Nina — Terms & Privacy
Privacy Policy
Effective: June 23, 2026 | Last updated: June 23, 2026
Hyeon Tae Kim (the "Operator") establishes and discloses this Privacy Policy to protect users' personal information in connection with the mobile application Nina (the "App") and related services (the "Service"), in compliance with applicable laws including the Personal Information Protection Act of Korea.
1. Personal Information Collected and Collection Methods
The Operator may collect the following personal information to provide the Service.
| Category | Items collected | Collection method |
|---|---|---|
| Sign-up / login | Social login identifier, email (if provided), name/nickname (if provided), profile photo URL (if provided) | Received from Kakao, Google, or Apple when using social login |
| Profile / onboarding | Name, gender, date of birth, height/weight, profile photo | Entered or uploaded by the user in the App |
| Meal logs | Food name, calories and nutrition, meal type/time, notes | Entered by the user or generated through AI analysis or search |
| Food photos | Captured or selected food images (thumbnails) | Provided by the user from camera or gallery |
| Health goals | Target calories, carb/protein/fat goals, weight-related settings | Entered by the user in the App |
| Service usage | Access timestamps, device info (OS, app version, etc.), auth tokens, error and usage logs | Generated automatically during use of the Service |
The Operator does not knowingly collect personal information from children under 14. If such collection is identified, the information will be deleted without delay.
2. Purposes of Collection and Use
- User identification, authentication, and service provision
- Meal logging, nutrition analysis, and calorie/macro goal management
- Extracting nutrition information through AI analysis of food photos
- Storing and syncing profile and personalized settings
- Service improvement, error handling, security, and abuse prevention
- Handling user inquiries and complaints
- Compliance with legal obligations
3. Retention and Use Period
Personal information is retained until the purpose of collection and use is fulfilled. Where required by law, information may be retained for the period prescribed by applicable regulations.
- Member information and meal logs: Until account deletion (deleted without delay after deletion)
- Legal retention: As required by applicable laws, including consumer protection regulations
4. Provision to Third Parties
The Operator does not provide users' personal information to third parties in principle, except in the following cases:
- When the user has given prior consent
- When required by law or by lawful request from investigative authorities
5. Processing Entrustment and Cross-Border Transfer
The Operator may entrust processing or use services of overseas providers as follows to operate the Service.
| Processor | Entrusted tasks | Retention period |
|---|---|---|
| Supabase, Inc. | Authentication, database and file storage, serverless function execution | Until contract termination or account deletion |
| OpenRouter / AI model providers (e.g., OpenAI, Google) | Food photo analysis and nutrition extraction (AI processing) | Until the analysis request is completed (no unnecessary long-term server retention) |
| Kakao Corp. | Kakao social login authentication | Until authentication is completed |
| Google LLC | Google social login authentication | Until authentication is completed |
| Apple Inc. | Apple social login authentication | Until authentication is completed |
Servers operated by Supabase and AI providers may be located outside the Republic of Korea, and users' personal information may be transferred abroad. The Operator complies with protection measures required by applicable law.
6. Destruction Procedures and Methods
Personal information is destroyed without delay when the retention period expires or the purpose is achieved.
- Electronic files: Permanently deleted in a manner that prevents recovery
- Paper records: Shredded or incinerated
- Upon account deletion: Account information, meal logs, uploaded photos, and related data are deleted (except where legal retention is required)
7. User Rights and How to Exercise Them
Users may exercise the following rights at any time:
- Request access, correction, deletion, or suspension of processing of personal information
- Withdraw consent to collection, use, or provision of personal information
- Request account deletion
These rights may be exercised through in-app settings or the contact information below. The Operator will take action without delay in accordance with applicable law.
8. Security Measures
The Operator implements the following measures to protect personal information:
- Access control and least-privilege principles
- Database Row Level Security (RLS) so users can access only their own data
- Encryption in transit (HTTPS) and token-based API access
- Server-side storage of API keys and secrets (no client exposure)
- Minimizing personnel with access to personal information
9. Cookies and Local Storage
The App may store session and authentication tokens on the device for service delivery and security. This is necessary for essential functions such as maintaining login state. The information is removed when the user logs out or deletes the App.
10. Privacy Officer
The Operator designates the following privacy officer to oversee personal information processing and handle user complaints and remedies.
- Name: Hyeon Tae Kim
- Title: Operator
- Email: contact@kodoko.ai
11. Remedies for Infringement
For reports or consultation regarding personal information infringement, users may contact:
- Personal Information Dispute Mediation Committee (Korea): 1833-6972 — www.kopico.go.kr
- Korea Internet & Security Agency (KISA) Privacy Center: 118 — privacy.kisa.or.kr
12. Changes to This Policy
If this Policy changes, notice will be provided in the App or on this page. If changes materially affect user rights, notice will be given at least 7 days before the effective date (30 days in advance if unfavorable to users).
The Korean version of this Privacy Policy is the authoritative version for users in Korea. This English translation is provided for convenience.