OX Factory Privacy Policy
VIBEMENT CO., LTD. (the "Company", "we", "us") operates "OX Factory" (https://oxfactory.app, the "Service"). We process users' personal information under the Personal Information Protection Act of Korea, and this policy explains how.
At a glance
- When you sign in, we receive only your member number and nickname from Kakao, or your unique ID and name from Google. We do not receive your email, phone number or date of birth.
- To make questions, pictures and plans, we send only the project content you enter to Google in the US (Gemini API). We do not send your account information.
- Trial records made without signing in are deleted 30 days after last use. If you delete your account, we delete your data right away.
- Please do not put personal information such as names, contact details or addresses into your project content.
1. Purposes of Processing
We process personal information only for the following purposes.
- Identifying members and keeping them signed in
- Providing the Service — making O/X questions, pictures and plans, and saving and resuming them in "My plans"
- Giving coins and keeping records of their use (including sign-up, attendance and friend invite bonuses)
- Preventing abuse — limiting daily use from the same access point
- Handling inquiries and complaints
- Connecting paid coin payments and refunds (matching order numbers with the payment gateway)
2. Personal Information We Process
| Category | Items | Required or optional |
|---|---|---|
| Sign-in with Kakao | Kakao member number · nickname | Required |
| Sign-in with Google | Google unique identifier · name | Required |
| Sign-up check | Confirmation that you are 19 or older · time you agreed to the Terms | Required |
| Using the Service | What you first wrote · questions and answers · pictures made · plans · coin history (coins received · coins spent) · invite relationship (whose invite link you joined through) | Required |
| Collected automatically | Sign-in cookie (random number) · access IP (to check daily use) · data saved in this device's browser (to resume) | Required |
3. Processing and Retention Periods
| Item | Retention period |
|---|---|
| Member information · My plans · coin history | Until you delete your account (destroyed right away when you delete it) |
| Trial records without signing in | Destroyed 30 days after last use |
| Access IP usage records | Deleted after that day ends (up to 2 days) |
When paid payments begin, we will add the transaction records we keep by law to this policy and tell you in advance.
4. Destruction Procedure and Method
When the retention period ends or the purpose is achieved, we destroy the information without delay. Electronic files are deleted in a way that cannot be recovered.
5. Provision to Third Parties
We do not provide personal information to third parties. Kakao and Google are sign-in methods you choose yourself. We receive from them only the information you agree to on their screen (Section 2).
6. Outsourcing of Processing
| Recipient | Task outsourced |
|---|---|
| Cloudflare, Inc. | Delivering access to the Service securely (network · security) |
We run our servers and database ourselves in Korea.
7. Transfer of Personal Information Abroad
We transfer personal information abroad as shown below because it is needed to provide the Service (performance of a contract) (Personal Information Protection Act, Article 28-8(1)(iii)). If you do not want this transfer, you can choose not to use the Service or delete your account. In that case, you cannot use the Service.
| Recipient (country) | Items transferred | Purpose | When and how | Retention period | Contact |
|---|---|---|---|---|---|
| Google LLC (USA) | What you first wrote · questions and answers · picture descriptions | Making questions, pictures and plans (Gemini API) | Each time you use the Service, over encrypted communication | The period set by the Google API terms | https://support.google.com/policies |
| Cloudflare, Inc. (USA) | Access IP · content sent and received (encrypted communication) | Delivering access · security | Each time you connect | Right after delivery (security logs follow Cloudflare's policy) | https://www.cloudflare.com/privacypolicy/ |
Only when you buy coins — outsourcing of payment processing (Korea): Paid coin payments are processed by KG Inicis (KG이니시스, 주식회사 케이지이니시스), an electronic payment gateway, and we use the service of Korea PortOne ((주)코리아포트원) to connect payments. When you press Top up coins, we pass the order number · the coin pack you chose · the payment amount · your internal member number (a random string) to them. You enter your name, mobile number, email and card details directly in the payment window. We do not receive card details. We keep payment records for 5 years under the Electronic Commerce Act of Korea.
8. Processing in the Generative AI Service
- The project content you enter is sent to AI (Google Gemini) to make questions, pictures and plans.
- Results made by AI are for reference only and may not match the facts.
- Please do not put your own or anyone else's personal information into your project content.
9. Measures to Keep Personal Information Safe
- We encrypt all communication (HTTPS).
- Sign-in cookies are signed so they cannot be forged, and JavaScript cannot read them (HttpOnly).
- We keep server access rights to a minimum and store secret keys separately from the code.
10. Tools That Collect Information Automatically (Cookies)
- We use a cookie holding a random number to keep you signed in. We do not use it for ads or tracking.
- You can block or delete cookies in your browser settings. If you block them, you cannot stay signed in.
11. Behavioral Information
We do not collect behavioral information for targeted advertising.
12. Your Rights and How to Use Them
- You can ask at any time to access, correct or delete your personal information, or to stop processing it.
- You can delete your account yourself in "My plans" (destroyed right away). You can also ask the privacy officer below by email or phone.
13. Children Under 14
Only people aged 19 or older can join the Service. We do not collect personal information from children under 14.
14. Privacy Officer
- Privacy officer: Sungjun Park (박성준), CEO
- Contact: 070-8656-6190 · [email protected]
15. Remedies for Infringement of Rights
- Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
- Personal Information Infringement Report Center: 118 (privacy.kisa.or.kr)
- Supreme Prosecutors' Office: 1301 (www.spo.go.kr)
- Korean National Police Agency: 182 (ecrm.police.go.kr)
16. Changes to This Policy
This policy applies from October 24, 2026. If it changes, we will announce it in the Service 7 days before the change takes effect.
This English version is a translation. If it differs from the Korean 개인정보처리방침, the Korean version prevails.