Governing version: The Korean-language version of this document is the governing version; in the event of any discrepancy in interpretation between the Korean version and a translated version, the Korean version prevails.
1. Purpose
Zero to Zenith Co., Ltd. ("Company," "we," "us") operates RUNMON ("Service"), a social app that connects people through real-time live voice broadcasts. RUNMON is the brand name under which the Company operates the Service. This Privacy Policy explains how your personal information is collected, used, retained, and destroyed, and what rights you have, in accordance with Korea's Personal Information Protection Act.
2. Information We Collect
| Category | Data | When | Method |
|---|---|---|---|
| Account (Required) | Email address, nickname, social account identifier | Sign-up | Google/Apple OAuth |
| Profile (Required) | Gender, country, purpose(s) for using the app (and any additional detail you provide) | Sign-up | Entered by you on the sign-up screen |
| Profile image (Optional) | Profile photo | When you set a profile photo | Uploaded by you in-app |
| Location (Optional) | GPS coordinates (latitude/longitude), altitude, route | (1) During a run; (2) when viewing or hosting a running broadcast | Device GPS, if permission granted |
| Health (Optional) | Heart rate, calories burned, step count, distance, workouts | During a run/broadcast | Read from the device's HealthKit, if permission granted |
| Fitness (Optional) | Elapsed time, pace, cadence, metrics derived from the GPS route | During a run/broadcast | Collected on the device via CoreMotion and GPS |
| Run record metadata (Optional) | Run date/time, broadcast/channel name, frequency, number of co-participants, place name | When a run ends | Generated automatically in-app |
| Reports & sanctions (if applicable) | Report reason/description, sanction type/reason/duration | When a report is filed or a sanction is issued | In-app report feature / issued by our moderation team |
| Account withdrawal (if applicable) | Withdrawal reason (selected from the options shown) | When you request account deletion | Selected by you on the withdrawal screen |
| Location-collection records (if applicable) | Your connection IP address | When your device transmits location data to the server | Recorded automatically as part of the location-information verification records |
| Service logs | Server access, error, and performance logs | During service use | Recorded automatically on the server |
| App usage analytics | App usage events, device model / OS version / language / approximate region, app instance identifier | During app use | Collected automatically by the Firebase Analytics (GA4) SDK |
| Error diagnostics | App crash and error logs, device / OS information | On app error or crash | Collected automatically by the Firebase Crashlytics SDK |
| Push notification token | Device push token | If you allow notifications | Firebase Cloud Messaging |
| Pre-registration (Optional) | Email address | When you sign up on our website (www.runmon.run) | Entered by you in the pre-registration form |
| Website usage analytics | Pages viewed, scroll depth reached within a page, referral source (referrer and UTM parameters), approximate region (country/city level), device / browser / language | While visiting the website | Collected automatically via cookies by the Google Analytics 4 web stream |
| Website visit counts | Page views, referral source, approximate region, device / browser | While visiting the website | Collected automatically by Vercel Web Analytics (no cookies used) |
We do NOT collect: contacts, videos, date of birth, payment information. Neither we nor the SDKs we use collect an advertising identifier (IDFA); we do not show an App Tracking Transparency (ATT) prompt; and we do not personalize for advertising.
Server Backup Notice: The location, health, fitness, and run-record data above (other than the location used to provide the nearby running-broadcast list) stays on your device by default. Only if you separately turn on Server Backup in app settings do we store this data on our servers, so your run history can be restored after a device change or app reinstall. Core app features (recording and viewing your runs) work the same whether or not Server Backup is on. Step count, however, is used only on your device (run screen, lock-screen widget, etc.) regardless of the Server Backup setting and is not transmitted to our servers. Cadence (steps per minute) is processed as part of the run record, as a pace metric.
Sensitive Data & Location Data Notice: Heart rate and calorie data constitute sensitive health information, and GPS coordinates constitute personal location information under Korea's Act on Location Information. When you turn on Server Backup, we obtain your consent to process this sensitive and location data separately from our general privacy consent. Location data handling is further governed by our separate Location-Based Service Terms. You may withdraw consent at any time in app settings; withdrawal triggers prompt deletion of the corresponding server-side data.
Location for the nearby running-broadcast list: When you view the running-broadcast list or host a running broadcast, we receive your current location at that time on our servers and use it only to filter broadcasts within a set radius. This location is processed regardless of your Server Backup setting; only the single most recent location per user is held temporarily and then automatically deleted, and location coordinates are not provided to other users. See our separate Location-Based Service Terms for details.
Saving workouts to Apple Health: Only if you tap "Save" on the completion screen after a run do we write that workout to Apple Health (workout type, start/end time, pause segments, distance, GPS route, and — on recent iOS versions — heart rate, calories, and step count). If you tap "Don't Save," nothing is written to Apple Health. Data stored in Apple Health is managed by Apple, and this saving is independent of any transmission to our servers.
Voice broadcasts: Audio is transmitted in real time between participants and is not recorded or stored on any server.
When you use our website (www.runmon.run): The other entries in this section concern the app; the following applies to our pre-launch website.
- Pre-registration email: If you enter and submit your email address in the pre-registration form, we use it solely to notify you when the Service launches and to inform you about the pre-registration benefit (a free first month of the Premium Plan). The legal basis is your consent under Art. 15(1)(1) of Korea's Personal Information Protection Act; you may decline simply by not entering your email address, and declining places no restriction on your use of the website. We do not transmit your email address to the analytics tools described below.
- Deletion requests: If you wish to cancel your pre-registration and have your email address deleted, contact us using the details in Section 13 and we will delete it without undue delay.
Cookies and similar automatic collection technologies, and how to refuse them (Art. 30(1)(6) of Korea's Personal Information Protection Act): Our website stores the following cookies in your browser for usage analytics. We do not use advertising cookies or third-party ad-network tracking cookies.
| Cookie name | Set by | Purpose | Lifetime |
|---|---|---|---|
_ga |
Google Analytics 4 | Distinguishing visitors (identifying returning visits) | 2 years |
_ga_SL1HMNGSMG |
Google Analytics 4 | Maintaining session state | 2 years |
How to refuse: You can refuse cookie storage in your browser settings, or block collection by installing Google's Analytics opt-out browser add-on. Refusing cookies places no restriction on your use of the website.
Collection without cookies: Vercel Web Analytics stores no cookie or equivalent identifier on your device and produces only aggregate figures that do not identify individual visitors.
Temporary browser storage: The website temporarily holds your referral source and a display variant in your browser's session storage (runmon.attr, runmon.pov). These are cleared when you close the browser tab and are not transmitted to our servers.
3. How We Use Your Information
- Account creation and authentication
- Providing the real-time voice broadcast service
- Displaying your fitness data within the app
- Providing a list of nearby running broadcasts based on your current location
- Server backup of run records (including location, health, and fitness data): storage, restoration when run records are lost from a device, and features based on server-stored run records
- Service improvement and personalized feature development using collected fitness data
- Statistical analysis and new service planning using anonymized, aggregated fitness data
- Analyzing app usage to improve the service
- Diagnosing service errors and app crashes and improving stability
- Sending push notifications (if you have allowed them)
- Complying with legal obligations
Health and location data: We do not use or share health, fitness, or location information obtained via HealthKit, CoreMotion, or GPS for advertising, marketing, or any third-party data purposes. Under Apple App Store Guideline 5.1.3, this restriction is applied strictly to data derived from HealthKit.
Analytics and diagnostics tools: We use Firebase Analytics (GA4), Firebase Crashlytics, and Firebase Cloud Messaging (provided by Google LLC), solely for app-usage analytics, error/crash diagnostics, and push notifications respectively. These tools do not use location, health, or fitness data for advertising, and do not collect an advertising identifier (IDFA). The analytics data collected is based on a pseudonymous app instance identifier and does not directly identify you. We use these tools on the basis of our legitimate interests (Article 15(1)(6) of Korea's Personal Information Protection Act) to the extent necessary to operate, secure, and improve the Service, and only where this does not unfairly override your rights and interests. Push notification tokens are processed only where you have opted in to notifications.
Fitness data: Fitness data (distance, elapsed time, pace, cadence, GPS route, heart rate, etc.) is collected and used for service improvement, personalized feature development, and statistical analysis. We do not use this data in identifiable form for statistics or research — GPS routes are used for statistical purposes only after pseudonymization: coordinates are generalized to roughly 100m precision, timestamps/order/altitude/speed/heart rate are discarded, and the result is stored separately from any information that could identify you (Korea's Personal Information Protection Act, Art. 28-2). This pseudonymization relies on your Server Backup consent and does not require separate additional consent.
We do not use your personal information for automated decision-making that produces legal or similarly significant effects on you.
4. Sharing Your Information
| Recipient | Purpose | Data Shared | Retention |
|---|---|---|---|
| Google LLC | Google Sign-In authentication | Email, Google account ID | Per Google's privacy policy |
| Apple Inc. | Apple Sign-In authentication | Apple account ID | Per Apple's privacy policy |
We do not sell your personal information. We do not share it with other third parties without your consent, except as required by law. When we receive a law enforcement request, we will make reasonable efforts to notify affected users where permitted.
International Transfer Notice (Korea's Personal Information Protection Act, Art. 28-8):
If you sign in with Google
- Recipient: Google LLC
- Destination country: United States
- Timing and method: Each time you authenticate with your Google account at sign-up or login, via network transmission during the OAuth flow
- Data transferred: Email address, Google account ID
- Recipient's purpose and retention period: Limited to Google Sign-In authentication; retention thereafter is determined by Google under its own privacy policy
If you sign in with Apple
- Recipient: Apple Inc.
- Destination country: United States
- Timing and method: Each time you authenticate with your Apple account at sign-up or login, via network transmission during the OAuth flow
- Data transferred: Apple account ID
- Recipient's purpose and retention period: Limited to Apple Sign-In authentication; retention thereafter is determined by Apple under its own privacy policy
You choose either Google or Apple as your sign-in method at registration; no transfer occurs to whichever provider you did not choose. Because the Service offers only social sign-in for account creation, this transfer is strictly necessary for the formation and performance of your account/service agreement, and is disclosed here in lieu of separate consent under Art. 28-8(1)(2) of the Act.
5. Processing Entrustment
We use LiveKit, Inc. to operate the real-time voice channel infrastructure. Audio streams are processed in real time for delivery and are not stored by the provider. We use Google LLC (Firebase) for app-usage analytics, error/crash diagnostics, and push notification delivery. We use Google LLC (Google Analytics 4 web stream) for website usage analytics, and Vercel Inc. for website hosting and cookieless website visit analytics; the pre-registration email address you submit passes through Vercel's infrastructure in transit to our backend. Processing is limited to the purpose of providing and operating the Service.
International Transfer Notice (Korea's Personal Information Protection Act, Art. 28-8) — LiveKit:
- Recipient: LiveKit, Inc.
- Destination country: United States
- Timing and method: At the time of each real-time audio stream transmission during a broadcast, via network transmission
- Data transferred: Real-time voice audio stream (not stored on our or the provider's servers)
- Recipient's purpose and retention period: Limited to operating the real-time voice channel infrastructure; not retained after transmission
- This transfer is processing entrustment strictly necessary to provide the Service's core real-time voice broadcast feature, and is disclosed here in lieu of separate consent under Art. 28-8(1)(2) of the Act.
International Transfer Notice (Korea's Personal Information Protection Act, Art. 28-8) — Google (Firebase):
- Recipient: Google LLC
- Destination country: United States
- Timing and method: At the time of app usage, an error, or push notification processing, via network transmission
- Data transferred: App usage events, crash/error logs, device/OS information, app instance identifier, push token
- Recipient's purpose and retention period: Providing analytics, diagnostics, and push notification infrastructure; retention follows Google Firebase's data processing policy
- This transfer is processing entrustment for operating and improving the Service, disclosed here by this notice.
International Transfer Notice (Korea's Personal Information Protection Act, Art. 28-8) — Google (web analytics):
- Recipient: Google LLC
- Destination country: United States
- Timing and method: Each time a page view, scroll, or similar interaction occurs during a website visit, via network transmission
- Data transferred: Pages viewed, scroll depth, referral source, approximate region, device/browser/language, cookie identifier
- Recipient's purpose and retention period: Website usage analytics; retention follows Google's data retention policy (up to 14 months by default)
- This transfer is processing entrustment for operating and improving the website, disclosed here by this notice.
International Transfer Notice (Korea's Personal Information Protection Act, Art. 28-8) — Vercel:
- Recipient: Vercel Inc.
- Destination country: United States
- Timing and method: Each time the website is accessed or a pre-registration is submitted, via network transmission
- Data transferred: Connection IP address, requested URL, referral source, device/browser information, pre-registration email address (relayed server-to-server)
- Recipient's purpose and retention period: Website hosting and visit analytics; server access logs follow Vercel's retention policy, and visit analytics data is retained only as aggregate figures that do not identify individuals
- This transfer is processing entrustment necessary to provide the website, disclosed here by this notice.
6. Retention and Deletion
| Category | Retention |
|---|---|
| Account data | Until account deletion |
| Voice calls | Not stored on any server |
| Run records (location, health & fitness data) — Server Backup off | Stays on device; not sent to our servers |
| Run records (location, health & fitness data) — Server Backup on | Deleted promptly upon account deletion (anonymization) or withdrawal of backup consent |
| Pseudonymized fitness statistics | Retained for as long as the Service operates this statistical purpose; the underlying necessity is periodically reviewed and the data is deleted without undue delay once no longer needed. When the original run record is deleted, the re-identification information (which user it belonged to) is deleted immediately; the statistics themselves then remain, unlinked to anyone |
| Location data collection/use/provision verification records (including the user's connection IP at collection) | 3 years from the date each record is created (exceeding both the 6-month minimum under Act on Location Information Art. 16(2) and the 1-year minimum under Art. 10(2) of the Standards for Administrative and Technical Protection of Location Information). Destroyed without delay thereafter, unless a related dispute, investigation, or inquiry is pending, in which case retained until its conclusion |
| Withdrawal reason | Separated from identifying information and retained in non-identifiable form for service-improvement statistics |
| Report and sanction records | Until account deletion |
| Reports you filed (evidence supporting sanctions against the reported user) | Retained for the duration of the Service's operation to prevent misuse, regardless of whether you yourself delete your account |
| Broadcast participation history | Until account deletion (aggregate values such as participant counts are retained separately, as of the time each broadcast ended) |
| Location for the nearby running-broadcast list | Only the single most recent location per user, held temporarily (updated on the next transmission, automatically deleted after a set period) |
| Service logs | Kept for as long as needed to diagnose service errors and improve stability, then deleted |
| App usage analytics / error diagnostics data (Firebase) | Follows Google Firebase's data processing policy (analytics data: up to 14 months by default). We do not separately retain it in a form that identifies you |
| Pre-registration email address | Until the launch announcement and pre-registration benefit information have been delivered, or until you request deletion |
| Website usage analytics data (Google Analytics 4) | Follows Google's data retention policy (up to 14 months by default). Cookies expire after the lifetimes listed in Section 2 |
| Website visit count data (Vercel) | Retained only as aggregate figures that do not identify individuals, per Vercel's retention policy |
| Push notification token | Until you disable notifications or delete your account |
| Records of contracts and withdrawal of subscription | 5 years (Korea's Act on Consumer Protection in Electronic Commerce, Art. 6) |
| Records of payment and supply of goods | 5 years (Korea's Act on Consumer Protection in Electronic Commerce, Art. 6) |
| Records of consumer complaints and dispute resolution | 3 years (Korea's Act on Consumer Protection in Electronic Commerce, Art. 6) |
Account data is deleted without undue delay following a deletion request, generally within 30 days. Data subject to statutory retention obligations is stored separately and destroyed after the mandatory period. Electronic files are deleted by appropriate technical means so that they cannot readily be recovered; we hold no paper records.
7. Security
Pursuant to Article 29 of Korea's Personal Information Protection Act, we take measures to keep your personal information safe, including:
- encryption of communications between your device and our servers, including voice streams
- encryption at rest of location data (GPS coordinates) stored via Server Backup
- minimization of and controls over access to personal information
- management of access records for the personal information processing system
8. Data Breach Response
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authorities and, where required by applicable law, affected individuals, without undue delay and in accordance with applicable legal requirements.
9. Your Rights
Depending on your location, you may have the following rights:
| Right | Description |
|---|---|
| Access | Request information about the personal data we hold about you |
| Rectification | Correct inaccurate data |
| Erasure | Request deletion of your data |
| Restriction | Ask us to limit how we process your data |
| Portability | Receive your data in a portable format |
| Objection | Object to processing based on legitimate interests |
| Withdraw consent | Revoke HealthKit/CoreMotion or location permission anytime in iOS Settings, turn off Server Backup in app settings, or disable push notifications in device settings |
How to submit a request:
- Email: team.zerotozenith@gmail.com (Subject: "[RUNMON Privacy] Rights Request")
- In-app: request account deletion from the app's settings
- Response time: We will respond without undue delay and within the timeframe required by applicable law.
You may exercise these rights yourself or through a duly authorized representative.
10. Users Under 18
RUNMON is an 18+ service, and the Company does not allow anyone under 18 to register or to have their personal information collected. We verify that users are at least 18 at sign-up. If we find that an account belongs to someone under 18, we restrict the account and destroy the collected personal information without undue delay.
11. Data Protection Officer
- Company: Zero to Zenith Co., Ltd. (주식회사 제로투제니스)
- Address: 123 Seocho-jungang-ro, Seocho-gu, Seoul, Republic of Korea (B1F, Unit A020)
- Name: Yujin Cho
- Title: CEO
- Email: team.zerotozenith@gmail.com
12. Changes to This Policy
We may update this policy from time to time. For material changes, we will provide notice before the changes take effect where reasonably practicable. Changes required for legal compliance or urgent security reasons may take effect immediately.
13. Contact and Remedies
For privacy-related questions or complaints, contact us at team.zerotozenith@gmail.com. Depending on your location, you may also contact your data protection authority — see the jurisdiction-specific Addenda below.
Users in Korea. To seek dispute resolution or advice for harm arising from a personal information infringement, you may apply to the following Korean organizations. The phone numbers below are domestic Korean numbers and can only be dialed from within Korea.
- Personal Information Dispute Mediation Committee: kopico.go.kr / 1833-6972
- Personal Information Infringement Report Center (KISA): privacy.kisa.or.kr / 118
- Supreme Prosecutors' Office: spo.go.kr / 1301
- National Police Agency: ecrm.police.go.kr / 182
This section applies to California residents and is provided for users in other US states with applicable privacy laws.
We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising purposes.
California residents may exercise the following rights:
- Right to know: The categories and specific pieces of personal information we have collected, used, and shared
- Right to delete: Request deletion of your personal information, subject to certain exceptions
- Right to correct: Request correction of inaccurate personal information
- Right to non-discrimination: We will not discriminate against you for exercising these rights
To submit a request: team.zerotozenith@gmail.com We will respond within 45 days, extendable by a further 45 days where reasonably necessary.
Joint use: We do not engage in the joint use of personal information.
Notice of the purpose of use of retained personal data: The purposes of use set out in this Privacy Policy also serve as the notice of the purpose of use of retained personal data (Art. 32 of the Act).
Disclosure of records of provision to third parties: You may also request disclosure of the records of any provision of your personal information to a third party (Art. 33(5) of the Act).
Reporting of leakage: If a leakage or similar incident involving personal information occurs, we will promptly report it to the Personal Information Protection Commission and notify you, in accordance with the requirements of the Act and the Commission's rules.
Complaint handling: Please direct complaints about our handling of personal information to the contact point set out in Section 13. If the matter is not resolved, you may raise it with the Personal Information Protection Commission (ppc.go.jp).