Privacy Policy

• At sign-up: email address, nickname, date of birth (for age verification), and the country and city at the time of sign-up (derived from connection information).
• Consent record: when you accepted the terms, which version you accepted, and the minimum age applied.
• While using the Service: artists you follow, reports you submit, notification settings, display language, and last access time.
• Optional: profile photo, opt-in to email updates, web push subscription, and the neighborhood for alerts (a spot you pick on the map yourself, stored only to about 1 km).

To identify members and provide the Service, to notify you about artists you follow, to review reports and keep a record of those we publish, and to analyze usage statistics so we can improve the Service.

We erase your data as soon as you close your account. Reports already published to other users may remain, with the author information separated and anonymized. Where the law requires us to retain certain records, we keep them for that period and then destroy them.

You may view and correct your personal data at any time, and you may close your account, which deletes it, from Settings.

Artist trail information shown in the Service is built only from what has already been made public. There are three sources: news reports, concert dates on sale, and user reports. We collect nothing by photographing, following, or tracking artists, and nothing through positioning devices.

The legal basis for this processing is legitimate interests (GDPR Article 6(1)(f); Korean Personal Information Protection Act Article 15(1)(6)). Our legitimate interest is letting fans see publicly announced activity in one place, and we apply the following safeguards to balance that against artists' rights.

• Sightings outside official events are never stored as exact coordinates, only as a neighborhood of about 1 km.
• Where an area has been reported to us as a private space, such as a residence, we publish nothing within that radius.
• We publish no trail information for artists under 19, whether or not the event was public.
• Sightings are removed from the map after 30 days.
• A person reviews everything before it is published. Concert dates announced by the ticket seller are the one exception and are published automatically.

An artist or their agency may object to this processing at any time. If you use our contact page to request deletion of specific information or full removal, which also stops collection, we act without delay once we have verified that you are the artist or are duly authorized. If we cannot act on a request, we will explain why.

We use no advertising or tracking cookies and share no user information with third-party ad networks. We use three cookies.

• Sign-in session: keeps you signed in. Essential to using the Service.
• Language: remembers the display language you chose.
• Visit count: a date marker so one visitor is counted once a day. It expires after 36 hours and holds nothing that identifies you.

We gather visit statistics two ways. Our own count stores only the number of visits per day, never who visited. We also use the web analytics built into our host (Vercel Inc.), which uses no cookies and distinguishes visitors by an anonymous value that is discarded daily.

To run the Service we entrust personal data to the processors below, whose servers are outside the Republic of Korea, mainly in the United States. Only the data needed for each purpose is transferred, at the time you use the Service, and it is kept until the processing agreement ends or you close your account.

• Supabase Inc. (United States): member data storage, sign-in authentication, and storage of report photos.
• Vercel Inc. (United States): hosting and visit statistics.
• Google LLC (United States): authentication if you choose to sign in with Google.
• Resend (Plus Five Five, Inc., United States): sending sign-in links and notification emails.

You may refuse the transfer of your personal data abroad, but doing so limits your use of the Service.

• All traffic runs over an encrypted connection (HTTPS).
• Access is restricted at the database level so that only you can view or change your own data.
• Who submitted a report, and our review notes, never leave for any public screen.
• Administrator functions are limited to designated accounts.

We check date of birth at sign-up so that no one under 13, or under 14 in the Republic of Korea, can create an account. Only users aged 16 and over may opt in to email updates. If we find an account belongs to someone below the minimum age, we destroy the account and its data without delay.

• Officer: 한욱진 (가바주식회사)
• Phone: 0507-1364-6608
• Email: hey@spotted.live

When you close your account we delete your account data without delay. Records the law requires us to keep are stored separately and destroyed when that period ends. Electronic files are deleted by means that make them unrecoverable, and for reports already published we separate and anonymize the author information.

If your personal data has been harmed, you may seek dispute resolution or advice from the Korean bodies below.

• Personal Information Dispute Mediation Committee (kopico.go.kr · 1833-6972)
• Privacy Infringement Report Center (privacy.kisa.or.kr · 118)
• Supreme Prosecutors' Office, Cybercrime Division (spo.go.kr · 1301)
• National Police Agency, Cybercrime Investigation Bureau (ecrm.police.go.kr · 182)

If you disagree with how we handled something, tell our data protection officer first and we will respond without delay.

If this policy changes we announce it in the Service, and we give notice before any change that disadvantages users takes effect.