Privacy Policy

Zorleno (the “operator”) processes users' personal information in operating the Sticker Decor app and website (the “service”) in accordance with the Korean Personal Information Protection Act and other applicable laws. This policy explains what information we process and why, how long we keep it, and how we protect it.

The required “Consent to the Collection and Use of Personal Information” you give when signing up is based on this document. You have the right to refuse consent, but if you do, you can't sign up or use features that need an account (Decorate Together, Chat Corner, favorites, and so on). You can still keep using the app with “Browse without signing in.” If you decline consent without completing sign-up, any account information created up to that point is deleted immediately.

Document version: 1.6
Effective date: 2026-10-18

Contents

Personal information we process, why, and how long we keep it
Information stored only on your device
Browsing without signing in
Children under 14
Automatic deletion
How personal information is destroyed
Provision of personal information to third parties
Outsourcing of personal information processing
Transfer of personal information overseas
Your rights and how to exercise them
Advertising
Automatic collection tools (cookies)
Measures to keep personal information secure
Privacy officer
Remedies for infringement of rights
Changes to this Privacy Policy

Personal information we process, why, and how long we keep it

When you sign up, we store and process the information below on our servers (Firebase). Information kept only on your device, such as photos you use when decorating on your own, is explained separately in the next section.

Purpose: Sign-up and account management
Information processed: Email address, password (for email sign-up; stored as a hash by Firebase Authentication), sign-in provider (Google or Apple) and its identifier, display name of your Google or Apple account, nickname (generated automatically at sign-up and changeable in Settings), profile photo you choose, type of device used to sign up (iOS or Android), app language, device country code, time of sign-up and most recent sign-in
Retention period: Until you delete your account

Purpose: Managing consent records
Information processed: Whether you agreed to the Terms of Service, the collection and use of personal information, and receiving marketing information, the version of each document you agreed to, and the date and time of consent; the date and time you changed your marketing notification setting; whether you confirmed you are 14 or older and when; sign-up method (email, Google, or Apple)
Retention period: Until you delete your account

Purpose: Using stickers, symbols, and frames
Information processed: Favorites and favorite folders, recent usage history
Retention period: Until you delete them yourself or delete your account

Purpose: Decorate Together
Information processed: Room title, room visibility setting (public room or code-only room), invite code, participants' uids and nicknames, photo uploaded by the room host, records (layers) of the stickers, text, decorating materials, drawings, and filters you added along with your nickname, room chat messages, turn information
Retention period: Decorate Together chat messages and reactions are deleted. In unfinished rooms, your participation information and uploaded photos are removed, and rooms you host are closed. Completed rooms retain shared photos, participant uids, and layers with your nickname cleared until the existing 30-day retention period ends.

Purpose: Decorate Together reactions
Information processed: uid of the person who reacted to someone else's layer and the type of reaction chosen
Retention period: Until the reaction is removed, the room is automatically deleted, or you delete your account

Purpose: Chat Corner
Information processed: uid, nickname, profile photo URL, chosen language, message content, time posted
Retention period: 30 days after posting (automatic deletion) or until you delete your account

Purpose: Preventing spam and counting copies
Information processed: Time you sent each message; the time you last copied each piece of content, so that copying the same content repeatedly does not inflate its copy count
Retention period: Until you delete your account

Purpose: Responding to feedback (inquiries)
Information processed: uid, nickname, inquiry content, the operator's reply, status, date and time of the inquiry and reply. When an inquiry is received, a notification containing your nickname, uid, and inquiry content is sent to the operator's email.
Retention period: Until you delete your account

Purpose: Responding to advertising and partnership inquiries
Information processed: uid, company or brand name, contact name, reply email address, inquiry type and content, app language, device type (iOS/Android) and app version, status and operator notes, date and time of the inquiry and its handling, and the time of your last inquiry (to prevent repeated sending). When an inquiry is received, a notification containing this information is sent to the operator's email.
Retention period: 1 year after the inquiry is handled (automatic deletion) or until you delete your account

Purpose: Blocking
Information processed: uid and nickname of users you blocked, date and time of blocking
Retention period: Until you unblock them or delete your account

Purpose: Handling Chat Corner reports
Information processed: Reporter's uid, the reported message's id, content, and language, the author's uid and nickname, status, date and time of the report. When a report is received, a notification containing the reason, the reported target, and the message content is sent to the operator's email.
Retention period: For the period needed to handle the report and respond to disputes. If the reporter deletes their account, the reports they made are deleted.

Purpose: Handling Decorate Together room reports
Information processed: Reporter's uid, room id, reported user's uid and nickname, reason for the report, the message's id and content if a chat message was reported, status, date and time of the report. When a report is received, a notification containing the reason, the reported target, and the message content is sent to the operator's email.
Retention period: For the period needed to handle the report and respond to disputes. If the reporter deletes their account, the reports they made are deleted.

Purpose: Suspension for violating the operating policy
Information processed: Suspended user's uid, reason for the suspension, suspension period (a fixed period or permanent)
Retention period: For the period needed to respond to disputes after the suspension ends

Purpose: Notifications
Information processed: Push token (stored only if you allow notifications; we ask for notification permission when you first join a Decorate Together room or when you turn notifications on in Settings), Decorate Together notification setting, app language used for notification text
Retention period: Until the token expires or you delete your account

Purpose: In-app notification inbox
Information processed: Type and content of “Your turn,” completion, inquiry reply, reaction, and “Decorate again” invitation notifications, and the time of each notification
Retention period: 60 days after it is saved (automatic deletion) or until you delete your account. When you delete your account, your nickname is also removed from notifications left in other people's notification inboxes (such as reaction notifications).

Purpose: Sending marketing information (only if you opted in)
Information processed: Whether you agreed to receive marketing information, push token, email address
Retention period: Until you withdraw consent or delete your account

Purpose: Error analysis and app stability
Information processed: When the app crashes or an unhandled error occurs: device model, OS version, app version, error details and stack trace, a record of the screens used just before the error, and your member identifier (uid) if you are signed in
Retention period: 90 days (the default Firebase Crashlytics retention period)

Purpose: Service operation, security, and error response
Information processed: Information generated automatically while you use the service: IP address, date and time of access, device and app installation identifier (Firebase installation ID)
Retention period: About 30 days (the default Google Cloud log retention period)

Purpose	Information processed	Retention period
Sign-up and account management	Email address, password (for email sign-up; stored as a hash by Firebase Authentication), sign-in provider (Google or Apple) and its identifier, display name of your Google or Apple account, nickname (generated automatically at sign-up and changeable in Settings), profile photo you choose, type of device used to sign up (iOS or Android), app language, device country code, time of sign-up and most recent sign-in	Until you delete your account
Managing consent records	Whether you agreed to the Terms of Service, the collection and use of personal information, and receiving marketing information, the version of each document you agreed to, and the date and time of consent; the date and time you changed your marketing notification setting; whether you confirmed you are 14 or older and when; sign-up method (email, Google, or Apple)	Until you delete your account
Using stickers, symbols, and frames	Favorites and favorite folders, recent usage history	Until you delete them yourself or delete your account
Decorate Together	Room title, room visibility setting (public room or code-only room), invite code, participants' uids and nicknames, photo uploaded by the room host, records (layers) of the stickers, text, decorating materials, drawings, and filters you added along with your nickname, room chat messages, turn information	Decorate Together chat messages and reactions are deleted. In unfinished rooms, your participation information and uploaded photos are removed, and rooms you host are closed. Completed rooms retain shared photos, participant uids, and layers with your nickname cleared until the existing 30-day retention period ends.
Decorate Together reactions	uid of the person who reacted to someone else's layer and the type of reaction chosen	Until the reaction is removed, the room is automatically deleted, or you delete your account
Chat Corner	uid, nickname, profile photo URL, chosen language, message content, time posted	30 days after posting (automatic deletion) or until you delete your account
Preventing spam and counting copies	Time you sent each message; the time you last copied each piece of content, so that copying the same content repeatedly does not inflate its copy count	Until you delete your account
Responding to feedback (inquiries)	uid, nickname, inquiry content, the operator's reply, status, date and time of the inquiry and reply. When an inquiry is received, a notification containing your nickname, uid, and inquiry content is sent to the operator's email.	Until you delete your account
Responding to advertising and partnership inquiries	uid, company or brand name, contact name, reply email address, inquiry type and content, app language, device type (iOS/Android) and app version, status and operator notes, date and time of the inquiry and its handling, and the time of your last inquiry (to prevent repeated sending). When an inquiry is received, a notification containing this information is sent to the operator's email.	1 year after the inquiry is handled (automatic deletion) or until you delete your account
Blocking	uid and nickname of users you blocked, date and time of blocking	Until you unblock them or delete your account
Handling Chat Corner reports	Reporter's uid, the reported message's id, content, and language, the author's uid and nickname, status, date and time of the report. When a report is received, a notification containing the reason, the reported target, and the message content is sent to the operator's email.	For the period needed to handle the report and respond to disputes. If the reporter deletes their account, the reports they made are deleted.
Handling Decorate Together room reports	Reporter's uid, room id, reported user's uid and nickname, reason for the report, the message's id and content if a chat message was reported, status, date and time of the report. When a report is received, a notification containing the reason, the reported target, and the message content is sent to the operator's email.	For the period needed to handle the report and respond to disputes. If the reporter deletes their account, the reports they made are deleted.
Suspension for violating the operating policy	Suspended user's uid, reason for the suspension, suspension period (a fixed period or permanent)	For the period needed to respond to disputes after the suspension ends
Notifications	Push token (stored only if you allow notifications; we ask for notification permission when you first join a Decorate Together room or when you turn notifications on in Settings), Decorate Together notification setting, app language used for notification text	Until the token expires or you delete your account
In-app notification inbox	Type and content of “Your turn,” completion, inquiry reply, reaction, and “Decorate again” invitation notifications, and the time of each notification	60 days after it is saved (automatic deletion) or until you delete your account. When you delete your account, your nickname is also removed from notifications left in other people's notification inboxes (such as reaction notifications).
Sending marketing information (only if you opted in)	Whether you agreed to receive marketing information, push token, email address	Until you withdraw consent or delete your account
Error analysis and app stability	When the app crashes or an unhandled error occurs: device model, OS version, app version, error details and stack trace, a record of the screens used just before the error, and your member identifier (uid) if you are signed in	90 days (the default Firebase Crashlytics retention period)
Service operation, security, and error response	Information generated automatically while you use the service: IP address, date and time of access, device and app installation identifier (Firebase installation ID)	About 30 days (the default Google Cloud log retention period)

Information stored only on your device

Photos you use when decorating on your own, drafts in progress, the Archive, and My stickers (stickers made from your own photos) are stored only on your device and are never sent to our servers. Decorating dates are stored only on the device per account, remain after sign-out, and are removed for that account on deletion. Calendar widgets receive dates, streaks, and localized text, not photos or uids.
Cutting out a subject from a photo to make one of My stickers is also done on your device.
Saving a finished photo to your photo library or copying a sticker to the clipboard also happens on your device.
When a Decorate Together room is completed, the finished work is saved automatically to each participant's Archive on their device. This copy exists only on the device.
The Archive, My stickers, and drafts are kept on your device separately for each account. They stay on the device after you sign out and appear again when you sign back in with the same account.
When you delete your account, the Archive, My stickers, and drafts of that account stored on that device are deleted. If you delete the app, the information stored on your device is deleted with it.

Browsing without signing in

Without signing in, you can browse and copy stickers and symbols, decorate on your own, and use frames. In this case we do not collect account information such as your email address or nickname.
Decorating work, the Archive, and My stickers you create while browsing are stored only on your device.
To use features that need an account, such as Decorate Together, Chat Corner, and favorites, you need to sign up.
If an app error occurs, device information and error details may be collected by Firebase Crashlytics even while browsing. In this case no member identifier (uid) is attached.

Children under 14

Sticker Decor does not accept sign-ups from children under the age of 14. At sign-up we ask you to confirm that you are 14 or older, and we record whether and when you confirmed it.

If we learn that personal information of a child under 14 has been collected, we delete it without delay.

Automatic deletion

Every day in the early morning (Korea time), our server automatically deletes data whose retention period has ended.

Chat Corner (the shared chat for each language) messages are deleted 30 days after they are posted.
Decorate Together rooms are deleted based on their last activity: 30 days for completed or closed rooms, 7 days for rooms waiting to start, and 60 days for rooms in progress that have stalled.
When a Decorate Together room is deleted, its photo, room chat, records (layers) of the stickers, text, decorating materials, and drawings added to it, and reactions are deleted with it.
Photos of completed Decorate Together rooms are deleted from our servers after 30 days. The finished work is saved in each participant's Archive on their device.
Notifications in the in-app notification inbox are deleted 60 days after they are saved.
Error analysis records are deleted from Firebase Crashlytics after 90 days.
Advertising and partnership inquiries are deleted 1 year after the operator finishes handling them.
Report records are excluded from automatic deletion and kept separately to handle reports and respond to disputes.

How personal information is destroyed

When the retention period ends or the purpose of processing has been achieved, we destroy the information without delay. Information that other laws require us to keep is stored separately from other information for the required period and then destroyed.
Information in electronic form is erased so it cannot be recovered by deleting the database documents and storage files. Backup copies remaining in Google's systems are deleted after a certain period under Google's deletion procedures.
Decorate Together rooms and Chat Corner messages are destroyed automatically every day under the “Automatic deletion” rules above.
When you delete your account, our server deletes the data linked to your account all at once and then deletes the account itself last. You can see what is deleted in “Account deletion.”

Provision of personal information to third parties

We do not provide users' personal information to third parties, except where the law specifically requires it or an investigative agency requests it following procedures set out in law.

Outsourcing of personal information processing

To provide the service, we entrust the processing of personal information as follows.

Processor: Google LLC
Outsourced tasks: Firebase Authentication (sign-in), Cloud Firestore (data storage), Cloud Storage for Firebase (photo storage), Cloud Functions for Firebase (server processing), Firebase Cloud Messaging (push notifications), Firebase Crashlytics (error analysis), Gmail (receiving report and inquiry notification emails), Google AdMob (ad serving)

Processor	Outsourced tasks
Google LLC	Firebase Authentication (sign-in), Cloud Firestore (data storage), Cloud Storage for Firebase (photo storage), Cloud Functions for Firebase (server processing), Firebase Cloud Messaging (push notifications), Firebase Crashlytics (error analysis), Gmail (receiving report and inquiry notification emails), Google AdMob (ad serving)

Transfer of personal information overseas

Because of the outsourcing above, personal information is transferred outside Korea (Article 28-8 of the Korean Personal Information Protection Act). The details of the transfer are as follows.

Item: Recipient
Details: Google LLC (Firebase, Firebase Crashlytics, Gmail, Google AdMob)

Item: Recipient's contact
Details: Google privacy inquiries: https://support.google.com/policies/contact/general_privacy_form

Item: Destination countries
Details: The United States and other countries where Google has data centers. Server functions (Cloud Functions) run in the United States (us-central1), and sign-in (Firebase Authentication) is processed in US data centers.

Item: Time and method of transfer
Details: Transmitted as needed over an encrypted network whenever you use the service

Item: Information transferred
Details: The items in the table “Personal information we process, why, and how long we keep it” above (information stored on our servers and error analysis information) and the ad processing information described in “Advertising”. Information stored only on your device is not transferred.

Item: Purpose of use
Details: Account authentication, data storage, running server features, sending push notifications, error analysis, receiving report and inquiry notification emails, ad serving

Item: Retention and use period
Details: The same as the retention period for each item in the table above (90 days for error analysis information). Ad processing information follows Google's retention policies.

Item: Legal basis for the transfer
Details: Outsourcing and storage of processing needed to perform the contract for providing the service, disclosed in this Privacy Policy (Article 28-8(1)(iii) of the Korean Personal Information Protection Act).

Item: How to refuse and what happens if you do
Details: You can refuse by not signing up or by deleting your account. If you refuse, you can't use features that need an account (Decorate Together, Chat Corner, favorites, and so on). Sending app error information can't be turned off separately in the app.

Item	Details
Recipient	Google LLC (Firebase, Firebase Crashlytics, Gmail, Google AdMob)
Recipient's contact	Google privacy inquiries: https://support.google.com/policies/contact/general_privacy_form
Destination countries	The United States and other countries where Google has data centers. Server functions (Cloud Functions) run in the United States (us-central1), and sign-in (Firebase Authentication) is processed in US data centers.
Time and method of transfer	Transmitted as needed over an encrypted network whenever you use the service
Information transferred	The items in the table “Personal information we process, why, and how long we keep it” above (information stored on our servers and error analysis information) and the ad processing information described in “Advertising”. Information stored only on your device is not transferred.
Purpose of use	Account authentication, data storage, running server features, sending push notifications, error analysis, receiving report and inquiry notification emails, ad serving
Retention and use period	The same as the retention period for each item in the table above (90 days for error analysis information). Ad processing information follows Google's retention policies.
Legal basis for the transfer	Outsourcing and storage of processing needed to perform the contract for providing the service, disclosed in this Privacy Policy (Article 28-8(1)(iii) of the Korean Personal Information Protection Act).
How to refuse and what happens if you do	You can refuse by not signing up or by deleting your account. If you refuse, you can't use features that need an account (Decorate Together, Chat Corner, favorites, and so on). Sending app error information can't be turned off separately in the app.

Your rights and how to exercise them

You can at any time request access to, correction of, deletion of, or suspension of the processing of your personal information, and withdraw your consent.
You can do this yourself in the app. Change your nickname and profile photo in Settings, and turn marketing notifications and Decorate Together notifications on or off in Settings. Unblock users in Settings > “Blocked users,” and delete your account and data in Settings > “Delete Account.”
For other requests, use Settings > “Send Feedback” or email zorleno.co@gmail.com. After confirming your identity, we will handle your request without delay and let you know the result.
You can also make a request through a legal representative or an authorized agent. In that case, documents proving the authorization are required.
Your request may be limited or refused under applicable law, and if so, we will tell you why.

Advertising

The app uses Google AdMob to show banner ads at the top of some screens, and rewarded ads that you can choose to watch when you want to keep saving or copying (watching one to the end lets you use the app without ads for 30 minutes). Ads are shown even if you are not signed in.
We request only non-personalized ads, not personalized ads tailored to your interests. We do not collect advertising IDs (IDFA on iOS, advertising ID on Android), and we do not request App Tracking Transparency permission on iOS.
To show ads, prevent invalid clicks and measure ad performance, Google processes device information (operating system, device model, app version, language), approximate location inferred from your IP address, and ad impression and click records. This information is processed under Google's Privacy Policy (https://policies.google.com/privacy), and we do not receive any ad information that can identify individual users.
Users in the European Economic Area (EEA), the UK and Switzerland may see Google's consent dialog before ads are shown. You can use the app without consenting, in which case only limited ads are shown.

Automatic collection tools (cookies)

The website uses only one cookie, which remembers the language you chose (sd_lang, 1 year). It contains no information that identifies you. You can delete or block cookies in your browser settings; if you block it, the site will be shown in your browser's language on your next visit.

Measures to keep personal information secure

Access management: We limit the people who handle personal information to the operator and manage access permissions for the Firebase console and admin tools.
Access control: Firestore and Storage security rules make sure only you can read and write your account information, only the author can see an inquiry, and only the operator can see report records and advertising and partnership inquiries.
Encryption in transit: Communication between the app and our servers is encrypted (TLS).
Protection of stored data: Google Cloud encrypts stored data by default, and passwords are stored as hashes by Firebase Authentication, so not even the operator can know them.
Minimal processing: Error reports include only your uid, not your email address or nickname, and photos you decorate on your own and My stickers are never sent to our servers.

Privacy officer

For questions, complaints, or requests for remedies regarding the processing of personal information, please contact us below. We will respond and handle them without delay.

Name: 류승환 (Seunghwan Ryu)
Position: Operator (Zorleno)
Email: zorleno.co@gmail.com
Receiving and handling access requests: the same email address, or Settings > “Send Feedback” in the app

Remedies for infringement of rights

Because the operator is based in Korea, if you need a remedy for an infringement of your personal information, you can apply to the following Korean agencies for dispute mediation or counseling.

Personal Information Dispute Mediation Committee: 1833-6972, https://www.kopico.go.kr
Personal Information Infringement Report Center (Korea Internet & Security Agency, KISA): 118, https://privacy.kisa.or.kr
Supreme Prosecutors' Office: 1301, https://www.spo.go.kr
Korean National Police Agency: 182, https://ecrm.police.go.kr

Changes to this Privacy Policy

If we change this Privacy Policy, we will let you know on this page of the website and in the app. Changes that are unfavorable to users or otherwise important will be announced before they take effect.
This document is effective from 2026-10-18 (1.6: adds banner and rewarded ad operation and Google AdMob processing). Previous versions: 1.5 (effective 2026-10-15), 1.4 (effective 2026-10-14), 1.3 (effective 2026-10-13), 1.2 (effective 2026-10-13), 1.1 (effective 2026-10-12).