then deleted automatically. If a signed-in user's compatibility check includes the record, it is kept while that check exists. |
| Records of a signed-in account | You delete them (section 9) |
| Google account identifier and email address | You ask us to delete the link to your Google account (section 9) |
| Sign-in token | 30 days after it is issued, or when you sign out |
| Usage records | Every record tied to the same record key has been deleted |
| Push subscription | The record it belongs to is deleted. If the push service reports the subscription as gone, we stop sending at once. |
| Converted IP value used to limit abuse | Deleted by the daily job once it is older than 2 hours |
| Administrator access records | Kept for security audits, currently without a set deletion date |
If a law requires us to keep something longer, we keep only what that law requires, for that period, stored separately from other data.
4. How we delete it
When a retention period ends or you ask for deletion, we delete the data without delay. A job runs every day for expired records, and deletions you make in Settings are applied when you make them. Data is deleted from the database. We don't keep personal information on paper.
5. Sharing with third parties
We don't give your personal information to third parties, except where the law allows it, such as a lawful request from an investigative agency.
A share card you create can be seen by anyone who has its link. A personal card shows your name and scores; a compatibility card shows both people's names and the match score. No card shows a date of birth.
If someone who received your card enters their own date of birth to see their match with you, you both see both names and the match score. If you are signed in, that match and their record are kept while the match exists.
6. Outsourcing and transfers abroad
The Service runs on server infrastructure operated for us. Any provider that processes personal information on our behalf is listed in this section.
Reminders are delivered through companies outside Korea. As Article 28-8 of the Act requires, the details are:
| Recipient | Country | Information | When and how | Purpose and retention | How to refuse |
|---|---|---|---|---|---|
| Google: Google LLC (Google Analytics and Google Ads, policies.google.com/privacy) | United States | Cookie values that tell visitors and visits apart, your device and browser details, the screens you opened and how long you stayed, and an IP address Google truncates | Each time you open a screen, over HTTPS | Counting visits, measuring how our ads on Google perform, and remarketing (section 11). Retention follows the data-retention setting in Google Analytics (2 months by default, up to 14 months). | Block the cookies in your browser or install Google's opt-out add-on. You drop out of the statistics, the ad counts and the remarketing lists; the Service works the same. |
| The push service run by your browser's maker: Google (policies.google.com/privacy), Apple (www.apple.com/legal/privacy), Microsoft (privacy.microsoft.com), Mozilla (www.mozilla.org/privacy) | Where that company runs it (for example the United States) | Your push subscription address and the encrypted reminder | At the reminder hour you chose; encrypted HTTPS using the Web Push protocol | Delivering the reminder only. The reminder is encrypted, so the push service can't read it. | Turn reminders off in Settings. Reminders then stop. |
Signing in with Google: when you sign in on Google's page, Google sends us a token with your Google account identifier, email address, whether the email is verified, your name and your profile photo. We store only the first three, not the name or photo. We don't send personal information to Google.
7. Information about other people you enter
A compatibility check asks for another person's date of birth, time of birth and name. Tell that person and get their agreement before you enter it, and before you share a card that shows their name.
If you enter a child's date of birth as the other person, you are responsible for telling the child's parent or legal guardian and getting their agreement.
When you delete your own record, the other people's records you entered go with it, unless another compatibility check still uses them. You or the person whose information was entered can also ask us to delete it at contact@otoworks.ai.
8. Children under 14
You must be 14 or older to use the Service. You can't create your own record with a date of birth that shows you are under 14. Both the form and our server refuse it. If a child's information was entered as another person, the child's parent or legal guardian can ask us to delete it at contact@otoworks.ai, and we delete it without delay.
9. Your rights and duties, and how to exercise your rights
You can ask to see, correct or delete your personal information, or to stop its processing, at any time.
- See or correct your date of birth, time of birth and display name: Account & settings → “Birth details”.
- Delete the record you have open, with its scores, matches, share cards and reminders: Account & settings → “Delete my data”.
- Delete your other records, the link to your Google account or your sign-in tokens, or make any other request: write to contact@otoworks.ai.
- Someone can act for you, such as a legal guardian or a person you authorize. We will ask for proof of that authority.
- We reply within 10 days. If we can't do what you ask, we tell you why and how to object.
- Your duty: before you enter someone else's information, tell them and get their agreement (section 7).
10. How we protect it
- All traffic is encrypted with HTTPS.
- Sign-in tokens are stored only as hashes, and your IP address isn't stored in the service database.
- Only the people who run the Service can open its admin screen, and opening, changing or deleting an individual record there is logged with the administrator's account, the time and the administrator's IP address.
- Email addresses are masked on the admin screen. Only an administrator with a separate permission can see a full email address, for one user at a time, and each view is logged the same way.
- We collect only the items listed in section 2.
11. Cookies and browser storage
The Service uses Google Analytics (GA4, measurement ID G-WVWXF7HV4K) to count visits and to see how our own ads on Google perform. We link this Google Analytics account to our Google Ads account, so that when a visitor who arrived from an ad opens a result, Google Ads counts it as a result of the ad (a conversion). The advertising features are on, so Google may also use this record to build lists of people to show our ads to again (remarketing). Google Analytics sets these cookies in your browser:
- _ga: tells visitors apart. Kept for 2 years.
- _ga_WVWXF7HV4K: tells one visit (session) apart. Kept for 2 years.
To opt out, block or clear this site's cookies in your browser and install Google's opt-out add-on (tools.google.com/dlpage/gaoptout). Opting out only removes you from the statistics, the ad counts and the remarketing lists; the Service works the same.
It keeps a few items in your browser's own storage so it works without asking the server each time:
- Your session: record key, record ID, display name and, if you signed in, the sign-in token and email address.
- Your settings: theme, color-vision option, language and reminder choice.
- Your streak, and a copy of today's score for the open tab.
- Whether you've already seen the reminder prompt.
- Which animations and tips you've already seen, so they aren't shown again.
- Your account email, kept in the tab briefly after you sign in until your record is created.
Signing out removes the session. To remove everything, clear this site's data in your browser:
- Chrome and Edge: open site settings from the icon left of the address bar, then delete this site's data.
- Safari: Settings → Privacy → Manage Website Data, then remove this site.
- Firefox: open the padlock menu left of the address bar, then clear cookies and site data.
12. Sensitive information, pseudonymized information and automated decisions
The Service doesn't process sensitive information as defined in the Act, such as health information or political views, and doesn't create or use pseudonymized information.
Scores are calculated automatically, but they are for entertainment and have no significant effect on your rights or obligations, so they aren't automated decisions under Article 37-2 of the Act.
13. Privacy officer
- Privacy officer: Privacy team (contact@otoworks.ai)
- Privacy questions, requests and other questions: contact@otoworks.ai
14. Where else to get help
If you have a concern about how we handle your information, you can also contact these organizations:
| Organization | Website | Phone |
|---|---|---|
| Personal Information Infringement Report Center (KISA) | privacy. | 118 |
| Personal Information Dispute Mediation Committee | www. | 1833-6972 |
| Supreme Prosecutors' Office | www. | 1301 |
| Korean National Police Agency | ecrm. | 182 |
15. Changes to this policy
We announce changes on this page at least 7 days before they take effect, and at least 30 days before for changes that affect your rights.
- September 23, 2026: We now also use Google Analytics to see how our own ads on Google perform, and set that out (sections 1, 6 and 11). We also corrected the name of the session cookie. We collect no new item; only the use of what we already collect is wider, so this takes effect on the day it is posted.
- September 17, 2026: Set out that email addresses are masked on the admin screen, that only an administrator with a separate permission can see one user's full address at a time, and that each view is logged with the administrator's account, time and IP address (section 10). No item or purpose changed, so this version takes effect when it is posted.
- September 16, 2026: We added Google Analytics to count visits, and now disclose its cookies (section 11) and the transfer to Google abroad (section 6). Because this adds collected items, it takes effect 30 days after posting.
- September 15, 2026: Set out in full how the Service already processes personal information, including usage records, transfers abroad, information about other people, children under 14 and browser storage. No item or purpose changed, so this version took effect when it was posted.