Paid Anyway Privacy Policy
Effective date: October 24, 2026
Paid Anyway ("the Service") is operated by apochopo Inc. (주식회사 아포초포, Seoul, Republic of Korea — "we", "us"). This policy explains what the Service does with information when you use the iOS and Android apps, the Apple Watch and Wear OS apps, widgets, the Apps in Toss mini-app, and our web pages at https://salary-alarm.vercel.app.
The one thing to know: there is no account, and your salary, currency, wake-up alarm time and your accrued totals stay on your device. They are never sent to our servers and never handed to advertisers.
1. What we process and why
| Purpose | What happens | Sent to our servers? | Legal basis (GDPR) |
|---|---|---|---|
| Alarm, live earnings counter, reminders | Your device computes accrued pay from what you entered and schedules alarms and local notifications | No — processed on the device only | Art. 6(1)(b) performance of the service (processing on your device) |
| Mini-app evening reminder (Apps in Toss) | If you opt in in the mini-app, we send one evening reminder a day without any amount through Toss (Section 10) | Yes — Toss anonymous key, reminder time, time zone and last send date | 6(1)(a) consent |
| Share card | When you tap Share, an image is rendered on your device | No (link previews use a fixed image without amounts) | 6(1)(b) |
| In-app advertising | Ad providers select and measure ads shown inside the app (Section 9) | Collected directly by the ad provider's SDK — not received by us | Non-personalized ads: 6(1)(f) legitimate interest in funding a free service. Personalized ads: 6(1)(a) consent (off by default) |
| Service quality | Which screens and features are used, whether alarms fired — never amounts or your settings values (can be turned off) | Yes — under a random per-install identifier | 6(1)(f) legitimate interest; where the EEA/UK rules require it, consent collected through the consent form |
| Support | Answering e-mails you send us | Yes — your e-mail address and message | 6(1)(b) / 6(1)(f) |
| Web pages | Serving the policy, terms, support and share-link pages | Yes — access logs (IP, time, URL) | 6(1)(f) |
2. Information we process
2.1 Stored only on your device (we never collect it)
Annual salary (with the dates you changed it); currency; time zone; the net-estimate view setting; wake-up alarm time and days; notification settings (how often, when, whether amounts are shown); share-card style; this year's and past years' accrued totals.
These live in the app's own storage on your device and, where you use the watch app or widgets, in the app-group storage of the same device and OS account. We cannot see them. If you have enabled your operating system's backup (iCloud Backup, Google Backup), the OS may include app data in that backup under your agreement with Apple or Google.
Why we treat pay as sensitive. Salary is not a "special category" under GDPR Art. 9 or Korean law, but we handle it as sensitive: it never leaves the device, analytics events contain no amounts, advertisers never receive it, and share cards never show your annual pay (this year's and last year's totals are hidden by default and appear only if you switch them on yourself).
2.2 Collected automatically
| Data | Who collects | When | Notes |
|---|---|---|---|
| Usage analytics: random per-install identifier, app version, OS and version, device model, language and region, screen/feature events (no amounts, no settings values), alarm/notification success or failure | Us | While you use the app | Turn off in Settings › Data › "Send usage analytics" |
| Advertising data: device information (model, OS, language, app version), IP address, ad impressions/clicks/completions, and — only if you turn on personalized ads — the advertising identifier (IDFA / Android Advertising ID) | Ad providers (Section 9) | When an ad is shown | We do not receive it |
| Web access logs: IP address, time, requested URL, browser type | Us (hosting provider logs) | When you open our web pages | |
| Support: e-mail address, message, attachments | Us | When you e-mail us |
We do not collect location, contacts, photos or health data, and we do not receive or store advertising identifiers ourselves.
2.3 Apps in Toss mini-app
The mini-app does not use Toss login. Your entries are kept in the mini-app's storage inside the Toss app; ads are served by Toss in-app advertising (Sections 9 and 13). If you opt in to the evening reminder, we keep your Toss anonymous key (an anonymous identifier issued by Toss — not your Toss account details such as name or phone number), reminder time, time zone and last send date on our server (Section 10). Your salary, totals and other entries are never sent to our server.
3. Retention
| Data | Retention |
|---|---|
| On-device data (2.1) | Until you delete it in the app or uninstall — never on our servers |
| Usage analytics | Raw events deleted 30 days after collection; only daily totals that cannot identify anyone are kept after that |
| Mini-app reminder data (Toss anonymous key, reminder time, time zone and last send date) | Until you withdraw consent — deleted as soon as you do |
| Web access logs | Up to 3 months (hosting provider retention) |
| Support e-mails | 1 year after the case is closed |
| Data collected by ad providers | Per each provider's policy (Section 9) |
4. Sharing, selling and processors
We do not sell personal information and we do not share your salary, accrued totals or analytics with anyone. Ad providers collect data directly through their SDK inside the app (Section 9); we do not pass them your data.
Processors acting on our instructions:
| Processor | Task | Location |
|---|---|---|
| Vercel Inc. | Hosting of web pages and share links, access logs | US company; servers in Seoul (icn1) |
| Supabase Inc. | Storage of usage analytics; storing mini-app reminder data and sending the evening reminder | US company; data stored in Seoul, Republic of Korea (AWS ap-northeast-2) |
5. International transfers
We are established in the Republic of Korea. Analytics, mini-app reminder data and web data are stored in Korea; our processors' staff in the United States may access them for operations and incident response. Google LLC (AdMob) collects advertising data in the United States. For EEA/UK residents these transfers rely on the recipients' Standard Contractual Clauses / UK Addendum (processors) and, for Google, Google's own transfer mechanisms published in its privacy policy. The European Commission's adequacy decision for the Republic of Korea covers data we hold in Korea.
6. Your rights
- On-device data: you control it directly. Settings › Data › "Erase everything" or uninstalling removes it. We cannot access or restore it.
- Data we hold (analytics, support): e-mail contact@apochopo.com to access, correct, delete, restrict or object, or to receive a copy. Analytics are stored under a random identifier that does not identify you; include the identifier shown in Settings › Data so we can locate the records. We reply within 10 days (within one month for GDPR requests).
- EEA/UK residents also have the right to withdraw consent at any time (personalized ads: Settings › Ads), to object to processing based on legitimate interests, and to lodge a complaint with your supervisory authority. We have not appointed an EU/UK representative; if the Service's EEA/UK use grows to a level that requires one under Art. 27, we will update this section.
- California and other US-state residents: we do not "sell" personal information. Turning on personalized ads may constitute "sharing" for cross-context behavioral advertising under the CPRA; it is off by default and you can turn it off at any time in Settings › Ads. We honor Global Privacy Control signals through the ad SDK's restricted data processing where applicable. You have the right to know, delete, correct, and to non-discrimination; contact us as above. We do not knowingly sell or share information of consumers under 16.
- Japan residents: Section 9 lists the SDKs that transmit information from your device to third parties, the information transmitted and its purposes, as required by the external transmission rule of the Telecommunications Business Act.
7. Cookies and identifiers
The apps use no cookies. Our web pages work without login or tracking cookies; only hosting access logs are kept. The app attaches a random per-install identifier (regenerated if you reinstall) to analytics events; turn it off in Settings › Data › "Send usage analytics". Advertising identifiers are used only when personalized ads are on (Section 9).
8. Children
The Service is not directed to children. We do not knowingly collect personal information from children under 14 (Korea), under 13 (US COPPA) or under the age of digital consent in your country (16 in parts of the EEA). If we learn that we have, we delete it. App-store age ratings and ad content ratings are set accordingly.
9. Advertising inside the app and personalized ads
We show ads to keep the Service free. Ads appear only as a banner on the main screen, a full-screen ad after you close the month-end, New Year or history screen, and rewarded ads you choose to watch. There are no ads on the alarm screen, in notifications, widgets or watch surfaces. If an ad fails to load, alarms and the counter work as usual. Ad providers select and measure ads using information their SDK collects directly:
| Ad provider | Where | Information collected | Purpose | Retention |
|---|---|---|---|---|
| Google LLC (AdMob) | iOS and Android apps | Device information (model, OS, language, app version), IP address, impressions/clicks/completions; only if personalized ads are on (on iOS, only after you allow tracking) the advertising identifier (IDFA / Advertising ID) | Ad selection, delivery and measurement; fraud prevention; confirming completion of rewarded ads | Per Google's policy (policies.google.com/privacy) |
| Viva Republica Inc. (Toss in-app ads) | Apps in Toss mini-app | As defined by Toss in-app advertising (Toss privacy policy). We attach none of your entries to ad requests | Ad selection, delivery and measurement | Per Toss's policy |
Personalized ads are off by default. While off, the app requests non-personalized ads only. If you turn on Settings › Ads › "Personalized ads", ads may be selected based on behavioral information such as your app usage and ad interactions; on iOS this requires allowing tracking in the system prompt. You can turn it off at any time; the change applies from the next ad request. To opt out:
- In the app: Settings › Ads › turn off "Personalized ads" (it starts off).
- iOS: Settings › Privacy & Security › Tracking › disable for this app.
- Android: Settings › Google › Ads › delete advertising ID or opt out of ads personalization.
- Apps in Toss: follow the Toss app's advertising settings.
We never pass your salary, accrued totals or analytics to ad providers, do not personalize ads using sensitive data, and do not personalize ads to children. We log that an ad was shown, failed or rewarded — by ad type and placement only, with no personal identifiers — as part of usage analytics. Report an inappropriate ad via Settings › Ads › "Report an ad"; we block it through the provider's controls. "Watch an ad for 24 hours ad-free" turns off banners and full-screen ads for 24 hours after a rewarded ad you chose; that choice is stored on your device only.
10. Notifications
In the iOS and Android apps, the wake-up alarm and the twice-daily earnings reminders are local notifications scheduled on your device (your device computes the amounts); the apps receive no server push notifications. In the Apps in Toss mini-app, if you opt in, our server (Seoul) keeps only your Toss anonymous key, reminder time, time zone and last send date, and sends one evening reminder a day without any amount through Toss; we delete these as soon as you withdraw consent. We send no marketing messages. You can disable each kind in the app or in the OS settings; the app warns you that alarms will not ring if you do.
11. Security
Entries are stored in the app's own sandboxed storage, which other apps cannot read, and are protected by your device's screen lock and the operating system's storage encryption (iOS Data Protection, Android device encryption); no copy exists on our servers. Our servers are designed not to receive pay or schedule values and the analytics schema has no amount fields. All network traffic uses TLS. Access to server data is limited to the minimum staff and logged.
12. Contact and data protection officer
apochopo Inc. · Representative and privacy officer: Yun Minjeong · contact@apochopo.com · Business registration no. 178-86-04021 · 264 Gaepo-ro, 107-902, Gangnam-gu, Seoul, Republic of Korea
Korean residents may also contact the Personal Information Dispute Mediation Committee (1833-6972, kopico.go.kr) or the Privacy Infringement Report Center (118, privacy.kisa.or.kr).
13. Apps in Toss, watch apps and widgets
The mini-app runs inside the Toss app without Toss login; entries stay in the mini-app's storage and are deleted with it; ads are Toss in-app ads; the mini-app has no alarms, and its only notification is the opt-in evening reminder through Toss (Section 10). Watch apps and widgets read accrued totals through app-group storage on the same or paired device and show no ads.
14. Changes
We announce changes 7 days before they take effect (30 days for changes that expand what we collect or how long we keep it) in the app and on this page. Translations (English, Spanish, Japanese, Chinese) are provided for convenience; the Korean text prevails, except that the EEA/UK and US-state notices in this English version apply to residents of those regions.
Revision history
| Version | Effective | Change |
|---|---|---|
| v1.0 | October 24, 2026 | First publication |