Privacy Policy

Baegugu (the "Company") collects personal information for the purposes below. Collected personal information is not used for any other purpose.

• Member authentication and account management: authentication and account linking through social login (Google, Naver, Apple)
• Service provision: volleyball community platform; club, association, academy, and shop management features
• Identity confirmation: phone OTP verification for features that require it, such as club or association registration and tournament comments
• Matching: forming teams from user profiles; recommending groups by age, gender, and skill
• Tournament management: tournament registration, team formation, bracket generation, roster management, and electronic signatures
• Athlete registration check: athlete verification through a Sports Support Portal lookup
• Referee certification: confirming and displaying referee qualifications through automatic text recognition (OCR) of a referee certificate photo
• Community operation: posts, comments, clips (videos), lost-and-found, messages, and other community features
• Notifications: push notifications (chat, tournaments, join requests, signature requests, and similar)
• Location-based services: searching and recommending nearby clubs, tournaments, and venues
• Service improvement: analyzing usage, collecting user feedback, and optimizing the Service

The Company collects the following personal information.

Basic member information

Body information

The items below are ordinary personal information, not sensitive information under the law. The Company collects them optionally for team formation and tournament division assignment.

Location information

Social login information

During social login, the Company receives the information below from each provider. Apple may provide a name only at the first sign-in, and may provide a Hide My Email (relay) address.

Phone identity-verification information

The Company does not collect a phone number at sign-up. When a user completes identity verification to use features that require it—such as club or association registration or tournament comments—the Company collects the information below.

Athlete registration check information

If a user requests an athlete registration check, the Company looks up the Sports Support Portal of the Korean Sport & Olympic Committee using the name and birth year on the profile. If the user selects their own record, the Company stores the information below.

Referee certification information

If a user photographs and registers a referee certificate in the app, the Company automatically recognizes the text in the photo (OCR), checks that it matches the name and date of birth on the profile, and stores the information below. No separate administrator review takes place.

Electronic signature information

Notification and device information

Position information

Volleyball position information entered by the user (for example, "6-player: Setter", "4-player: Libero")

Block information

IDs of members the user has blocked. Purpose: providing the block feature.

The information below may be generated and collected automatically while the Service is used.

Access and log information

Cookies and local storage

• Apple sign-in state (apple_state): prevents login forgery; expires after about 5 minutes
• Device identifier (bg-device-id): stored in the browser's localStorage; used to distinguish sessions
• Most recently used login method: shown on the login screen
• Google Analytics cookies (_ga and names starting with _ga_): distinguish website visitors; kept for up to 2 years

Usage statistics

• App and website screen views and feature-use history (Google Analytics and Firebase Analytics): screens visited, features used (such as join requests and sharing), device and browser type, approximate location (country and city), and referral source. When you are logged in, your member identifier (internal ID) is also sent; your name, email, and contact details are not sent.
• Website visit statistics (Vercel Analytics)
• Number of clubs created

Refusing cookies

You can refuse cookies in your browser settings. Refusing essential cookies may limit some features, including social login. You can refuse Google Analytics collection by blocking cookies in your browser or installing the Google Analytics Opt-out Browser Add-on (https://tools.google.com/dlpage/gaoptout). Refusing it does not limit your use of the Service.

Basic club information

Club location information

This is the address and coordinates of the club's place, not a person's real-time location.

Club operating information

• Volleyball format (6-player, 4-player, and similar)
• Target age group (20s, 30s, 40s, and similar)
• Gender composition (men, women, mixed)
• Number of members
• Social links (YouTube ID, Instagram ID)
• Private or public setting
• Whether the club is recruiting members

Club member information

Guest recruiting

When a club recruits guests, the Company collects the listing (date and time, place, fee, positions) and applicant information (name, position, application status).

Club visibility settings

• Place visibility: a club administrator can choose whether to show GPS coordinates to other users
• Invite token: create and manage club invite links (no expiration)

Basic tournament information

Tournament schedule and venue

• Start date, end date, registration period
• Si/do and gu/gun codes (tournament region)
• Venue information (opening ceremony location and time)
• Place name, address, GPS coordinates

Tournament contacts

• Contact email
• Contact phone number

Participating team information

Player and staff roster

When a team applies, the Company collects personal information of teammates and staff. This may include information of third parties who are not account holders. The applicant must confirm that those persons consented to the provision of their information.

This information is provided to the tournament organizer (operator) for tournament operations. See "Provision of Personal Information to Third Parties" for details.

Tournament notices

Notice title, body, importance, and pin-to-top status — purpose: tournament announcements

Association

Academy

Academy name, branch name, phone number, address, GPS coordinates, introduction, images, and social links. Purpose: listing and searching volleyball academies.

Shop

Shop name, phone number, address, GPS coordinates, products carried, introduction, images, and social links. Purpose: listing and searching volleyball equipment shops. The Company does not process shop payments.

Posts

Comments and replies

• Comment body
• Author information (name, ID)
• Created time, edited time
• Private setting (visible only to the comment author and the post author)
• Purpose: community discussion and information sharing

Private comment policy

A user may mark a comment as private. In that case, only the comment author and the post author can see it.

Clips (videos)

The Company collects short videos a user uploads (file, description, portrait or landscape) and like and save records. Purpose: providing the video feed.

Lost and found

The Company collects title, description, item, place and date lost or found, images, and inquiry messages. Purpose: operating the lost-and-found board.

Feedback

Body, category, rating, page of origin, and User-Agent. If the user is signed in, member ID, name, and email may be stored together. Purpose: improving the Service.

Message information

Conversation information

• Participants (one-to-one or club chat)
• Last message body
• Unread message count
• Last message time

Message retention policy

If a user deletes a conversation, every message in that conversation is deleted from the Company's servers. The Company may retain messages for a period if there is a legal request. However, if a user reports a message, the Company separately retains the reported message and up to 10 preceding messages in the conversation (including photos) to handle the report; only the operators who handle reports can view them. This material is deleted one year after the report has been handled.

OAuth 2.0 authentication

The Company provides social login through the OAuth 2.0 protocol. When a user clicks a login button, they are sent to that platform's authentication server. Only information in the scope the user expressly approves is provided to the Company.

Information received

At social login, the Company collects the information below from each provider. The Company does not send member personal information to those businesses.

Location display (Naver Maps)

The Company uses the Naver Maps API to display club, tournament, academy, and shop locations on a map. A person's real-time location is not sent to the Maps API.

Personal information is destroyed without delay after the purpose of collection and use is achieved. The Company may retain it for a set period when required by law or by the internal criteria below.

Member information retention

Club, association, and similar information retention

Tournament information retention

Community information retention

Legal retention duties

The Company currently does not charge users. When retention is required by law, the Company follows the table below.

Information the Company does not collect

The Company does not collect sensitive information under the Personal Information Protection Act (ideology or beliefs, labor union or political party membership, political opinions, health, sex life, genetic information, criminal records, and similar).

Items often confused with sensitive information

Date of birth, gender, height, dominant hand, social account IDs, and the contents of messages and comments are not sensitive information under the law. Users can control how widely body information is shown. The Company uses messages and comments only to provide the Service.

Personal location information

The Company does not store a user's real-time GPS coordinates on its servers.

• Profile si/do and gu/gun codes: region information the user enters
• Auto location: only the setting (on/off) is stored
• Map current location: used only in the browser or app; not sent to the server

Place location information

Addresses and GPS coordinates registered by club, tournament, academy, or shop administrators are information about those places. They may be shown as markers through the Naver Maps API.

• Visibility: an administrator can control location sharing (clubs)
• Private setting: if location sharing is off, no map marker is shown
• Member visibility: club members can see the location regardless of the public sharing setting

Tournament venue information

Tournament venue information registered by the organizer is shown on the tournament page.

General principle

The Company does not provide personal information to third parties without the user's consent. When the Service requires it, the Company provides personal information as described below.

Provision to tournament organizers

When a team applies to a tournament, the Company provides the roster to the organizer (operator) to the extent needed to run that tournament.

The applicant must have obtained consent from any listed person other than themselves before this information is shared. If you do not want this information shared, you cannot apply to that tournament.

Provision on a legal request

The Company may provide personal information when there is a legal basis, such as a court order or a request from an investigative agency.

The Company consigns personal information processing as follows to operate the Service. The Company manages and supervises trustees so that they comply with the Personal Information Protection Act.

Current trustees

Some trustees operate infrastructure outside Korea, so personal information may be transferred overseas to the extent needed to provide the Service. If you do not want a transfer, you may stop using the relevant features (social login, push notifications, phone identity verification, and the website) or delete your account.

Current transfers

Destruction procedure

Personal information whose retention period has ended or whose processing purpose has been achieved is destroyed without delay. Information retained under law is moved to a separate storage location and destroyed when that period ends.

Destruction method

• Electronic files: deleted so they cannot be recovered
• Printouts: shredded or incinerated when applicable

Access and correction

Users may exercise the following rights:

• Request to access and inspect their personal information
• Request correction of errors or omissions
• Request deletion of personal information
• Request restriction of processing
• Request data portability

Account deletion and data deletion

When a user deletes their account, account information is deleted without delay or changed so that the user cannot be identified. The profile photo, photos attached to posts and lost-and-found items, and clip video files are deleted as well. However, the following information is kept for the period shown and then deleted:

• Email at account deletion: 30 days after deletion (to prevent immediate re-registration with the same account)
• Login records (IP, device, time): 1 year from the date recorded (account security, fraud prevention)
• Text of hidden posts, comments, tournament comments, and lost-and-found items: 1 year after account deletion (handling infringement reports and disputes)
• Reported message materials: 1 year after the report is resolved
• Access logs (3 months)
• Consumer complaint records (3 years)

Records shared with other members

Records left together with other members, such as club chats, schedules and schedule comments, club application and invitation records, and guest and class applications, also belong to other members. Their content is kept, the name is changed to 'Withdrawn user', and phone numbers are removed. Tournament entry lists and match records follow the tournament information retention period above. One-on-one conversations are deleted for both sides when an account is deleted. Members who exchanged player cards keep the copy of the card received at the time of exchange in their collection.

Visibility and opt-out

Users can control the following themselves:

• Body information (height, dominant hand) visibility: Private / Club members only / Public
• Private comments: visible only to the comment author and the post author
• Push notification receipt: managed by type in settings
• Auto location: on/off in settings

How to exercise rights

You may exercise these rights in Service settings or by emailing the contact below. The Company will act within 30 days of receiving a request.

The Service is not directed to children under 14 years of age, and the Company does not knowingly collect their personal information. If the Company confirms that a user is under 14, it deletes the account and destroys the collected information. A legal representative may request deletion at baegugu@naver.com.

Technical measures

The Company takes the following technical measures to keep personal information secure:

• Encryption of data in transit with HTTPS/TLS
• Database access control and encrypted storage
• Compliance with OAuth 2.0 and OpenID Connect
• Access control and permission management
• Regular security updates
• Viewing active sessions and remotely signing out

Administrative measures

The Company protects personal information through the following administrative measures:

• Least-privilege access
• Managing and monitoring personal information processing records
• Management and supervision of trustees

Response to a leak

If personal information is leaked or there is a risk of misuse, the Company will notify affected users without delay and take necessary measures.

Google's data processing

Google may process data in the course of social login, Cloud Storage, Google Analytics (including Firebase Analytics), and Firebase Cloud Messaging.

• Google Privacy Policy: https://policies.google.com/privacy
• Google Safety Center: https://safety.google/
• Google account security settings: https://myaccount.google.com/security
• Google Data & Privacy: https://myaccount.google.com/data-and-privacy

Disconnecting Google and deleting data

A user may revoke the Service's access in Google account settings at any time, and may manage and delete Google account data in Google Data & Privacy.

Deleting your account on the Company's Service may leave data in the Google account itself. You must manage and delete Google account data in Google account settings.

Naver's data processing

Naver may process data in the course of social login and Maps API use.

• Naver Privacy Policy: https://policy.naver.com/rules/privacy.html
• Naver Security Center: https://www.naver.com/security
• Naver account settings: https://nid.naver.com/user.naver

Disconnecting Naver

A user may revoke the Service's access in Naver account settings at any time.

Apple's data processing

Apple processes data during Sign in with Apple. Apple may forward email through a Hide My Email address, and may provide a name only at the first sign-in.

• Apple Privacy Policy: https://www.apple.com/legal/privacy/
• Manage Apple ID: https://appleid.apple.com/

Disconnecting Apple

A user may stop using the Company's app in Apple ID settings. Deleting your account on the Service may leave data in the Apple ID itself under Apple's policy.

Personal Information Protection Officer

Baegugu has designated an officer who oversees personal information protection.

Personal information inquiries

For questions about personal information protection or exercising related rights, contact the officer above. The Company will act within 30 days of a request.

Personal Information Protection Commission

If you are not satisfied with the Company's handling, you may file a complaint with the Personal Information Protection Commission (https://www.pipc.go.kr/).

Reporting and counseling for personal information infringement

If you need to report or seek counseling about a personal information infringement, you may contact the institutions below.

• Personal Information Dispute Mediation Committee: www.kopico.go.kr / 1833-6972
• Personal Information Infringement Report Center: privacy.kisa.or.kr / 118
• Supreme Prosecutors' Office: www.spo.go.kr / 1301
• Korean National Police Agency: ecrm.police.go.kr / 182