Coupledger둘이모아

Coupledger privacy policy

NodeX Inc. (주식회사 노드엑스, "we") runs the shared household budget app Coupledger (Korean name 둘이모아 · Android kr.nodex.dulimoa, "the app") and the website coupledger.com. This policy explains what personal information we handle and how.

The app has no sign-up or login. We never ask for your real name, phone number, email, date of birth or address. The app has no ads.

1. What we collect

1.1 What you enter in the app (stored on our server)

  1. Household name and invite code (when you start a household)
  2. Nickname and colour (when you join)
  3. A round profile photo — optional (JPEG, shrunk to 32 KB or less)
  4. Household records — amount, date, category, memo, payment method, who it belongs to (a member or "joint"), instalment months, recurring-bill rules, accounts, savings, deposits and loans, spending and savings goals (name, a short motto, chosen picture, order), your own categories (name, picture), comments and seen marks on records, app settings, "report viewed" marks, and the "no spending today" mark you can choose from the daily report or the evening reminder (the date only — no amount or details)

1.2 Created automatically while you use the app or website (stored on our server)

  1. Device connection — a random access token made for each device (we store only its hash, never the token itself), a random device number, when it connected, and when it was last seen (recorded at most every 10 minutes). We do not collect phone model, OS version, phone number, email or advertising ID.
  2. Server program log — the kind of address requested (it can include the random number of a household, member or device), the result and how long it took. When an invite code, reconnect code or nickname is entered wrongly, we keep an 8-character fingerprint of the sender's IP address instead of the IP itself. The fingerprint cannot be read as an IP address directly, but matched against the access log (item 3) of the same time it can reveal the IP, so we use it only to look into outages and abuse (attempts to guess codes).
  3. Access log (kept by the program that receives app and website traffic in front of our server) — time, only the first part of the IP address (IPv4: the first three groups · IPv6: the first 48 bits — the rest is zeroed before it is written), connection port, request method, address and host, encryption used, and the response status, size and time. Request headers (access tokens, browser type and so on) are not kept.
  4. When we received a web "delete account & data" request (section 7.3). The invite code and nickname you type there are used only to check the request and are not stored.
  5. Deletion log — each time a household, member, device or record is deleted, and each time a web deletion request is received or cancelled or the invite code is changed by hand (the code itself is not kept), one line with only the random number of what it was about, the kind and the time (no names, household names, codes, amounts or memos). We keep it so that, if we restore the service from a backup, we can delete again what was deleted since, and keep received deletion requests and changed invite codes as they were.

1.3 Collected by Google when you use receipt scanning (Google ML Kit · built into the app · reads text on your phone)

  1. Device information (maker, model, OS version), app information (package name, app version), a per-installation identifier (not meant to identify you or your device)
  2. Performance and diagnostic metrics — time taken, image format and resolution, input and output size, event type (start, recognise, close), error codes

The receipt photo and the text and amounts read from it never leave your phone — not to Google, not to us. A record is saved only after you tap to confirm it, as an ordinary household record (1.1, item 4).

1.4 Kept only on your phone (never sent to our server)

Notification settings, app lock PIN, display settings, the copy of the household on your phone, report pictures (saved as one image to your phone's gallery — not sent to us), and spreadsheet (CSV) files you export. Receipt photos are deleted as soon as they are read and are not stored on your phone or our server (a camera photo sits only in the app's temporary folder until recognition finishes, is cancelled or fails; a photo picked from your gallery is read, not copied).

2. Why we use it

  1. To keep the household in step across members' phones and to show statistics and reports (the daily report and evening reminder notifications are made on your phone — their content is not sent to our server or anyone else)
  2. To recognise devices and keep others out of your household (access tokens, limits on wrong invite codes)
  3. To find and fix outages (server program log, access log, backups · the deletion log only to delete again what was deleted after a restored backup, so that a received deletion request is not lost, a cancelled one does not come back, and a changed invite code does not return to the old one)
  4. To carry out deletion requests you make (the time a request was received)
  5. Receipt-scanning diagnostics and usage analysis — Google processes the metrics in 1.3 for its own purposes. We do not receive them.

3. How long we keep it

WhatHow long
Household, members, records, profile photos (1.1)While the household exists, except:
① When a member chooses "Leave household" or is removed by the other member ("Remove"), their nickname, profile photo, device connections and reconnect codes are deleted from the server immediately. Their records stay in the shared household, shown as "Former member".
② If you choose "Also delete my records" when you leave, records, payment methods, savings and accounts, loans, recurring bills and spending goals in your name, plus your comments and seen marks, are deleted immediately on the server and on the other phone. "In your name" means the record's "Whose" field is you, whoever typed it in. Records marked "joint" and records in the other member's name stay.
③ When the last member chooses "Delete and leave", the whole household — members, all records and device connections — is deleted from the server immediately.
④ A web deletion request is carried out in the next early-morning server clean-up (daily at 03:30 Korea time · on a day the server is restarted, also once at start-up) after 7 days have passed since we received it (section 7.3).
A single deleted recordIt disappears from both phones. The server keeps only a "deleted" marker (record number, times, member number of who wrote it). The content, such as amount and memo, is removed in the next server clean-up (daily at 03:30 Korea time · on a day the server is restarted, also once at start-up) after the record has been deleted for one day. The marker stays while the household exists, so the phones do not create the same record again.
Device connectionUntil the phone is disconnected ("Disconnect phone", or "Disconnect" in the list of connected phones), or its member leaves or is removed
Reconnect code10 minutes after it is made, or as soon as it is used
Time a deletion request was receivedRemoved when the request is carried out or cancelled (the times it was received or cancelled stay in the deletion log for its keeping period)
Server program logA new file every 20 MB · up to 5 old files (at most 120 MB) — the oldest is deleted automatically
Access logA new file every 10 MiB · up to 5 old files — the oldest is deleted automatically
Restore hints (record fingerprints and edit times kept after we restore the server from a backup)30 days
Deletion log (only the random number, kind and time of what was deleted, of received or cancelled deletion requests and of invite codes changed by hand · no code text, names, amounts or memos · kept to delete again after a restore)800 days — older lines are removed in the early-morning server clean-up (it tidies up once the oldest line passes 830 days, so at most about 830 days). It is also uploaded with the off-site backup and stays in those copies for their keeping period (up to 24 months).
Server disk backupMade once a day; only the latest 2 (about 2 days) are kept
Off-site backup (encrypted copy)Uploaded once a day · we keep one per day for the last 14 days, one per week for the 8 weeks before that, and one per month for the 24 months before that; the rest is deleted automatically (the oldest copy is about 2 years old)
Copies made just before a server upgrade, a server move or a restoreNot deleted automatically; we delete them ourselves once no longer needed. On request we delete them within 10 days (section 10).

4. Sharing and transfers abroad

  1. We do not share your household information with anyone else.
  2. Our server and backups are in Seoul, Republic of Korea. Household information is not moved to another country.
  3. When you use receipt scanning, Google ML Kit sends the information in 1.3 to Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA · https://policies.google.com/privacy), to the United States and other countries where Google runs servers, over an encrypted connection, for service diagnostics and usage analysis (ML Kit terms: https://developers.google.com/ml-kit/terms). Google keeps it under its own privacy policy. If you do not use receipt scanning, nothing is sent; you can still enter records with the number pad.
  4. If you email us (ceo@nodex.co.kr), your email address and message pass through our domain's mail forwarding service (Cloudflare, Inc. · USA) to the mailbox we have chosen. The mail service that runs that mailbox may also keep its servers outside Korea. You never need to email us to delete your account or data — use the app (7.2) or the web form (7.3).

5. Service providers

ProviderWhat they do
Amazon Web Services, Inc. (Amazon Lightsail · Asia Pacific (Seoul) region)Provides our server and backup storage (we rent the equipment). Data stays in the Seoul region. Off-site backups are encrypted by us before upload, so the provider cannot read them.

Cloudflare answers DNS (domain name) lookups for coupledger.com, but app and website traffic goes straight to our server, not through Cloudflare.

6. How data is destroyed

  1. Information is deleted automatically at the times in section 3. Only the copies made before a server upgrade, move or restore are deleted by us by hand.
  2. Our database overwrites deleted entries with zeros. Backup files are deleted automatically when their keeping period ends. We have no paper records.
  3. Information deleted by leaving, removing, deleting a household or a web request can remain for a while in backups made before the deletion (server 2 days · off-site backup up to 24 months), but if we restore the service from a backup, we delete again the households, members and records deleted since that backup before the service opens. If the whole server is lost and we can restore only from the off-site backup, deletions made after the last off-site backup (once a day) may not be repeated. Backups are used only to recover from outages and are deleted automatically when their keeping period ends.

7. Your rights and how to use them

  1. See, correct and delete — you can view, edit and delete your records and profile photo in the app. You can change your nickname and colour; to remove your nickname, use "Leave household" (7.2).
  2. Delete your account in the app — More › Delete account (or More › Members & invite code › Leave household). It does not go through us.
    • "Leave household" — your nickname, photo and device connections are deleted from the server, and the household copy on this phone is deleted. Turn on "Also delete my records" to delete the records in section 3 ② as well (off by default · cannot be undone).
    • "Remove" — removes the other member. On the server it is the same as leaving (records stay); the removed phone can no longer reach the server. The copy on the removed phone is deleted when "Start over here" is tapped on that phone.
    • The last member leaves with "Delete and leave", which deletes the whole household from the server. This cannot be undone.
    • Disconnect a device — this phone: More › Sync › Disconnect phone; a lost phone: the list of connected phones in More › Members & invite code (household data stays).
  3. No phone? Request deletion on the web — enter the invite code at coupledger.com/en/delete/ (and the nickname, to delete one member).
    • We accept it only if no phone in that scope (whole household = all current members · one member = that person) has connected for more than 7 days. If a phone is in use, delete from that phone.
    • We wait 7 days; after that the server deletes it automatically in the next early-morning clean-up (daily at 03:30 Korea time · on a day the server is restarted, also once at start-up). If any phone in that scope connects in the meantime, the request is cancelled automatically. If we restore the service from a backup, any pending request is rescheduled to 7 days from the day of the restore.
    • What is deleted — one member: the same as "Leave household" with "Also delete my records" (the whole household if no member is left). Whole household: the same as the last member's "Delete and leave".
    • No person at our company reviews or handles the request. You do not need to email us.
  4. For anything else (information left in backups, stopping processing and so on), email us (section 10). We act on it and tell you the result within 10 days of receiving it.
  5. We do not knowingly process information of children under 14 (Korea) or under 13 (United States). The app is for couples aged 18 or over. If we learn we hold a child's information, we delete it.

8. Ads, tracking and cookies

The app has no ads. We do not collect advertising IDs or behavioural information (records of your app or web use used to guess your interests), and we have not added anyone else's tracking or analytics tools. The website uses no cookies and loads no outside fonts or scripts. Because we do not track you across sites or apps, we do not respond differently to browser "Do Not Track" signals — there is nothing to switch off. If we ever add ads, we will update this policy at least 7 days before.

9. How we protect it

10. Contact and privacy officer

Send requests to see, correct, delete or stop processing your information, and any questions, to the email above. We act on them and tell you the result within 10 days of receiving them.

11. If you live outside Korea

12. Changes to this policy

If we change this policy, we post the change on this page at least 7 days before it takes effect. The Korean version is at 한국어; if the two differ, the Korean version applies.