Privacy policy

1. What we process

Members (app and owner console): email, name, username, optional status, bio and links, language, the availability, plans, polls, events and booking pages you create, and push tokens of devices that receive notifications.

Sign-in: a code sent to your email, or Sign in with Apple or Google. A social sign-in gives us only what that service shares (your name, your email, which Apple may hide behind a private address, and your profile picture), never your password there. If you sign in with Apple we keep an Apple token so we can ask Apple to disconnect Tovi when you delete your account.

Guests who join by link (no account): for bookings, name, contact (email or phone), party size and note; for polls and events, name and answers. To recognise the same browser we store only a hash of a random token, never the token itself.

App downloads and Free features are free. If you buy a Business subscription, Apple processes the payment. Tovi processes the product and transaction identifiers, subscription status, billing period, amount and currency needed to verify access. Tovi sends a pseudonymous Tovi account identifier to Apple to associate the purchase with your account. Tovi does not receive card numbers or payment credentials.

Collected automatically: cookies that keep you signed in and recognise guests, and access logs for fixing errors.

We do not read device contact lists or GPS location. Places, areas and notes you enter yourself are stored as schedule data.

2. Why

To schedule plans, share availability, take and manage bookings, send notifications (email, push), review reports, prevent abuse and fix errors.

We do not use your data for advertising and do not sell it.

3. Who sees what

Friends see only the free time you allow, never what your plans are. When you stop sharing, they stop seeing it at once.

Only the organiser sees other participants' names in polls and events. Only the owner who received a booking sees the guest's contact and note.

4. Retention and deletion

Member data: until you delete your account (Me → Delete account in the app, effective immediately). If you signed in with Apple, deleting also asks Apple to disconnect Tovi (revoking the token), and the stored token is erased with the account.

Guests' booking details (name, contact, note): deleted 180 days after the booking; the booking record (time, party size, status) after 24 months.

Poll guests' names and answers: 180 days after the last candidate time. Polls, plans and events themselves: 24 months.

Sent notification records: 30 days. Unused push tokens: 30 days.

Encrypted database backups for disaster recovery are kept for up to 30 days. Copies of deleted data expire within that period and are not used for routine queries. Deletion requests must be reapplied after a restore.

5. Processors and international transfer

Supabase stores account, schedule, booking and authentication data in the Seoul, South Korea database region for the periods in section 4. Cloudflare processes web and API requests on its global network, which may involve processing outside South Korea. Worker runtime logs have a default retention of three or seven days depending on the plan. Vercel is temporarily retained for compatibility with earlier app server addresses; its current runtime logs are retained for one hour.

Resend (United States) receives email addresses, sign-in codes and message content over the network when sending email. Current email logs are retained for 30 days. Expo and Apple APNs / Google FCM receive enabled devices' push tokens and notification content when sending. Expo keeps notification content only in memory and queues for delivery, not in a separate database.

GitHub (a US provider) stores encrypted database backups as GitHub Actions artifacts for up to 30 days. Apple and Google process authentication data under their policies when you choose their social sign-in.

Expo: when the app checks for updates, it sends its operating system, app project identifier and a randomly generated installation identifier to Expo. This is used to deliver updates and count installations. It is not a unique hardware identifier. Retention follows Expo's privacy notice.

These processors support authentication, request handling, email, push and disaster recovery. Detailed processing locations may vary across each provider's delivery network. Contact us below to request information, restriction or deletion concerning international processing. Declining processing essential to email sign-in or online scheduling may prevent use of those features.

6. Your rights

You can access, correct and delete your data or ask us to stop processing it. Most of this is in the app and owner console; for anything else, contact us below.

Guests can cancel a booking from the browser they booked with or the manage link in their email.

7. Security

Database access is separated by role. Web sign-in tokens live in cookies page scripts cannot read; app sign-in tokens use device secure storage. Guest tokens and manage links are stored only as hashes, and database backups are encrypted.

8. Privacy officer

Officer: 김지구 (JIKOO KIM) · Contact: hello@oruvena.com

Deposit Information

Seller-supplied transfer and identity details and the deposit/refund terms at booking are stored with the booking and shown to its guest. Tovi does not receive bank credentials, card data or actual payment records. These details follow the booking record’s retention/deletion period (up to 24 months).

Business details

Company: 오루베나 (ORUVENA) · Representative: 김지구 (JIKOO KIM)

Business registration no.: 531-16-03083

Address: 부산광역시 동래구 동래로 61, 107호(명륜동, 청마아파트)

Contact: hello@oruvena.com