Privacy Policy

1. Information we collect

Email registration: we process your email address, password, display name and selected language. We use Supabase Auth for email and password authentication; in the App we also process the verification code you receive by email.

Google or Kakao sign-in: we process the user identifiers, email address and profile information (name and profile photo) supplied within the provider's sharing scope.

Apple sign-in: we process the user identifier Apple provides for the service. If an email address is shared with us, we use it for account identification and communication. If you choose Hide My Email, we receive an Apple-generated relay address instead of your actual email address.

Using the Service: we process profiles, project records, work photos and files, palettes, wishlists, comments, schedules and other information you enter or upload, as well as usage records, access logs and cookies (Website).

Consent records: we store whether and when you accepted the Terms of Service and this Privacy Policy and whether you chose to receive notifications, together with your member information.

Store links (Website): when you click a link on the Website that takes you to a store, we record which product you clicked, which project you came from, and the date. Members are distinguished by their member identifier and non-members by a random identifier stored in the browser. Multiple clicks on the same product in one day are counted once.

Contact and reports: we receive your name, email address, message or report and selected language. If you email us directly, we receive your sender address and the content you send.

Under 14: only people aged 14 or older may register for the Service, and we do not collect personal information from children under 14. If we learn that a child under 14 has registered, we delete the account and its information without delay.

2. Purposes and grounds for processing

Information needed to identify members, handle sign-in, authentication and account recovery, and save or post requested projects, works and files is processed to enter into and perform the service agreement (Article 15(1)(4) of Korea's Personal Information Protection Act).

Information received through inquiries is used to understand and answer them. Authentication and recovery emails and necessary service notices are distinguished from advertising and marketing communications.

Notifications: for members who agreed to receive notifications, we provide activity notifications such as comments and likes, and schedule reminders the member sets. You can change this at any time in the App settings. We do not send advertising (marketing) messages before obtaining separate consent.

Store-link click records are used to measure actual referral traffic and to support listing or partnership proposals to stores and brands. This processing rests on our legitimate interest in operating and sustaining the service (Article 15(1)(6) of Korea's Personal Information Protection Act). We do not combine these records with advertising identifiers or share them externally in a form that identifies an individual.

For processing based on consent, we separately explain the purpose, information, retention period, right to refuse and consequences of refusal. Reading this policy is not consent to all processing. Refusing optional purposes does not prevent use of essential member services.

3. Retention

Member information and saved content are retained to provide your account and requested services. When you delete your account, we immediately delete your profile, projects, works and comments, uploaded files and consent records; backups expire within 30 days at most. We also delete personal information without delay when it is no longer needed after a retention period expires or its purpose is fulfilled.

Information that must be retained by law is kept only for the items and periods that law requires. Using a link to an external seller does not, by itself, cause e-commerce record retention periods to apply to all member information.

Store-link click records are kept for three years from the date of collection and deleted thereafter.

Contact and report materials are kept for three years after handling and any appeal are complete, then deleted.

Deleting your Ssuessueknits account is separate from deleting your Google, Kakao or Apple account itself. Disconnecting sign-in at the provider alone does not delete information stored in the Service. We cannot directly delete content others have already downloaded or copied.

4. Processing entrusted to others and cross-border transfers

The Service entrusts the processing of personal data to the providers below. Each processes the data only within the scope of the work entrusted to it.

Supabase, Inc. (United States) — member authentication (including sending authentication emails such as sign-up confirmation and password reset), database and file storage. Data transferred: email address, encrypted password, nickname and profile, content you upload, and access records. Member data and files are stored in the Republic of Korea (Seoul region); because the operating company is a United States entity, it may access the data from outside Korea for operations and technical support.

Cloudflare, Inc. (United States) — web hosting, Service API processing and content delivery (CDN). Data transferred: access IP, request information and access logs. Requests are handled through servers distributed worldwide.

Formspree, Inc. (United States) — receiving and forwarding contact and report forms. Data transferred: the name, email address, message and language you enter in the form.

Google LLC (United States) — email exchanged with our published contact address is handled through Gmail. Data transferred: the sender's email address and the contents of the exchange. Authentication and recovery emails are sent as part of member authentication.

Google LLC (United States) — sending mobile push notifications through Firebase Cloud Messaging. Data transferred: device push token and notification content (sender name, post or project title). On iPhone, notifications are delivered through Apple’s push notification service.

Timing and method of transfer: data is transmitted over the network at the moment you use the relevant feature. Retention by the recipient: for the period needed to perform the entrusted work; deleting your data on the Site ends the purpose of the entrustment. Each provider's contact details and processing practices are set out in its own privacy policy.

You may refuse the cross-border transfer. However, these providers perform the sign-up, sign-in, content storage and contact intake functions themselves, so if you refuse we cannot provide those functions and your use of member services will be limited. Please tell us at the contact below if you wish to refuse.

Google, Kakao and Apple provide the social sign-in authentication you select. Their own processing for their services is also subject to their respective privacy policies. This policy applies to the member information the Site receives and processes.

Apple App Store and Google Play distribute, install and update the App independently under their own terms and privacy policies. We do not receive information from the stores that identifies individual users.

5. Cookies (Website)

The Website uses essential cookies to keep you signed in. The App does not use cookies (Section 9).

To count store-link clicks without duplicates, we store a cookie (ssk_cid) containing a random identifier in the browsers of non-member visitors, kept for up to 400 days. This cookie contains no directly identifying information such as your name or email address.

If we use tools for optional purposes, such as Google Analytics (usage analysis), Microsoft Clarity (screen interaction records) or Google AdSense (advertising), we explain them separately from essential sign-in cookies. Processing that requires consent is limited to the consent given. Refusing or withdrawing optional consent does not require account deletion.

You can delete or refuse cookies in your browser settings. Blocking essential sign-in cookies may prevent features such as staying signed in from working. Deleting browser cookies is separate from deleting information already sent to providers.

6. Your rights

You may request access, correction, deletion or restriction of processing of your personal information. You may also withdraw consent for processing based on consent by contacting us below. Identity verification may be required depending on the request.

You can edit your profile and delete your account yourself in the Website's member information screen or in the App under Profile → Delete account. If you cannot sign in, email the contact below from the address you registered with; we process the request after verifying your identity. Detailed steps are at ssuessueknits.com/en/account-deletion. Withdrawal of optional consent and deletion of your entire account can be requested separately.

If law requires us to limit a request, we explain the reason. Making a rights request alone does not restrict essential services unrelated to that request.

7. Privacy officer and access requests

Privacy officer: Yewon Kim / Email: yewon61137@gmail.com. Requests for access, correction, deletion or restriction of processing and withdrawals of consent are received at the same address; we respond with the outcome or the reason for any delay within 10 days of receipt.

Contact us about privacy questions, complaints or remedies. You can also contact Korea's Personal Information Dispute Mediation Committee (kopico.go.kr) or Personal Information Infringement Report Center (privacy.kisa.or.kr).

8. Security measures

Encryption in transit: the Website and the App communicate with our servers only over HTTPS (TLS).

Passwords: stored in an irreversibly transformed form; we cannot see the original password.

Access control: the database applies row-level access control so that members can read and write only their own data, and file storage is limited to each member's own path. Administrative work is performed only through authenticated administrator accounts.

Data minimization: we do not collect information that is unnecessary for the Service, such as location, contacts or advertising identifiers.

If a data breach occurs, we notify affected users and the relevant authorities without delay as required by law.

9. Processing in the mobile app

Account and data: the App uses the same member account and data as the Website. Projects, works and comments created in the App appear on the Website under the same conditions.

Device permissions: camera and photo access is requested only when you upload a photo, and other features remain available if you decline. Selected photos are not sent to the server until you tap upload. Notification permission is requested when you choose to receive notifications. We do not access location, contacts or advertising identifiers.

Information stored on the device: your sign-in session is kept in the device's secure storage; drafts in progress and display settings are kept in the App's storage. Uninstalling the App removes this device data, but your account and data on the server remain; account deletion must be done separately.

Notifications: schedule reminders are scheduled and displayed on the device itself. Comment, reply, like and follow notifications appear in the App’s notification list and, if you agree to receive notifications and allow notifications on your device, are also sent as mobile push notifications. For this we store your device’s push token, device type and the notification types you turned off on that device together with your account. When you sign out or turn off notifications, we delete that device’s information; if you delete the App, it is deleted at the next delivery attempt.

Advertising and analytics: the App contains no advertising SDK or behavioral analytics SDK.

Account deletion: in the App, go to Profile → Delete account, enter your account email to confirm, and the account is deleted immediately.

10. Changes

We announce changes to this policy and their effective date. Where a change requires new consent, we provide a separate explanation and obtain the necessary consent before starting that processing.

Revision history: October 1, 2026 — introduced mobile push notifications (Section 9) and added the push notification delivery processor (Google Firebase Cloud Messaging) (Section 4). September 25, 2026 — added the mobile app to the scope (Section 9), specified security measures (Section 8), retention periods and the account deletion procedure, and stated the minimum age of 14. September 10, 2026 — first version.