OX Factory Privacy Policy
VIBEMENT CO., LTD. (the "Company", "we", "us") operates "OX Factory" (https://oxfactory.app, the "Service"). We process users' personal information under the Personal Information Protection Act of Korea, and this policy explains how.
At a glance
- When you sign in, we receive only your member number and nickname from Kakao, or your unique ID and name from Google. We do not receive your email, phone number or date of birth. If you request 'Try building it' or 'Make it mine' and choose to enter how to reach you, we receive only that (optional).
- To make questions, pictures and plans, we send only the project content you enter to Google in the US (Gemini API). We do not send your account information.
- Trial records made without signing in are deleted 30 days after last use. If you delete your account, we delete your data right away.
- To improve the Service, we keep usage records (taps, scrolling, screen recordings — on-screen text and inputs are masked) on our own servers for 30 days. We do not sell them or use them for ads, and you can turn this off with 'Turn off usage records' in Section 10.
- For operations such as reviewing requests and building services, we use our AI work tool (Anthropic Claude, USA). When building, we pass only the plan you requested, separated from your name and account. Since October 25, 2026, it is set not to use this data for model training.
- Please do not put personal information such as names, contact details or addresses into your project content.
1. Purposes of Processing
We process personal information only for the following purposes.
- Identifying members and keeping them signed in
- Providing the Service — making O/X questions, pictures and plans, and saving and resuming them in "My plans"
- Giving coins and keeping records of their use (including sign-up, attendance and friend invite bonuses)
- Preventing abuse — limiting daily use from the same access point and checking votes, friend invites and coin builds for fraud
- Handling inquiries, feedback and complaints, and improving the Service
- Connecting paid coin payments and refunds (matching order numbers with the payment gateway)
- Handling 'Try building it' and 'Make it mine' requests — confirming the request, building the preview and the service, and contacting you about the build
- Usage analytics to improve the Service — seeing where people stop or leave, and whether O/X questions and pictures work well (Company staff may view plan content, and each view is logged)
- Sending notifications about your inventions (O votes received) to members who ask for them
2. Personal Information We Process
| Category | Items | Required or optional |
|---|---|---|
| Sign-in with Kakao | Kakao member number · nickname | Required |
| Sign-in with Google | Google unique identifier · name | Required |
| Sign-up check | Confirmation that you are 19 or older · time you agreed to the Terms | Required |
| Using the Service | What you first wrote · questions and answers · pictures made · plans · coin history (coins received · coins spent) · invite relationship (whose invite link you joined through) · "Would you use this?" vote records | Required |
| 'Try building it' / 'Make it mine' request | The plan you request · a one-line note · how to reach you (an email, phone number or KakaoTalk ID that you enter) | Plan required; note and contact optional |
| Collected automatically | Sign-in cookie (random number) · access IP (to check daily use) · access-point hash (your access IP turned into a value using that day's random key — to check votes and invites for fraud) · data saved in this device's browser (to resume) | Required |
| Send feedback | The option you pick · what you write · (if you pick "It doesn't work") screen name · build number · last error · device type | Optional |
| Notifications | Browser information to receive notifications (push address · encryption keys) · on/off record | Optional (only if you tap 🔔 and allow it in your browser) |
| Usage analytics (collected automatically) | Usage records (taps · scrolling · screen recordings — on-screen text, inputs and pictures are masked) · pages viewed and time · device · browser type · screen size · referrer · random recording number | Automatic until you turn it off |
3. Processing and Retention Periods
| Item | Retention period |
|---|---|
| Member information · My plans · coin history | Until you delete your account (destroyed right away when you delete it) |
| Trial records without signing in | Destroyed 30 days after last use |
| Access IP usage records | Deleted after that day ends (up to 2 days) |
| Access-point hashes | The day's random key used for hashing is deleted after 8 days, after which the hash can no longer be matched to any access point |
| 'Try building it' preview | Destroyed 30 days after it opens (if you choose 'Make it mine', it continues as that service) |
| 'Try building it' / 'Make it mine' request information | Destroyed 1 year after the request is closed (preview only, not built, or build finished). Destroyed right away if you delete your account. If a paid build contract is made, contract records are kept 5 years under the E-Commerce Act |
| Usage records | Destroyed after 30 days |
| Feedback (what you write) | Destroyed 1 year after we receive it. Destroyed right away if you delete your account |
| Browser information for notifications | Destroyed right away when you turn notifications off, block them in your browser, or delete your account |
When paid payments begin, we will add the transaction records we keep by law to this policy and tell you in advance.
4. Destruction Procedure and Method
When the retention period ends or the purpose is achieved, we destroy the information without delay. Electronic files are deleted in a way that cannot be recovered.
5. Provision to Third Parties
We do not provide personal information to third parties. Kakao and Google are sign-in methods you choose yourself. We receive from them only the information you agree to on their screen (Section 2).
6. Outsourcing of Processing
| Recipient | Task outsourced |
|---|---|
| Cloudflare, Inc. | Delivering access to the Service securely (network · security) |
| Amazon Web Services, Inc. | Servers · database · backup storage (Seoul region) |
| Anthropic, PBC | The Company's AI work tool (Claude) — reviewing requests, building previews and services, and operational analysis |
Notifications are delivered through the push servers run by your browser's maker (Google, Mozilla, Apple, Microsoft, etc.). The content is encrypted and those companies cannot read it. Notifications contain no advertising and are not sent between 9 p.m. and 8 a.m. (Korea time).
Our servers, database, backups and usage records are kept in the AWS Seoul region and operated by the Company.
For services that members build through "Make it mine", the member is the controller of their users' information and the Company processes it on the member's behalf (Terms of Service Article 6-4). That information follows the built service's own privacy policy.
7. Transfer of Personal Information Abroad
We transfer personal information abroad as shown below because it is needed to provide the Service (performance of a contract) (Personal Information Protection Act, Article 28-8(1)(iii)). If you do not want this transfer, you can choose not to use the Service or delete your account. In that case, you cannot use the Service.
| Recipient (country) | Items transferred | Purpose | When and how | Retention period | Contact |
|---|---|---|---|---|---|
| Google LLC (USA) | What you first wrote · questions and answers · picture descriptions | Making questions, pictures and plans (Gemini API) | Each time you use the Service, over encrypted communication | The period set by the Google API terms | https://support.google.com/policies |
| Cloudflare, Inc. (USA) | Access IP · content sent and received (encrypted communication) | Delivering access · security | Each time you connect | Right after delivery (security logs follow Cloudflare's policy) | https://www.cloudflare.com/privacypolicy/ |
| Anthropic, PBC (USA) | 'Try building it' / 'Make it mine' request information · the requested plan's content (separated from name and account) · usage records needed for operational analysis | Reviewing requests, building previews and services, operational analysis (AI work tool) | When our staff do that work, over encrypted communication | 30 days (set not to be used for model training since October 25, 2026; conversations flagged for policy review may be kept longer under Anthropic's policy) | https://www.anthropic.com/legal/privacy |
| Anthropic, PBC (USA) — from November 27, 2026 | First entries · questions and answers (separated from name and account) | Improving question quality, operational analysis (AI work tool) | When our staff do that work, over encrypted communication | 30 days (set not to be used for model training since October 25, 2026; conversations flagged for policy review may be kept longer under Anthropic's policy) | https://www.anthropic.com/legal/privacy |
Only when you buy coins — outsourcing of payment processing (Korea): Paid coin payments are processed by KG Inicis (KG이니시스, 주식회사 케이지이니시스), an electronic payment gateway, and we use the service of Korea PortOne ((주)코리아포트원) to connect payments. When you press Top up coins, we pass the order number · the coin pack you chose · the payment amount · your internal member number (a random string) to them. You enter your name, mobile number, email and card details directly in the payment window. We do not receive card details. We keep payment records for 5 years under the Electronic Commerce Act of Korea.
Only when you pay in USD with a card issued outside Korea — Dodo Payments (USA): If you choose to pay in USD with a card issued outside Korea, Dodo Payments Inc. (USA) and its affiliates, acting as merchant-of-record reseller, sell the coins to you and handle payment, tax and refunds. When you press pay, we pass the order number · the coin pack you chose · your internal member number (a random string) to Dodo Payments over an encrypted connection. You enter your name, email, billing address and card details directly in the Dodo checkout, and they follow the Dodo Payments privacy policy (https://dodopayments.com/privacy-policy). We do not receive card details. We keep payment records for 5 years under the Electronic Commerce Act of Korea.
8. Processing in the Generative AI Service
- The project content you enter is sent to AI (Google Gemini) to make questions, pictures and plans.
- Results made by AI are for reference only and may not match the facts.
- Please do not put your own or anyone else's personal information into your project content.
9. Measures to Keep Personal Information Safe
- We encrypt all communication (HTTPS).
- Sign-in cookies are signed so they cannot be forged, and JavaScript cannot read them (HttpOnly).
- We keep server access rights to a minimum and store secret keys separately from the code.
- Only staff designated by the Company can open the admin screens; every view of personal information is logged, kept for 1 year and reviewed monthly.
10. Tools That Collect Information Automatically (Cookies)
- We use a cookie holding a random number to keep you signed in.
- For usage analytics, we keep a random recording number in your browser. It is not linked to your member information. Records stay on our servers, are not used for ads, and we do not look at your activity on other sites. We do not record visitors from the European Economic Area, the UK or Switzerland.
- To block them: Turn off usage records (this browser will not be recorded again), or clear cookies and site data in your browser. If you block the sign-in cookie, you cannot stay signed in.
11. Behavioral Information
We do not run targeted advertising and do not collect behavioral information for it. To improve the Service, we analyze only usage records on our own site (Sections 2 and 10).
12. Your Rights and How to Use Them
- You can ask at any time to access, correct or delete your personal information, or to stop processing it.
- You can delete your account yourself in "My plans" (destroyed right away). You can also ask the privacy officer below by email or phone.
13. Children Under 14
Only people aged 19 or older can join the Service. We do not collect personal information from children under 14.
14. Privacy Officer
- Privacy officer: Sungjun Park (박성준), CEO
- Contact: 070-8656-6190 · [email protected]
15. Remedies for Infringement of Rights
- Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
- Personal Information Infringement Report Center: 118 (privacy.kisa.or.kr)
- Supreme Prosecutors' Office: 1301 (www.spo.go.kr)
- Korean National Police Agency: 182 (ecrm.police.go.kr)
16. Changes to This Policy
This policy applies from November 4, 2026 (the second Anthropic row in Section 7 applies from November 27, 2026). If it changes in the future, we will announce it in the Service 7 days before the change takes effect (30 days before if the change is unfavorable to users).
- Revised November 4, 2026: added notifications about your inventions (web push) for members who ask for them
- Revised November 4, 2026: added 'Try building it' and 'Make it mine' (previews kept 30 days · building services with our AI work tool), logging of admin views, and USD card payment (Dodo Payments). From November 27, 2026, first entries and questions and answers are analyzed with our AI work tool to improve question quality
- Revised October 25, 2026: added 'Build it for real' request information, usage-record analytics, our AI work tool (Anthropic), servers (AWS Seoul), vote records and access-point hashes
- Previous version (effective October 25, 2026 · applies until November 3, 2026)
- Previous version (effective October 24, 2026)
This English version is a translation. If it differs from the Korean 개인정보처리방침, the Korean version prevails.