Haruyak Privacy Policy

1. Core local features

Medication names, reminder times, repeat intervals, reference dates, weekdays, end dates, schedule history, medication check dates and times, and reminder settings are stored on your phone. You use one personal record; adding or selecting family profiles is not supported. Basic features work without an account. Reminder preparation, rescheduling and duplicate-prevention state, and the selected daily encouragement message are also stored on the device.

Deleting a medication reminder preserves past records and totals. Clearing app data or uninstalling deletes local records and internal restore copies.

2. Optional family record sharing

Sharing authentication uses Google accounts or existing email accounts. Google Firebase Authentication processes email, account identifiers, authentication details and the name provided by Google. Google passwords are not entered into or stored by Haruyak. Signing in alone does not share medication data. With consent, the shared display name, medication names, times, intervals, anchor dates, weekdays, start/end dates, today’s checks and timestamps are sent to Google Firebase Firestore, together with daily checked/scheduled counts and coverage for the last seven days. Separate calendar consent sends the latest daily scheduled/checked totals for this and last month.

Connected family members' records, your full history and encrypted backups are not sent automatically. Account identifiers, original device/record identifiers, time zone, upload sequence, sync time, caregiver UID and display name, and connection codes with expiry/use information are used to manage permissions and updates.

Server medication data is updated to the latest information and can be viewed only by connected caregivers. A caregiver's phone stores schedules for family members who consented to alarms in a private cache and uses them for locally scheduled alarms. The last received schedule is valid for up to 7 days; this period is not extended without an update. Local shared schedules are cleared when alarms are turned off, the relevant connection is removed or the user signs out. Remote disconnection and schedule changes may take effect at the other phone's next sync. Caregivers cannot edit medication checks on another person's behalf. Caregiver names are visible only to the sharer and the caregiver concerned.

3. External services and security

The Firestore database region is Seoul (asia-northeast3). Authentication and app protection use Google Firebase and Play Integrity. Firebase SDKs may process technical data such as IP addresses, app/SDK/platform information, authentication tokens and app-integrity tokens to secure authentication and provide the service. Authentication and app-protection processing locations cannot be inferred solely from the Firestore database region.

Family sharing involves server-side processing. It is not end-to-end encrypted sharing like an encrypted backup. For Google's processing practices, see Firebase privacy information.

4. Stopping sharing and retention

Stopping sharing first clears the shared server content and blocks caregiver access, then cleans up related connections and invitations. The app retries after connection failures; check that the operation has completed. Identifiers recording the stopped state may remain until account deletion.

A connection code cannot create new connections after 10 minutes. Generating a new code, stopping sharing or deleting the account cleans up related invitations. Signing out or uninstalling does not delete the server account or data. Information already viewed by others cannot be retrieved.

5. Deleting a sharing account and server data

In the app, use With family → Account management → Delete sharing account and server data. Recent sign-in verification may be required. Remote shares, caregiver connections and related invitation/index data are removed before deleting the Auth account. Local records are kept.

Without the app, use the account deletion request page to request deletion by email. After verifying ownership, we remove the account and related server data and reply with the outcome. Requests are processed within 7 days of verification; any delay will be explained. External backups, local records on each phone and information already viewed by others are not subject to remote deletion.

6. Encrypted backups and restoration

You can save medications, schedules, records and settings as a password-based AES-256-GCM file. The app does not store the password, and the developer cannot recover it if lost. If you choose a cloud file provider, its policy also applies. You must delete external backups yourself.

A password-encrypted internal copy of the records immediately before restoration is kept and replaced on the next restoration. Automatic full cloud backup/device transfer is excluded; backup and restore are manual. Sharing uploads pause after restoration and resume only with renewed consent.

7. Permissions and feature scope

Notification and exact-alarm permissions are used for on-device medication reminders. Battery saving, permissions and device conditions may delay or restrict delivery. Backups access only documents you select and do not request full-storage permission.

There are no advertising or analytics SDKs, Health Connect or medical decision features. A user’s check does not prove actual medication use or a health effect.

With separate consent, completion notifications use the ITLAND server and Google FCM. The recipient phone’s account, connection and device identifiers and FCM token are encrypted on the ITLAND server. The sender transmits connection and medication-slot identifiers, date and checked time. Using the requester’s authority, the server briefly reads current Firebase medication records and family membership for verification. It does not store or log the medication snapshot. FCM messages omit medication names and email; the recipient rechecks current authority and records before notifying.

Unrefreshed device registrations are removed within one hour after their 30-day expiry; one-way event hashes used for deduplication are removed within one hour after 24 hours. Opting out or disconnecting blocks delivery and removes registrations; in-app sharing-account deletion first removes that account’s push registrations. Signing out discards the device FCM token. Residual offline registrations follow these retention periods. ITLAND uses AWS infrastructure in Seoul; Google FCM processing is not restricted to Seoul.

8. Website, contact and changes

The app and ITLAND website process data separately. For website access logs, cookies and email inquiries, see the ITLAND Website Privacy Policy. Do not attach passwords, ID documents, medication records or backups to inquiries or deletion requests.

If sign-in/sharing or SDK processing changes, we update the public policy, in-app guidance and Google Play Data safety information together.