Privacy policy

At a glance

• There is no sign-up, and the app uses no advertising or analytics SDK.
• Ordinary menus, photos and projects stay on your device. If you choose to publish a QR/link guide, reviewed details are sent as a public copy to a separate server. In versions with photo-card support, this may include small photo previews and descriptions you explicitly select and publish (section 6a).
• The app connects over HTTPS to the operator's billing verification server (Google Cloud Run, Seoul region) only when you buy or restore a subscription, when it checks an existing subscription (on opening or returning to the app and before a paid export), or when you enter an app review code. It sends only the app identifier and the Google Play purchase token (or, for review access, the review code), and the server does not store them in a database or logs.
• Google Play handles payments, renewals, cancellation and refunds. The operator never receives card numbers or Google passwords.
• Support is by email only (support@getsalonpaper.com).

1. Information processed, purposes and retention

Information kept only on your device is listed separately from information processed on the operator's server or by email.

• On-device editing data (excluding the optional public guide copy): shop name, contact details, services, prices and promotional text, resized and compressed copies of photos you choose, photo-card and artwork details, prices and availability, projects and display settings, and editing-state and error-recovery copies. Versions with photo-card support also keep re-encoded print copies up to 4,096px with location and other source metadata removed. Used to edit and reopen your work, and kept on your device until you delete it.
• Subscription verification: the app identifier (package name), the Google Play purchase token, and the product, base plan, subscription status, expiry time and acknowledgement status returned by Google Play. Used to verify purchases, restores and subscription status, acknowledge valid purchases and enable exports without SAMPLE. Raw purchase tokens and full lookup responses are processed only in runtime memory. The minimized subscription operations records described below are stored separately.
• Subscription change notifications: the app identifier, purchase token, product, notification type and time. Used to confirm renewals, cancellations, refunds and other changes. Only notifications that have not been processed are kept in Google Pub/Sub for up to 1 day for retries.
• Access logs: request time, path, response status, latency, IP address, user agent and similar details. Used for service operation, troubleshooting and abuse prevention, and kept in Google Cloud logs for 30 days.
• App review access: the app identifier and the review code you enter. Used to verify exports without SAMPLE for app review. The code is kept only in the app's runtime memory, and the server holds a verification hash instead of the original code.
• Email enquiries: your email address and the contents you send. Used to reply, resolve issues and improve the app using optional feedback you choose to send, and kept in the operator's mailbox. If you ask us to delete them, we delete them unless the law requires us to keep them.

2. Information stored on your device

So that you can edit and reopen menus and promotional images, the following is kept in the app's private storage.

• Shop name, contact details, services, prices and promotional text you enter
• Resized and compressed copies of photos you choose, photo cards and artwork information
• In versions with photo-card support, print copies up to 4,096px: these are orientation-corrected, re-encoded copies with location and other source metadata removed, not preserved originals
• Projects, display settings, editing-state copies and error-recovery copies

Photos are imported only when you pick them in the Android system picker; the app does not request access to your whole photo library or camera. Original photos are not changed. Do not enter your customers' personal information or sensitive material.

Except for the event/photo guide copy you explicitly publish under section 6a, this data is not sent to the operator's server. The app has no full editing-data server sync, and Android cloud backup (automatic backup to your Google account) is disabled for app data. However, if you use device-to-device transfer, moving directly between Android 12 or later devices by cable or a nearby wireless connection, your projects and current work (including resized and compressed photo copies and error-recovery copies) can be copied into the app's private storage on the new device. You start this transfer yourself and it does not pass through the operator's server; editing-state copies, display settings and temporary export files are not transferred. High-resolution print copies and guide editing keys are excluded from automatic cloud backup and device transfer. A separately and explicitly saved encrypted QR recovery file follows section 6. Removing a photo from a card may leave a print copy on the device. To remove all app-private photo copies, preserve the files you need elsewhere, then clear app data in Android settings.

3. Google Play subscription verification

The monthly subscription uses Google Play Billing. The app uses the internet for Google Play billing, the subscription verification below, and optional event-guide publication, updates and withdrawal.

• Connection check before purchase: before opening the payment sheet, the app sends only its identifier to check that the billing verification server is ready.
• Purchase, restore and paid-export checks: if the Google Play account on the device has an active subscription, then on purchase or restore, on opening or returning to the app, and before a paid export, the app sends the app identifier and the Google Play purchase token to the operator's HTTPS server. The server uses the Google Play Developer API to check the product, base plan, subscription status, expiry time, acknowledgement status and similar details, and acknowledges valid purchases.
• Without a subscription: if there is no active subscription and you do not start a purchase, the app does not connect to the billing verification server. Optional event-guide connections are separate. Editing and exports with SAMPLE work without a server connection.

The app keeps the export access result in runtime memory for up to 120 seconds and requires a valid check for each paid export. In versions supporting shop displays, a separate display/preview grant lasts for at most 24 hours or until the verified paid period ends, whichever comes first. Clean foreground displays normally recheck every 6 hours, sooner near expiry; failed checks retry after 15 minutes and never extend access. A confirmed loss of access or the end of the verified window switches the display to SAMPLE while its schedule keeps running. Starting a new clean display requires online verification. Access results are not saved to files or backups. Restarting the app requires fresh verification; saved exports and editable projects are not revoked. There is no separate app account; restores are based on purchases made by the Google Play account signed in on the device. The operator never receives card numbers or Google passwords.

Google Play handles payments, renewals, cancellation and refunds. The operator can view the order and transaction information needed for subscription support and refunds in Google Play Console. Google's processing is governed by the Google Privacy Policy.

4. Billing verification server, notifications and access logs

The operator uses a Google Cloud Run server in the Seoul region (asia-northeast3) and Google Pub/Sub to verify subscriptions and receive Google Play subscription change notifications. Notifications can contain the app identifier, purchase token, product, notification type and time. The server processes only notifications authenticated by Google.

• Raw purchase tokens and full lookup responses: processed in the server's runtime memory and not stored in a separate database, file or application log.
• Subscription operations records: one-way hashed identifiers for deduplication, test-purchase flag, subscription state, renewal flag and expiry, order state and timestamps, currency, amounts, developer revenue returned by Google, and country code are stored in Google Firestore in Seoul. Raw purchase tokens, order IDs, names, emails and full addresses are not stored. These records support revenue, renewal, cancellation and refund monitoring and operational troubleshooting; they are not used for advertising or cross-service user tracking. They are retained while needed to operate the service and deleted when that purpose ends or the service closes. Identifiable records can be requested for deletion through support.
• Unprocessed notifications: notifications that fail to deliver are kept in Google Pub/Sub for up to 1 day for retries. Acknowledged notifications are configured not to be retained.
• Access logs: for service operation, troubleshooting and abuse prevention, request time, path, response status, latency, IP address, user agent and similar access details may be recorded in Google Cloud logs. The current retention setting is 30 days. Request bodies and purchase tokens are not written to application logs.
• Rate limiting: the connecting address and request count seen by the server are processed in memory for a short time only and are not saved as a separate list.

Google Cloud is the operator's server, notification and log infrastructure. Regardless of the Seoul region setting, Google's global infrastructure may be used to run Google Play and Google Cloud services. See the Google Cloud Privacy Notice.

5. App review access

If you enter a review code provided by the operator for app review, such as Google Play review, the app sends its identifier and the code to the same HTTPS server to verify access to exports without SAMPLE only. This creates no payment or automatic renewal, and creates no account with access to menus, photos, other users' data or server administration.

The code is kept only in the app's runtime memory and is not saved to files, backups or application logs. After restarting the app, it must be entered again. The server holds a verification hash instead of the original code. Access logs are handled as in section 4, and the export access result is kept for up to 120 seconds and checked again for each export. In display-supporting versions, review display access is limited to 1 hour per verification, never persisted, and can be revoked on the server.

6. When you save or share

Picking photos and files, saving PNG/PDF/JSON files, sending images or PDFs and printing A4 use Android system features or external apps you choose, including print services. The cloud storage or sharing apps you choose may process files under their own policies.

An ordinary JSON backup may contain the current project, photo-card details and small photo previews. It does not include high-resolution print copies, references to those device-local copies or public-guide editing keys. Imported projects do not automatically reconnect to another device’s data. Keep your original photos separately and select them again for large prints on a different device. Check the contents before saving or sharing outside the app. Files saved to the gallery or elsewhere remain outside the app.

In versions with QR recovery, you can explicitly save a separate encrypted recovery file containing one guide (including its dates and program), small photos and QR editing capability. It excludes high-resolution print photos, subscription access, display auto-switch schedules and source-menu links. Restoration creates an independent new project without reconnecting other projects. The app does not upload this file automatically, but a storage service you choose may process it under its own policy. Anyone with both the file and password can edit or withdraw the guide; keep them separately and do not share them. The operator cannot recover lost files or passwords. Restoring does not revoke the original device’s access: verify recovery on the new device before clearing app data on a device you will give away. Recovery alone does not change public content or reopen withdrawn or expired QR links.

6a. Optional event/photo QR and link sharing

When you explicitly review and publish a guide, the app sends the selected title, host, date, time, venue, address, message, program, menu, directions and contact text, plus optional host updates and map/external-registration links, to a separate guide service. You can review and select fields before publication. Event guides require a title, date, time and venue. In versions with photo-catalog support, catalogs require a title and at least one selected photo card; date, time and venue are optional.

Only when you explicitly publish from a version with photo-card support: selected small photo previews (up to 800px and 75KB per card), titles, descriptions, creator, material/technique, year, dimensions, credits, accessibility descriptions, prices, currency and availability may also be sent. High-resolution print copies, original files, photo location/capture metadata and device-local menu/project references are not sent. This feature does not send attendee lists, device contacts or subscription purchase tokens. Selecting a photo or saving it locally does not publish it.

Anyone with the QR or link can read, save and forward this information and its photos without signing in. Do not publish confidential details or guest personal information. Default availability is 30 days, selectable up to 90 days before first publication. Expiry is fixed after publication. Edits become public only after you select Update guide. Previously saved images, printouts and screenshots do not change and cannot be recalled.

The service uses OpenAI Sites and Cloudflare global infrastructure. Public text and small photo previews are stored together in Cloudflare D1, alongside an editing-capability verification hash, revision/publication/expiry information and minimal rate-limit records. The raw editing key stays in private device storage and is not stored on the server. It can be included in a separate encrypted QR recovery file only when you explicitly export it; ordinary JSON, automatic cloud backup and device transfer exclude it. Hosting providers may process access logs for delivery and security. The application adds no visitor analytics, attendee registration or advertising tracking. This is separate from the existing Google Play billing verification server.

Excluding or deleting a card and publishing an update stops this site from serving that photo detail. Withdrawing the whole guide clears its public text and previews and stops link access. Expired guides are also unavailable. An already open page must reconnect and fetch new information to receive withdrawals or changes; offline it may show the last loaded information until the known expiry. Records more than 30 days past expiry are cleaned up on a later server write, rather than on a guaranteed date. For earlier deletion, send the guide link to support@getsalonpaper.com. Never send the editing key. Uninstalling or transferring the app does not withdraw published content. Verify a usable encrypted recovery file or withdraw the guide first to avoid losing editing access.

External map and registration services apply their own policies. This feature provides no native RSVP, ticket validation or automatic email/text delivery.

7. Email enquiries and optional usage feedback

The app's support button opens an email draft. Nothing is sent until you send it yourself. The draft includes only the app version; menus, photos and logs are never attached automatically.

The email address and contents you send (including any device model, Android version or screenshots you write or attach) are used only to reply, resolve issues and handle your request, and are kept in the operator's mailbox. To have them deleted, ask at the same address; we delete them unless the law requires us to keep them. Do not send names, phone numbers, Google account passwords, card information, purchase tokens or customer data.

Share your experience is an optional survey. You may manually answer any questions about business type, the range of promotions you shared or printed in the last 30 days, project reuse, your next project and reasons to keep or cancel a subscription. The app does not read or send usage records automatically. If you send the email, support receives your sender address and answers for product improvement. The private operations dashboard holds a minimal summary, category, work status, receipt time, any voluntarily stated acquisition channel and business type, and the mail message identifier needed to locate the original. It does not store names, email addresses, business names or full answers, and is not linked to purchase records. Participation does not affect app access. Original emails follow the same deletion-request process as support enquiries.

Support mail is automatically forwarded to the responsible operator's Gmail. An owner-only Google Apps Script temporarily reads support-mail subjects and sender/recipient headers to classify enquiry candidates and notify the operator. Private script properties store only message/thread identifiers, categories, receipt/handling times and status; subjects, email addresses, bodies and attachments are not copied. Resolved or excluded test records are automatically cleaned up once their latest message is older than 90 days; unresolved records are kept while needed for support. Daily revenue aggregates and delivery confirmation records are also kept for 90 days. The revenue dashboard receives only currency/day aggregates and subscription counts, not individual payment identifiers. The operator may use ChatGPT connected Gmail for manual review and minimal summaries when needed. Existing access-restricted OpenAI Sites and Cloudflare operations records are retained, but their scheduled collection and reports have been paused. Summaries and work records are deleted when no longer needed or upon an identifiable deletion request, together with the original.

The operator's support email uses Gmail, so the Google Privacy Policy also applies. The policy of the email service you use applies as well.

8. External services we use

The operator uses the services below. Each processes only the information described in the sections above.

• Google LLC — Google Play: app distribution, subscription payments, renewals, cancellation and refunds, and subscription change notifications. Payment information that Google processes directly is governed by Google's privacy policy.
• Google Cloud (Cloud Run and Firestore in Seoul, Pub/Sub, Cloud Logging): running the billing verification server, receiving subscription change notifications and keeping minimized subscription operations records and access logs.
• Gmail and Google Apps Script: receiving, forwarding and replying to enquiries, support-header classification, the owner-only operations dashboard, minimized work records, revenue aggregates and automated reports. Google may use global infrastructure.
• OpenAI ChatGPT and Sites, and Cloudflare: manual connected-mail review and minimal summaries when needed, existing access-restricted operations records, and optional public event/photo guides under section 6a. Scheduled operations collection and reports were paused after the Apps Script migration. These services may use global infrastructure.

The operator does not provide personal information to third parties except as described in this policy or where required by law, and does not sell it or use it for advertising.

Public event/photo guides use OpenAI Sites and Cloudflare and follow the publication, retention and deletion rules in section 6a. Verify a usable encrypted QR recovery file or withdraw published guides before uninstalling, clearing data or transferring devices.

9. Retention and deletion

Projects stay on your device until you delete them. Device-to-device transfer copies your data, so data on the old device must be deleted there separately. Editing-state and error-recovery copies may remain after you delete a project from your projects.

To remove all internal app data, first preserve needed ordinary JSON and separate encrypted QR recovery files outside the app and verify that you can recover them, then use Apps → Salonpaper → Storage → Clear data in Android settings. Menu names vary by device. Uninstalling the app also deletes the data in its private storage.

Gallery images, files you saved and copies shared by email or other apps must be deleted where they are. The operator cannot view or delete data that exists only on your device.

On the server side, raw purchase tokens and full lookup responses are not kept once processing ends. Minimized subscription operations records and enquiry summaries follow the purposes and deletion rules in sections 4 and 7. Unprocessed notifications are deleted automatically after 1 day and access logs after 30 days under the Google Cloud retention settings. Enquiry emails are deleted from the mailbox when you ask us to delete them.

Uninstalling the app or clearing its data does not cancel a Google Play subscription. Cancel subscriptions and manage billing history in the Subscriptions menu in Google Play. Purchase and payment records held by Google follow Google's retention policies.

In versions with photo-storage cleanup, only unused app-private print copies are deleted after you inspect the report and explicitly confirm. Photos referenced by saved work, current work or recoverable drafts are protected, and cleanup stops if those records cannot be checked safely. This cleanup does not delete gallery originals, small previews, public QR photos or files exported outside the app. Nothing is cleaned up automatically.

10. Security measures

• Communication between the app and the billing verification server uses HTTPS only, and the app does not allow unencrypted traffic.
• Purchase tokens are treated as secrets and are not stored or logged.
• Subscription change notifications are accepted only when authenticated by Google.
• Review codes are configured on the server only as a verification hash, not the original code.
• The server runs with Google Cloud service account permissions and no separate private key file, and it limits excessive requests.
• Editing data is kept in app-private storage that other apps cannot access, and is excluded from cloud backup. Direct device-to-device transfer includes only projects, current work and error-recovery copies.

Please manage your device lock and access to backup files you export yourself.

11. Your rights

The app creates no separate account, so there is no app account to close. You can manage on-device data yourself as described in section 9. You can ask by email to access, correct or delete personal information the operator processes, or to stop processing it. We can act on server access logs only where the records you ask about can be identified, and please also use Google's own controls for your Google account and payment records. Do not send purchase tokens, passwords or card numbers with your request.

12. Privacy contact and remedies

Operator: CREOS (크레오스)
Service: Salonpaper Android app
Privacy enquiries: support@getsalonpaper.com (email only)

For advice or dispute resolution about a privacy infringement, you can contact the relevant Korean bodies, such as the Personal Information Dispute Mediation Committee or the Personal Information Infringement Report Center run by the Korea Internet & Security Agency (KISA). If you use the app outside Korea, you may also contact the data protection authority in your country.

13. Changes to this policy

When actual data handling changes, we update this page and the in-app notice. If the information processed, its purposes or its retention change, we describe the change and its effective date on this page. On November 6, 2026, we added minimized subscription operations records and owner-only enquiry classification, summaries and daily reports. Later that day, automated collection and reporting moved to Google Apps Script, with more specific retention and storage details. Optional event QR/link sharing was subsequently added (section 6a). On November 7, 2026, we described explicitly selected and published photo previews, artwork details, prices/availability and on-device print copies in versions with photo-card support. This does not enable photo publication in older versions without that feature. No automatic photo uploads or advertising SDKs were added. For versions with QR recovery and photo-storage cleanup, this notice also covers optional encrypted recovery exports and confirmed deletion of unused print copies. Automatic-backup exclusions remain unchanged.

Effective: November 7, 2026 · First published: October 22, 2026