1. General Provisions
“AnyFly” (the “Service”) complies with applicable laws such as the Personal Information Protection Act (「개인정보 보호법」) and processes users' personal information as set out below. This policy applies to both the website (anyfly.io) and the mobile app.
The Service is only a channel for exchanging files and does not store the files exchanged on its servers. As a result, the scope of personal information collected is very narrow — what is listed in Section 3 below is all of it.
2. Handling of Exchanged Files — What the Service Does Not Keep
This section is not about items collected, but about **the fact that they are not collected**, because it is what users most need to know first.
- Files travel directly between the two devices (P2P). Because they do not pass through a server, the Service knows neither the content nor the file names.
- On networks where a direct connection is not possible, files pass through a relay server. Even then, the relay server only passes the received bytes through as-is without interpreting or storing them, and nothing remains once the transfer ends.
- The 6-digit transfer code is a temporary number for pairing two devices, and it becomes invalid when the transfer ends or the screen is closed.
- Received files are saved only on the recipient's device.
Accordingly, no list or content of the files users have exchanged exists in the Service, and the Service operator cannot view them.
3. Personal Information Collected and Collection Methods
A. When signing in — If you sign in with a Google account, we receive the following information from Google. The only permissions requested are for your email and basic profile.
- Required: email address, name, profile photo, Google account identifier
B. When using Contact us — You enter this yourself.
- Required: email address for our reply, message content
C. When paying for a paid pass — You enter this yourself or it is taken from your member information. For Korean card payments, the payment provider (KG Inicis) requires the buyer's name and mobile number.
- Required: buyer's name, mobile number, email address
- Required: order and payment details (plan, payment amount, payment method, payment date and time, order number, transaction number assigned by the payment provider)
- ⚠ Information about the payment method itself, such as the card number, expiry date and password, is handled directly by the payment provider, and **the Service neither receives nor stores it.**
D. Information generated or collected automatically
- A session cookie to keep you signed in
- Access logs automatically generated when you connect to the Service (IP address, browser and device information, date and time of access)
- Records of the stage at which a transfer connection was established or dropped. These are used to improve connection quality and do not include file contents or file names.
- Mobile app: error logs when an error occurs (values judged to be personal information are masked before being sent) and anonymous usage statistics that do not identify individuals
E. **The Service provides all file transfer features even without signing in.** If you do not sign in, the information in item A above is not collected.
F. The Service does not collect your address book, your entire photo library, or your location. The app requests file and media access permissions only to read and send the files you choose yourself, and does not read files you have not chosen.
4. Purposes of Processing Personal Information
- Identifying Members and keeping them signed in
- Replying to inquiries
- Confirming payment and approval for paid passes, activating passes, viewing payment history, and processing refunds
- Analyzing connection logs to improve the success rate and speed of transfer connections (for statistical purposes)
- Identifying the causes of errors and taking action to keep the Service stable
- Preventing misuse and taking operationally necessary measures such as restricting use of the Service
5. Retention and Use Period of Personal Information
In principle, the Service destroys collected personal information without delay when a Member closes their account.
However, the following information is kept for the periods stated.
- Inquiry content and the email for our reply: 1 year after the reply is completed. This is so that earlier inquiries can be referred to when the same problem recurs.
- Access logs and connection logs: 3 months from the date of collection
- Under the Act on the Consumer Protection in Electronic Commerce, etc. (「전자상거래 등에서의 소비자보호에 관한 법률」) — records on contracts or withdrawal of orders: 5 years / records on payment and supply of goods, etc.: 5 years / records on consumer complaints or dispute handling: 3 years
- Under the Protection of Communications Secrets Act (「통신비밀보호법」) — access logs: 3 months
- Other information that must be retained under applicable laws: the period prescribed by the relevant law
6. Outsourcing of Personal Information Processing and Overseas Transfer
The Service outsources the processing of personal information as follows to provide the Service, and because the processors' servers are located overseas, personal information is transferred abroad.
- Supabase, Inc. (USA) — member authentication and storage of account information. Items transferred: email, name, profile photo, account identifier. When and how: transmitted over the network in encrypted form at sign-in. Retention period: until the Member closes their account
- Google LLC (USA) — Google account sign-in. Items transferred: sign-in authentication information. When and how: transmitted over the network in encrypted form upon a sign-in request. Retention period: until the authentication purpose is fulfilled
- Vercel Inc. (USA) — website hosting. Items transferred: access logs (including IP address), addresses of the screens visited. When and how: sent automatically when accessing the Service. Retention period: according to the processor's log retention policy
- Cloudflare, Inc. (USA) — domain connection and communication protection. Items transferred: access logs (including IP address). When and how: sent automatically when accessing the Service. Retention period: according to the processor's log retention policy
- Korea Port One Co., Ltd. (PortOne) and KG Inicis Co., Ltd. (South Korea) — Korean card payment processing. Items transferred: buyer's name, mobile number and email address, order number and payment amount. When and how: transmitted over the network in encrypted form upon a payment request. Retention period: the period prescribed by applicable laws (see Section 5). Because the processing takes place in Korea, it does not constitute an overseas transfer.
- Eximbay Co., Ltd. (South Korea) and PayPal (USA and Singapore) — international card and PayPal payment processing. Items transferred: buyer's name and email address, order number and payment amount. When and how: transmitted over the network in encrypted form upon a payment request. Retention period: the period prescribed by applicable laws
- Slack Technologies, LLC (USA) — forwarding inquiry content. Items transferred: email address for our reply, inquiry content. When and how: transmitted over the network in encrypted form when an inquiry is submitted. Retention period: same as the inquiry retention period in Section 5
- Mobile app only — Functional Software, Inc. (Sentry, USA): collection of error logs. Items transferred: device and app information at the time of the error, and the error content. Values judged to be personal information are masked before being sent. / Google LLC (Firebase, USA): anonymous usage statistics that do not identify individuals. Retention period: according to each processor's retention policy
The Service's signaling server and file relay server are also located in the USA. The items transferred are access logs (including IP address) and connection logs, and the content of files being transferred is not stored (see Section 2).
Users may refuse the overseas transfer of personal information. However, because the above processing is essential to providing the Service, use of the Service may be restricted if you refuse.
Outsourcing contracts provide for safe management of personal information, restrictions on sub-outsourcing, and a ban on use beyond the stated purpose, and if a processor changes, this policy will be amended and announced.
7. Provision of Personal Information to Third Parties
The Service does not provide users' personal information to third parties. However, this does not apply where laws specifically provide otherwise or where an investigative agency requests it following the procedures and methods prescribed by law.
Because the Service does not store the files exchanged, there is no material about the content of files that could be provided, even if an investigative agency requests it.
8. Procedures and Methods for Destroying Personal Information
Personal information is destroyed without delay once its retention period has passed or its processing purpose has been achieved.
Information in electronic file form is permanently deleted by a method that makes recovery impossible, and any printed material is shredded or incinerated.
9. Rights and Obligations of Data Subjects and Legal Representatives, and How to Exercise Them
Users may at any time request access to, correction of, deletion of, or suspension of the processing of their personal information.
- For a signed-in account, you can disconnect by signing out, and deletion of the account and records will be processed without delay when you request it from the Chief Privacy Officer below.
- Other requests can also be made using the same contact details.
Children under the age of 14 cannot create an account, and the Service does not collect personal information of children under 14.
10. Measures to Ensure the Security of Personal Information
- Encryption in transit: all communication between users and the Service, and between the Service and its processors, is encrypted.
- Minimized collection: we do not collect information that is not needed to provide the Service, and the files exchanged are not stored on servers.
- Minimized access rights: we keep the number of people who handle personal information to a minimum and manage their access rights.
- Record keeping: we keep and review error logs and access logs.
11. Use of Cookies
The Service uses only cookies that keep you signed in, and does not use cookies for advertising or user tracking.
You can refuse to store cookies in your browser settings. Even then, you can still use the file transfer feature that works without signing in.
12. Chief Privacy Officer and Contact
- Company: GangnamTokki Co.,Ltd. (Representative IM WONMOOK)
- Address: #203, 3-8, Hakdong-ro 53-gil, Gangnam-gu, Seoul, Republic of Korea
- Business registration number: 456-87-03346
- Chief Privacy Officer: IM WONMOOK (Chief Executive Officer)
- Contact email: help@gangnamrabbit.com
- Telephone: +82-70-8027-1293
Users may direct inquiries, complaints and requests for remedies relating to personal information protection to the above contacts, and the Service will respond without delay.
13. Remedies for Infringement of Rights
If you need counseling or remedies for a personal information breach, you may contact the following organizations.
- Personal Information Dispute Mediation Committee (개인정보분쟁조정위원회): 1833-6972 (www.kopico.go.kr)
- Personal Information Infringement Report Center (개인정보침해신고센터): 118 (privacy.kisa.or.kr)
- Supreme Prosecutors' Office Cyber Investigation Division (대검찰청 사이버수사과): 1301 (www.spo.go.kr)
- National Police Agency Cyber Bureau (경찰청 사이버수사국): 182 (ecrm.police.go.kr)
14. Changes to This Policy
If this policy is changed, the changes and the effective date will be announced at least 7 days before the effective date. However, changes that significantly affect users' rights, such as changes to the items collected or the purposes of use, will be announced at least 30 days before the effective date.
Earlier versions can still be viewed by adding the effective date to this page's address (e.g. /privacy?v=2026-09-30).