befall United States Privacy Notice
This notice at collection explains the personal-information categories, purposes, training boundaries, retention criteria, and state privacy rights associated with befall. befall is operated by PROJECT82 LLC, an active entity. Its business address of record is 30 N Gould St, STE R, Sheridan, WY 82801, USA.
Who is responsible for the data
befall is operated by PROJECT82 LLC, an active entity. Its business address of record is 30 N Gould St, STE R, Sheridan, WY 82801, USA. The identified operator determines why and how covered personal information is processed for this service, subject to the limitations stated here. This notice is in effect as of the effective date stated in this document, on the operator's approval; United States counsel has not reviewed it. Legal notices may be sent to jin@project82.kr, and DMCA copyright notices to the designated agent Jinwon Jeon at dmca@project82.kr. Vendor facts are reconciled to live configuration and contracts as each one is verified.
Notice at collection: categories collected
befall provides interactive episodic fiction shaped by typed lines and choices, video drama and short-form series, and chats with series characters. Story progress, selected choices, typed lines, conversations with series characters, episode unlocks, and safety signals support continuity and moderation. befall sells the monthly Story Pass subscription, which grants 1,200 coins for each paid billing period, and coin packs through the App Store and Google Play at the price and in the currency shown for your store account's country; a saved story answer, a character-chat reply, or a reroll costs 8 coins, published interactive-story episodes can be read without payment, and video drama episodes after a series' free episodes cost 50 coins each. Entry begins at age 16; ages 16–17 use the safety tier, and training eligibility begins at age 18. The adult tier begins at age 18, and data from younger or unknown-age users is excluded from training. Depending on use, categories may include account and contact details; age or birth-date data; device, log, and cookie data; conversation or call content; recordings and derived transcripts; character, memory, and preference data; safety reports; purchase and transaction records excluding full payment credentials handled by a store or payment provider; and support communications. A category not verified in the product data flow is not added to this notice by assumption.
Sources of personal information
We receive information directly from you, from your interactions with AI and safety features, from the device or browser you use, from app stores or payment services, and from service providers acting for the operator. We do not treat an unverified vendor inventory as a final public recipient list.
Purposes and authority for use
We use information to create an account, provide requested AI responses and continuity, classify age, personalize features, process purchases, detect abuse, investigate reports, secure systems, provide support, comply with law, establish or defend claims, and, for eligible adult data after valid notice, evaluate and improve models. Applicable consent, contract, legal-obligation, and legitimate-purpose requirements are honored by jurisdiction. We use the IP address of each request to determine your approximate country, to decide which features are available in your region (for example, AI chat and 19+ limits in Korea and Taiwan); we do not store the IP address for this purpose. If you separately opt in to advertising, BEFALL / PROJECT82 processes your push token, notification language and timezone, advertising and nighttime-advertising consent/withdrawal timestamps, and consent-reconfirmation records to deliver push notifications about events and offers. Advertising consent is separate from device notification permission and new-episode alerts. Declining does not affect access to the service. Advertising between 21:00 and 08:00 in your timezone requires additional, separate consent. You may withdraw consent at any time in My > Notifications. Advertising is limited to one push per seven days and includes an advertising label and opt-out instructions. Related preferences and processing records are removed through the existing account-deletion process when the account is deleted. Every two years from the date of your advertising consent, we notify you of your consent status and consent date, and how to maintain or withdraw consent. When you use the ongoing friend-invite feature, BEFALL / PROJECT82 processes invite codes, redemption and reward status, registration and reward timestamps, account creation dates and episode-completion information, linked to the relevant accounts, to provide friend-invite registration and rewards and check eligibility (account creation within seven days and first-episode completion). The legal basis for this processing is Article 15(1)(4) of the Personal Information Protection Act (contract performance). Separately, we process a hashed install identifier and perform duplicate-reward and self-invite checks to help prevent duplicate invite rewards and self-invites. The legal basis for this anti-abuse processing is Article 15(1)(6) of the Personal Information Protection Act (legitimate interests in preventing invite-reward abuse). The app generates a dedicated random install identifier for friend invites, keeps it across sign-out and account switches, and clears it when you delete your account in the app. If you delete your account on the web or by email, server records are deleted, but the on-device identifier remains until app removal or in-app deletion. Only its SHA-256 hash is sent to the server for this feature, not the original identifier. This is not the analytics install identifier, IDFA, IDFV or Android ID, and we do not create a device fingerprint. The hash is used for invite-reward abuse prevention, not advertising tracking, and is not anonymous because it is linked to invite and account records. For this hash-based anti-abuse processing, you may request suspension under Article 37 of the Personal Information Protection Act through the privacy contact in this notice. You can use the service without participating in friend invites.
Service processing is separate from training
Operational processing may continue after a training opt-out when needed to generate replies, store conversations or requested memory, perform age and content-safety checks, handle reports, prevent fraud, secure accounts, complete payments, provide support, or meet legal duties. Training, fine-tuning, evaluation-dataset addition, and long-term pseudonymized retention for those purposes stop prospectively as described in the AI Data Use Notice.
Human review and labeling
Only a limited number of authorized personnel may review the minimum context needed for improvement quality evaluation or labeling. Improvement labeling views must never expose account or direct contact details. Operational support or safety review is a distinct limited-purpose process and does not make those details available for improvement labeling. Access, viewing, export, and deletion events are logged, and an external labeler may not be used until confidentiality, security, access, and deletion obligations are contractually verified.
Service providers and disclosures
Service providers may support hosting, AI inference, security, customer support, analytics, communications, or payments only under appropriate instructions and safeguards. Only service providers whose actual use is verified are listed below. A value not yet confirmed from contracts and consoles is not estimated and is shown as "To be confirmed". | Provider | Service | Surface | Processing location | Retention | | --- | --- | --- | --- | --- | | Supabase | Authentication, database, storage, and server functions | Mobile app, Web, Server | United States (AWS us-east-1, database and storage); server functions may run in the region closest to the caller | Kept while the service is provided and deleted by the app's deletion process when you delete your account. Statutory records and minimum deletion-compliance evidence are kept separately. Advertising-consent evidence is also kept separately until three calendar years after subsequent withdrawal or account deletion (UTC), then deleted at the next expiry-deletion run (see Retention criteria for fields and nighttime/re-consent rules). Consent evidence without subsequent withdrawal is kept while consent remains active. Database backups may retain data for the provider's backup cycle. | | Anthropic | Story generation, moderation, crisis classification, and summaries | Server | United States (data storage); requests may be routed for processing to select countries in the United States, Europe, Asia and Australia | Under the provider's default policy, inputs and outputs are deleted within 30 days of receipt or generation (if flagged for a usage-policy violation, inputs and outputs up to 2 years and trust-and-safety classification scores up to 7 years) | | RevenueCat | In-app purchase verification | Mobile app, Server | United States | For the term of the processing agreement (after it ends, return or destruction can be requested within 30 days, after which the provider may delete the data) | | Expo | Push notification relay and app builds (EAS) | Mobile app, Server | United States | Notification content is not stored and is processed only for the time needed to hand it to the Apple and Google push services; push tokens are kept as long as needed to send notifications (deleted when our Expo account is deleted); app build logs and artifacts 90 days, backups 90 days after creation | | Apple APNs and Google FCM | Push delivery to devices | Mobile app | The United States and other countries where Apple, Google and their subprocessors operate facilities (Firebase Cloud Messaging is a global service with no data-region selection) | Undelivered notifications may be held for delivery for up to the APNs expiration (at most 30 days) and the FCM lifespan (at most 28 days, four weeks by default). Device tokens and delivery records are kept under each provider's privacy policy. | | Browser push services (Google, Mozilla, Apple) | Web push (VAPID) delivery | Web | To be confirmed | Undelivered notifications are kept for up to 28 days (the default four-week time-to-live applied when sending) and then discarded | | Apple and Google store payments | In-app purchase ledger and receipts | Mobile app | The United States and other countries where Apple and Google operate facilities | As long as needed to process the payment. We receive only the purchase result; each store keeps its transaction records under its own privacy policy. | | Google (social sign-in) | Social sign-in | Mobile app, Web | The United States and other countries where Google operates facilities | As long as needed to process the sign-in. We receive only the sign-in result (such as the email address); Google keeps its own records under Google's privacy policy. | | Apple (Sign in with Apple) | Sign in with Apple | Mobile app, Web | The United States and other countries where Apple operates facilities | As long as needed to process the sign-in; Apple keeps its own records under Apple's privacy policy. | | Vercel | Web hosting | Web | United States (Washington, D.C., iad1 region, serverless functions); middleware may run in any region worldwide where a request arrives | As long as needed to process the request; runtime logs are kept for 1 hour to 3 days depending on the provider plan (up to 30 days with the observability add-on) | | PostHog | Product analytics (no autocapture or session replay) | Mobile app, Web | United States (PostHog Cloud US) | Events can be queried for 1 year (free plan) or 7 years (paid plans) depending on the provider plan; this is not an automatic deletion deadline. Actual retention follows the provider's policy and the handling of deletion requests (applicable plan to be confirmed) | | Sentry | Error and outage diagnostics | Mobile app, Web, Server | United States (Sentry US data region) | Error events are kept for 30 or 90 days depending on the provider plan; performance traces are kept for 30 days by default and may be kept longer depending on the plan (applicable plan to be confirmed) | | Operations alert webhook recipient (vendor not yet confirmed) | Operational alerts for scheduled jobs and cost incidents | Server | To be confirmed | To be confirmed | We may also disclose information when lawfully required or necessary to protect rights and safety.
Cross-border processing
The operator is a United States company, so personal information from users outside the United States is processed abroad as the ordinary course rather than as an exception. The transfer is carried out as necessary to perform the service agreement with you, and is disclosed here rather than made subject to a separate consent. When an account is closed, we carry out the service-data deletion process. Statutory records, minimum deletion-compliance evidence, separately held advertising-consent evidence, backups and data held by external recipients follow the provider retention terms and the Retention criteria section below. Advertising-consent evidence in Supabase in the United States follows the three-year post-withdrawal or account-deletion retention rule in that section, then is deleted at the next expiry-deletion run. Information may also be processed by service providers outside the state or country where a user lives. The operator will verify each destination, recipient role, purpose, transfer mechanism, safeguard, and retention term. This notice does not substitute an assumed country or vendor for that required transfer record.
Retention criteria
Retention criteria include the time needed to provide an active account or requested feature, the sensitivity and volume of the data, safety and fraud needs, legal recordkeeping, dispute limitation periods, a valid preservation request, and the time required for secure deletion from backups. Training copies follow the additional eligibility, opt-out, and separability rules in the AI Data Use Notice rather than an unlimited retention period. As an exception to deletion of related preferences and processing records, we keep separate advertising-consent evidence in Supabase in the United States: a sequence number, event type (advertising or nighttime consent/withdrawal, two-year reconfirmation, or account deletion), event time, channel (push), recording source (notification settings, account deletion, or legacy backfill), policy version, and a keyed-hash identifier (HMAC-SHA256 of the account ID). This identifier does not directly identify you; it is pseudonymous, not anonymous, and an account ID you provide can be checked against it on the server. These evidence records do not contain your original account ID, email, name, push token, IP address, device information, or screen text. The legal basis is Article 15(1)(6) of the Personal Information Protection Act (legitimate interests) and proof of consent to receive advertising under Article 50 of the Act on Promotion of Information and Communications Network Utilization and Information Protection. Consent evidence is kept while consent remains active, without a fixed expiry if there is no subsequent withdrawal. Consent and reconfirmation evidence is kept for three calendar years after the first applicable subsequent withdrawal or account deletion (UTC); withdrawal and account-deletion records are kept for three calendar years from their own event time. Expired records are deleted at the next expiry-deletion run. Withdrawal of nighttime consent alone closes only nighttime-consent evidence, not general advertising consent. Re-consent starts a new period and does not extend the retention of earlier evidence. Account deletion is treated as withdrawal of advertising consent, but does not restart the retention clock for evidence already closed by an earlier withdrawal. Deleting an account that never gave advertising consent does not itself create an account-deletion evidence event. Explicit advertising or nighttime opt-out requests may still be recorded and retained under the rules above. These evidence records are not used to send advertising after withdrawal or account deletion. Friend-invite codes and the install-identifier hash stored with each code are kept while the code owner's account exists and are deleted from the service database through account deletion. Redemption records, including their install-identifier hash, status and timestamps, are kept while both related accounts exist; deleting either the inviter's or invitee's account deletes that redemption record and its hash through the account-deletion process. These records are not kept for an additional abuse-prevention period after account deletion. The existing backup-deletion procedures in this notice still apply.
Security safeguards
We use administrative, technical, and organizational measures proportionate to the data and risk, such as access restriction, logging, separation of operational and training stores, masking, and protected transmission where appropriate. No system is perfectly secure, so this notice does not promise absolute prevention of loss or unauthorized access.
State privacy rights and choices
Depending on residence and applicable law, you may request access, correction, deletion, or portability; opt out of certain sale, share, or targeted advertising activity; limit certain sensitive-data use; and receive equal service without unlawful retaliation. You may appeal a denied request and may use an authorized agent where permitted. This notice does not authorize the monetary sale of training data. A factual classification of any SDK disclosure as a sale, share, or targeted advertising event requires completion of the vendor audit, which is not complete.
Children, teens, and unknown ages
Entry begins at age 16; ages 16–17 use the safety tier, and training eligibility begins at age 18. The adult tier begins at age 18, and data from younger or unknown-age users is excluded from training. All minor and unknown-age events are ineligible for model training, evaluation datasets, and labeling for improvement. If age information changes or indicates a minor, pending training material is removed or blocked under the AI Data Use Notice.
AI outputs and automated processing
Automated systems generate content, personalize continuity, classify safety risk, and help detect abuse. They may make mistakes and are not represented as human judgment. Where applicable law grants review or opt-out rights for a decision producing legal or similarly significant effects, the operator will provide the required process rather than relying on this general description.
How to make a privacy request
Privacy and deletion requests may be sent to jin@project82.kr. Requests may require proportionate identity verification, and an authorized agent may need to show authority.
Changes to this notice
We will date and describe material changes and provide prominent advance notice when required. New training terms apply only after the required versioned notice and never backdate authority. Earlier versions remain in revision history, and mandatory rights continue despite a policy change.
Document history
- 2026-07-27-draft.1 · 2026-07-27 — Initial PROJECT82 regional legal draft.
- 0.1.0 · 2026-09-01 — Published as the version in effect from 2026-09-01.
- 0.1.0 · 2026-10-07 — Stated jin@project82.kr as the privacy and deletion request channel. Stated the legal-notice and DMCA notice channels. Listed each service provider with its purpose, processing location, and retention. Stated coin packs, the daily check-in grant, character-chat costs, free and paid video drama episodes, and how long an unlocked episode can be watched.
- 0.1.0 · 2026-10-08 — Listed or updated each service provider's purpose, processing location, and retention.
- 0.1.0 · 2026-10-16 — Completed the retention of Supabase and Apple APNs/Google FCM, and stated that PostHog's retention period is a query window rather than a deletion deadline.
- 0.1.0 · 2026-10-22 — Stated that the request IP address is used to determine an approximate country for regional feature availability.
- 0.1.0 · 2026-10-23 — Described optional advertising push notifications, separate nighttime consent, withdrawal, the two-year consent-status notice, and the fields, legal basis, retention and deletion exceptions for advertising-consent evidence.
- 0.1.0 · 2026-10-24 — Described friend-invite and reward provision under contract performance, separate hash-based anti-abuse processing under legitimate interests, its suspension-request right, and server and on-device deletion.
- 0.1.0 · 2026-10-25 — Clarified that app purchases of Story Pass and coin packs use the price and currency shown for the store account's country, while web purchases through Stripe remain in US dollars (USD).
Last updated 2026-07-27 · content d37cf40d90b6 · 대한민국 · 한국어 · 日本 · 日本語