Privacy Notice
Version / effective date: 2026-10-19
Read the full English policy
Controller and contact
The Unseen Index is responsible for this deployment. Contact: [email protected]. Postal address: Siheung-si, Gyeonggi-do, Republic of Korea.
What the application processes
Account name and email, a bcrypt password hash (not the plaintext password), role and timestamps; optional identity-provider ID or wallet address; your Items; order identifiers and amounts when payments are enabled; hashed refresh credentials and security records (including an audit log of account and administrative actions, without IP addresses); email verification status; language and time-zone preferences; and, if you turn on two-factor authentication, an encrypted authenticator secret and hashed single-use recovery codes. Signup agreement records contain policy versions, an adult-eligibility confirmation and a server timestamp. Wallet sign-in signatures are checked locally. When the operator enables token payments or swaps, the application also stores linked wallet addresses, payment orders, transaction hashes/signatures and verification results, and queries the operator-configured blockchain RPC providers to verify them; public blockchains themselves are public and permanent. Do not submit private keys or seed phrases.
Sources and purposes
You provide account and Item data directly. Optional Google sign-in supplies a verified email/profile; optional payment providers supply checkout/order details. Account processing provides the requested service, security processing prevents abuse, and order records support enabled purchases and legal duties. The deployment must document applicable contractual, legitimate-interest or legal-obligation grounds. Separate consent must be obtained for any future purpose that requires it.
Recipients and access
The operator and authorized administrators can access data needed for support, security and administration. Hosting/database providers may process data for the operator. Google and Polar receive data only when their optional flows are used; blockchain RPC providers receive transaction identifiers and addresses only when token payments or swaps are enabled. Google receives the data described under Advertising when a page with ads loads. There is no data-broker integration. The operator must update this notice before adding recipients or materially changing practices.
Analytics
This site uses Google Analytics to count visits and see which pages are read, and Cloudflare Web Analytics to measure page performance. Google receives device and usage information such as your IP address, browser and the pages you visit: https://policies.google.com/privacy.
Advertising
This site shows ads served by Google AdSense. When a page with ads loads, Google and its partners may use cookies, similar identifiers and device information (such as IP address, browser and the page visited) to serve and measure ads, prevent fraud and, where permitted, personalize ads based on visits to this and other websites. Google processes this data under its own privacy policy; see https://policies.google.com/technologies/partner-sites. You can turn off personalized ads at https://adssettings.google.com, and https://www.aboutads.info lets you opt out of some other vendors. Where the law requires consent (for example in the EEA, the UK and Switzerland), personalized ads and non-essential advertising cookies are used only after you agree in the consent message, and you can change that choice later.
Storage, retention and deletion
Configured data location: South Korea (site and database servers run by the operator). Cloudflare delivers and protects the site through its global network.. Account data: until you delete your account, then removed within 30 days. Payment and order records: 5 years. Consumer complaint and support records: 3 years. Access and security logs: 1 year. Database backups expire after 14 days. Access tokens last 15 minutes and refresh credentials 14 days. Expired database records can remain until cleanup; expiry is not a claim that stored rows or backups were erased.
International access and transfers
Cloudflare (global network) and Google (advertising, analytics and optional sign-in; United States and other countries), under each provider's contractual data-protection safeguards such as standard contractual clauses. Where required, the operator must use an applicable adequacy decision, approved safeguards or another lawful mechanism and provide details on request. Accepting the Terms is not blanket consent to international transfers.
Your choices and rights
Depending on applicable law, you may request access, correction, deletion, portability, restriction, objection, withdrawal of optional consent, or information about recipients and transfer safeguards. You may complain to a competent supervisory authority. California residents may have rights to know, delete, correct and opt out of sale/sharing and limit sensitive-data use where the CCPA applies. Google AdSense may use data for personalized advertising as described under Advertising; you can opt out at https://adssettings.google.com or through the consent message where it is shown. Requests must not cause unlawful discrimination. You can also delete your account yourself under Account security: identifying data, sign-in methods, memberships and notifications are erased, while records that must be kept (audit and payment records) remain without your identity.
How requests are handled
Use Contact & privacy requests. The operator may verify identity proportionately and respond within the period required by applicable law, explain any lawful exception and provide appeal/complaint information where required. Never send a password, JWT, private key or seed phrase. The contact form prepares an email in your own mail application; it does not claim delivery or automatic deletion.
Children, security and changes
This base service is intended for adults as described in the Terms. Contact the operator if a child’s data was submitted. Security includes password hashing, expiring tokens and server-side access controls; no system can promise absolute security. Material privacy changes require an updated version and notice before new processing where law requires it.