This English version is provided for convenience. If there is any conflict, the Korean version prevails.

Proce Privacy Policy

Yigo Corp. (와이고 주식회사, the "Company") operates Proce (the "Service"). In doing so, the Company complies with the Personal Information Protection Act (개인정보보호법) and other applicable laws, and establishes and publishes this Privacy Policy to protect users' personal information.

1. How the Service works — why this policy is short

Personal Proce can be used without signing in and, unless optional encrypted backup is enabled, does not store users' files, code, conversations, or screens on Company servers. The iPhone and Mac connect directly, and content that passes between them is not retained. An account is created only when a user chooses Apple, Google, or email sign-up or subscribes. The Company stores only the minimum account and subscription data needed to operate the Service. Company Proce additionally stores company membership information on the same account server.

2. Personal information we collect

• In-app inquiries are delivered to and retained in the support mailbox. Inquiry text is not stored in the account database, but it is collected and processed for customer support. Inquiry retention follows Section 5. Files, conversations, screens, and raw logs are not automatically attached.
• Personal use does not require sign-up. A real name, phone number, or date of birth is not required. Optional display names and preferred AI forms of address may be stored with your account. It receives an email address only when you choose email login, use a company account, or request a reply. Apple and Google login do not store the provider's email or name.
• Unless you enable optional encrypted backup, your files, code, conversations, screens, and terminal output are not collected or stored by the Company. They can be read only on your iPhone and Mac. Encrypted backup stores ciphertext that the Company cannot read. When a remote connection passes through a Company server, the server forwards encrypted data, cannot read it, and does not keep it.
• The App Store processes payments. The Company stores only the identifiers, product, and status needed to verify entitlement and does not collect card or payment method data.
• Anonymous activity metrics can be disabled in account settings. The Company does not store the original installation UUID or IP address. Daily HMAC rows are deleted after 35 days, and aggregated totals contain no user identifier.
• AI responses are generated through your own AI tool accounts, such as Claude or Codex. The Company does not receive or keep those account details or the content of those conversations.
• Tailscale (the network used to connect the phone and Mac directly) is installed and signed in to by you, with your own account. The Company does not create or operate that account.

2-1. Items stored on the account server

The server stores optional display names and preferred AI forms of address, profile revision numbers, account and login identifiers, optional email login addresses, subscription status, Product Trial and referral records, anonymous daily activity rows, login codes and sessions, company membership and invitations, abuse-prevention counters, a daily hash of the company audit log, and the company Mac public key. Company work content — including work products, source materials, goals, projects, tasks, and approval records — stays only on the company representative's Mac and is not transmitted to or stored on Company servers.

• Company computer handoffs store company/request/representative and source/target computer identifiers, target name and public key, expected revision, handoff state, encrypted checkpoint digest, creation time and expiry time. Approval expires after one hour. Metadata remains until company deletion or replacement by the next handoff request. Company files and encryption keys are never stored by the account service.
• Company work-computer registration stores the company and computer identifiers, computer name and public key, revision and registration state, registration timestamp, request identifier, and registering account identifier. These remain until company deletion or computer deregistration.
• Login codes and refresh tokens are stored only as hashes. Access tokens expire after 15 minutes and are not stored. Login sessions expire 60 days after last use.
• Product Trial records contain the account identifier, trial start, end, and first Mac connection timestamps, referral code, valid referral count, rewarded days, start trigger, and an HMAC of the random installation identifier. Referral index and redemption records contain the referring and referred account identifiers, the code used, redemption timestamp, reward, status, and installation HMAC. They remain until account deletion and do not contain work content. To prevent repeated rewards after deleting and recreating an account, a separate record containing only the installation HMAC, use time, status, and deletion time is retained for 365 days; it contains no account or referral code.
• Anonymous daily activity rows are deleted after 35 days; App Store notification deduplication records after 180 days; invitations become invalid after 7 days; and abuse-prevention counters after 1 hour. Company membership data remains until membership or account deletion.
• Company audit logs stay on the company Mac for the period selected by the company (one year by default, configurable from three months to five years). The server keeps only a non-reversible daily hash for one year so later changes can be detected.
• Account deletion removes server records without delay. Disaster-recovery backups may retain them for up to 35 days. Server error logs are deleted after one week and contain no email address, login code, token, or request content.
• If the user enables encrypted cloud backup, the device encrypts selected data with AES-GCM before upload. The server stores only ciphertext and minimal backup metadata. The recovery key stays in the user's device keychain and is never sent to Proce. Backups are deleted at the selected 7, 30, or 90 day limit, on manual or account deletion, or after the selected 0–90 day grace period following Pro expiry.

2-2. Items handled by company Slack and GitHub connections

When a company connects Slack or GitHub, request text passes through a Company server in a signed envelope to the company representative's Mac and is not stored. Work result content does not reach the server. The server stores only the connection identifiers and display name, optional GitHub account link, the channel/thread or repository/issue location used for a reply, a hash for deduplication, and request counters. Reply-location records are deleted after 14 days, deduplication hashes after one day, and request counters after two hours. Slack bot tokens are kept in encrypted secret storage until disconnection; short-lived GitHub tokens are not stored.

3. Why we use personal information

• To send approval and question notifications (to alert your iPhone when a task has stopped and needs your review)
• For personal use: optional sign-in, Product Trial and referral rewards, subscription verification and restoration, and account recovery
• For company use: login, member, invitation and role management, seat verification, and login abuse prevention
• For company Slack/GitHub connections: deliver a request to the company representative's Mac and return progress to the same place
• To handle customer inquiries and complaints

4. How long we keep personal information

• Push token: deleted without delay when you remove the device registration or delete the app. There is no separate expiry process. You can remove a device at any time from the "Registered devices" screen in the Mac app.
• Connection signaling information: We do not record the IP addresses you connect from. Temporary room information exists only while the phone and Mac are finding each other. It is deleted after 60 seconds of inactivity and is never kept longer than 180 seconds. Server logs used to diagnose errors are automatically deleted after 1 week and do not contain the content of communications.
• Encrypted relay information: relay room information is deleted when the connection ends and is never retained longer than 3 hours. Only the message count used for a monthly limit is kept for 40 days. Relayed content is encrypted, cannot be read by the Company, and is not stored.
• Account, Product Trial, referral, and Slack/GitHub information: retained as described in Sections 2-1 and 2-2. Reply-location identifiers are automatically deleted after 14 days.
• Inquiry records: kept for 3 years after the inquiry is resolved (records of consumer complaints and dispute handling under the Act on the Consumer Protection in Electronic Commerce, Etc. (전자상거래법)), then deleted.

5. Providing personal information to third parties

The Company does not provide users' personal information to third parties.

6. Outsourcing of personal information processing

The Company does not outsource any work beyond the purposes above. AI responses are generated directly through your own accounts, so the Company is not outsourcing that processing.

7. Transfer of personal information outside Korea

To send push notifications, the Company transfers information outside Korea as follows:

• Legal basis: Article 28-8(1)3 of the Personal Information Protection Act (개인정보보호법 제28조의8제1항제3호) — the transfer is necessary to conclude and perform a contract with the data subject, and the details of the transfer are disclosed in this policy. Publishing this policy takes the place of a separate consent step.
• How to refuse, and what happens if you do: You can turn off notifications individually in your iPhone settings or in the app's settings. Refusing does not affect your use of the Service's other features.
• A one-line company Slack/GitHub reply is sent only to the workspace or repository connected by that company. This is delivery to the destination selected by the company, not disclosure elsewhere.
• The signaling and company account servers, including email delivery, are not transfers outside Korea — they run only in the Amazon Web Services Seoul Region (ap-northeast-2).

8. Your rights and duties, and how to exercise them

You may exercise the following rights at any time:

• Deleting a registered push token (removing the device registration)
• Deleting a personal account in the app. This removes the Product Trial, referral records, subscription link information, login sessions, and linked social sign-in identifiers
• Deleting a company account in the app. A sole company representative must first transfer that role to another remaining member or remove the remaining members
• Asking questions or raising objections about the processing of your personal information

You can exercise these rights through the "Registered devices" setting in the Mac app, or by emailing the Chief Privacy Officer listed below. The Company will act without delay.

Children under 14: The Service is not intended for users under the age of 14. Personal use does not require sign-up, and company accounts receive only an email address, so the Company does not separately verify age. If the Company learns that a child under 14 is using the Service, it will immediately delete the related information.

9. How we destroy personal information

• Procedure: When the retention period ends or you ask for deletion, we delete the information without delay.
• Method: Personal information stored as electronic files is deleted using technical methods that make the records impossible to recover.

10. Measures to keep personal information secure

• The phone-Mac connection is authenticated with a key created on the phone. Actions that cannot be undone also require a separate biometric authentication key.
• Data is encrypted in transit.
• Access control and retention of access logs.
• Login tokens and company membership certificates are signed with a dedicated signing key that cannot be exported from the server. Login codes and refresh tokens are stored only as hashes.

The signaling server connects the phone and Mac. Before a direct connection is established, or on networks where one cannot be established, it forwards encrypted data. The Company server cannot read the content; decryption keys exist only on the user's phone and Mac. The Company does not record connection IP addresses, and temporary room information contains no user identifier.

11. Chief Privacy Officer

12. How to seek remedies for privacy violations

If you need to report or get advice about a violation of your personal information, you can contact the following organizations:

• Personal Information Dispute Mediation Committee (개인정보 분쟁조정위원회) (www.kopico.go.kr / 1833-6972)
• Personal Information Infringement Report Center (개인정보 침해신고센터) (privacy.kisa.or.kr / 118, no area code)
• Supreme Prosecutors' Office, Cyber Crime Investigation Unit (대검찰청 사이버범죄수사단) (spo.go.kr / 1301, no area code)
• Korean National Police Agency, Cyber Security Bureau (경찰청 사이버안전국) (ecrm.police.go.kr / 182, no area code)

Addendum

This Privacy Policy takes effect on September 24, 2026.

Revision history

Account profile

Display names and preferred AI forms of address are optional; legal names are not required. Display names are visible to fellow company members. Preferred addresses personalize AI replies. Company central synchronizes signed profiles and removes them when membership is removed. These fields never grant permissions and are excluded from analytics and activity log content.

Representative handoff

The company account stores the last ownership transfer identifier, pending recipient account, request identifier and expiry. Requests expire after ten minutes; pending details are cleared on acceptance or cancellation. The last identifier synchronizes ownership with the customer central after a connection failure. Business documents are not sent to the shared account server.

Company phone QR authentication

The account service keeps a QR request identifier, account and company identifiers, originating PC session identifier and PC name, request state, creation and expiry times, phone public key, phone name, device identifier and phone request identifier. A per-PC/company index contains only the QR identifier and expiry time. Requests expire after two minutes, cannot be reused after exchange or cancellation, and are subsequently removed by automatic expiry cleanup. No PC access token, phone private key or work content is stored in QR records. Company phone sessions additionally retain their permission scope, company identifier, device identifier and public key until logout, account deletion or 60 days after last renewal.