Privacy Policy

1. About this policy

Align is independently operated by an individual, referred to here as “we,” “us,” or “our.” This policy covers the Align website and app. The operator is responsible for handling your personal information and privacy requests. You can reach us at gm@wemorph.xyz.

We handle personal information in accordance with the Personal Information Protection Act of the Republic of Korea and other applicable laws. Features and information collected may differ by platform and by the features you choose to use.

2. Information we handle

• Account information. Your account identifier, email address, sign-in provider, and account profile information supplied through authentication. Apple may provide a private relay email address. Google and Apple handle their own passwords; Align does not receive those passwords.
• Routine content. Titles, notes, scheduled times, repeat days, time zone, uploaded images, and the media or chart connections you save, including their order, links, titles, artwork, and provider metadata.
• Completion history. The routine you mark complete, the completion date and timestamp, and the recording time zone used to show daily completion and streaks.
• Search and connection requests. Music search terms, pasted media links, and selected market symbols are processed to find or display the content you request.
• Device and service information. Language and theme preferences, authentication and security identifiers, and technical request information such as IP address, browser or app version, operating system, timestamps, and errors processed by our hosting and security services.
• Messages you send us. Your email address and the information you include when asking for help or exercising your privacy rights.

The introduction website uses fictional sample routines in its previews. Viewing those previews does not load your account or saved routines. Uploading an image only sends the file you select, not your entire photo library. Please avoid putting highly sensitive information or another person’s private information in your routines unless you have an appropriate basis to do so.

3. Why we use this information

We use information to authenticate you, save and retrieve your routine pages, display connected media, record completions, remember your preferences, respond to requests, maintain reliability, and prevent abuse. Core processing is undertaken as necessary to provide the service you request. Where consent or another legal basis is required, we will obtain that consent or establish that basis. This policy is not a blanket consent to unrelated uses of your information.

We do not sell your personal information. Your routines are not published as a public feed. Uploaded images are served through direct file URLs, however, and someone who has an image URL may be able to view that image. These URLs should not be treated as confidential storage or shared publicly if you want the images to remain private.

4. Service providers and connected media

We use service providers to operate Align. They process information needed for their respective functions:

• Google Firebase: account authentication and storage of account information, routines, and completion history.
• Amazon Web Services: storage and delivery of the image files you upload.
• Vercel: website and application hosting, request delivery, and operational logs.
• Mixpanel: planned product analytics, described separately below. It is not currently integrated into Align.

Apple/iTunes, Spotify, YouTube/Google, and TradingView supply external content. Searching, loading artwork or charts, playing media, or opening a link can send the relevant query or content identifier and technical connection information to that provider. Some requests occur when a preview loads, before you press play. Providers may use their own cookies or similar technologies under their own privacy policies. Adding a Spotify or YouTube link does not give Align access to your account with that provider.

We may also disclose information when required by law or when lawfully necessary to address fraud, security incidents, or a legal claim. We limit such disclosures to the relevant information.

5. Planned analytics with Mixpanel

We plan to use Mixpanel to understand how people use Align and improve the experience. Planned events include opening a screen, creating a routine, using a media feature, and marking a routine complete. Event information may include a pseudonymous device or account identifier, event time, app version, device type, operating system, and language. An identifier is not necessarily anonymous if it can be linked to an account.

Our intended setup will exclude routine titles, note text, uploaded images, private media links, authentication tokens, and email message contents from analytics events. Session replay is not currently enabled. Mixpanel integration and its privacy controls have not yet been activated; this notice does not mean that tracking is already occurring.

Before enabling it, we will update this policy with the actual event fields, processing location, retention period, and available controls, and obtain any consent required by law. You will be able to refuse optional analytics without losing access to core routine features. For details about the provider’s privacy tools, see Mixpanel’s privacy documentation.

6. Cookies and device storage

The web app uses an authentication session cookie with a maximum lifetime of 14 days and a security identifier cookie lasting up to one day to help limit abusive requests. Browser or device storage keeps sign-in state and choices such as language and appearance. Email-link sign-in may temporarily remember the email address used to complete that sign-in.

You can manage cookies and local storage in your browser settings and app permissions in your device settings. Clearing or blocking essential storage may sign you out or reset preferences. Signing out or uninstalling the app does not delete your stored account. Future optional analytics storage will be described before it is enabled.

7. Retention and deletion

Account and routine information is kept to provide your saved pages and history while your account is in use, until you delete the information or request erasure, subject to applicable legal requirements. In Settings, Delete account removes the authentication account, account profile, routines, and completion records from the active database.

Uploaded image files are stored separately. Removing an image from a routine or deleting an account does not currently automatically erase the underlying file. Contact gm@wemorph.xyz to request deletion of those files, including files from an upload you did not save. Include enough information to identify the account or file; never send passwords or sign-in tokens.

Support messages and security records are retained only as needed to resolve the request, investigate an incident, or meet an applicable legal obligation. If information must be retained by law, we limit its use to that purpose and delete it when the required period ends. Provider backups and cached copies may remain until their scheduled expiry. Deletion from active systems does not promise instant removal of every backup or a copy already held by an external provider.

8. International processing

Our infrastructure and external content providers may process information outside the Republic of Korea, including in the United States. Locations depend on the provider and deployment configuration. Mixpanel’s processing region has not yet been selected for Align.

Where Korean law requires a specific overseas-transfer notice or consent, we will provide the recipient, destination, data items, purpose, timing and method, retention period, and refusal procedure through the applicable notice before the transfer. This general description does not replace that notice or consent. Refusing an overseas transfer needed for a core service may prevent us from providing that service; refusing optional analytics does not.

9. Your rights and privacy requests

You may request access to, correction of, or deletion of your personal information, suspension of processing, or withdrawal of consent where applicable. You may also ask for a copy of your information and exercise any other rights provided by applicable law. You can edit routine content in the app, undo today’s completion, or delete your account in Settings.

For other requests, contact gm@wemorph.xyz. We may need to verify your identity or an authorized representative’s authority. We will respond within the applicable statutory time limit and explain any lawful restriction or reason we cannot fulfill a request. You may also seek assistance from the Republic of Korea’s Personal Information Protection Commission or Personal Information Dispute Mediation Committee.

10. Security, children, and policy changes

We use authenticated access, ownership checks, encrypted connections, and request limits to help protect the service. No storage or transmission method is completely secure. Align is not intended for children under 14. If you believe a child under 14 has provided personal information, contact us so we can investigate and take appropriate action.

We will update the date above when this policy changes and give additional notice of material changes where required. A new use that requires consent will not be authorized merely by posting an updated policy.