Privacy Policy
This English text is provided for convenience. The Korean version governs in the event of any discrepancy.
튜터드(Tutrd) (the "Company") complies with the Personal Information Protection Act and other applicable laws, and processes personal data as set out below.
1. Personal Data Collected and How
The Company collects the minimum data needed to provide the Service, either entered by the user or generated automatically during use.
| Category | Data | Method |
|---|---|---|
| Account | Email address, password (stored one-way hashed), and for Google sign-in the Google account identifier, email and profile name | Entered at sign-up / social login |
| Profile | Display name, Overwatch in-game nickname, per-role tier and division, preferred roles, region | Entered during onboarding and profile edits |
| Coach | Coach display name, in-game nickname, verification evidence (rank proof), heroes and roles covered | Coach application and verification |
| Feedback requests | Replay video file, player nickname, request note, focus keywords, request and feedback history | Submitting a request and receiving feedback |
| Payments | Payment identifier, payment method type, amount and timestamp, coin grant/usage/refund ledger (card credentials are never stored by the Company) | Payments made through the gateway (PortOne) |
| Automatically generated | IP address, access timestamps, browser and device information, service usage logs, authentication session cookies | Generated automatically while using the Service |
2. Purposes of Processing
- Registration, identification, authentication and account management
- Receiving, intermediating and fulfilling replay feedback requests, including coach assignment
- Coin payments, refunds, settlement and retention of transaction records
- Preventing abuse, resolving disputes and responding to enquiries
- Analysing usage to improve the Service (never used for marketing in identifiable form)
- Meeting legal obligations and sending service notices
3. Retention Periods
Personal data is destroyed without delay when a member withdraws, except for the following, which are retained for the periods shown.
| Data retained | Period | Basis |
|---|---|---|
| Records of contracts and withdrawal of subscription | 5 years | Act on Consumer Protection in Electronic Commerce |
| Records of payment and supply of goods or services | 5 years | Act on Consumer Protection in Electronic Commerce |
| Records of consumer complaints or dispute handling | 3 years | Act on Consumer Protection in Electronic Commerce |
| Records of labelling and advertising | 6 months | Act on Consumer Protection in Electronic Commerce |
| Service access logs | 3 months | Protection of Communications Secrets Act |
| Uploaded replay videos | 90 days after the request is completed, cancelled or expired (deleted automatically thereafter) | Service operating policy |
4. Disclosure to Third Parties
The Company does not provide personal data to third parties, except with the user's prior consent or where an investigative authority makes a lawful request under applicable law.
A coach who claims a request receives only what is needed to deliver feedback — the replay video, player nickname, request note and keywords, and tier information — which constitutes performance of the service the user requested.
5. Processors and Cross-Border Transfers
The Company entrusts the following processing in order to operate the Service; some processors are located outside Korea. Transfers occur over the network at the time of use.
| Processor | Entrusted work | Country | Data transferred | Retention |
|---|---|---|---|---|
| Supabase, Inc. | Authentication and database operation | United States | Account, profile, request and payment history data | Until the contract ends or the member withdraws |
| Vercel Inc. | Service hosting and traffic handling | United States | IP address, access logs and other automatically generated data | Until the contract ends |
| Cloudflare, Inc. | Replay video storage and delivery | United States | Replay video files | For the period stated in section 3 |
| Korea PortOne Inc. | Payment processing and verification | Republic of Korea | Payment identifier, method, amount and timestamp | For the period required by law |
| Google LLC | Social login (OAuth) authentication | United States | Google account identifier, email, profile name | Until the link is removed or the member withdraws |
Users may refuse the cross-border transfer of their data, in which case use of the Service may be limited. Refusals can be sent to the privacy officer below.
6. Your Rights and How to Exercise Them
Users may at any time request access to, correction of, deletion of, or suspension of the processing of their personal data.
- Profile data can be viewed and edited directly in My Page.
- Membership withdrawal can be requested through the Service or by contacting support.
- Other requests can be sent to overspec.app@gmail.com; the Company responds with the outcome within 10 days of receipt.
- Rights may be exercised through a legal representative or an authorised agent, in which case proof of authority may be requested.
Data the Company is legally required to retain may be excluded from deletion requests.
7. Destruction of Personal Data
Data is destroyed without delay once the retention period elapses or the purpose of processing is achieved. Electronic files are erased irrecoverably; paper documents are shredded or incinerated.
Data that must be retained by law is stored separately and destroyed once the statutory period ends.
8. Cookies and Similar Technologies
The Company uses authentication session cookies to keep users signed in and to protect accounts. Users may block cookies in their browser settings, but features requiring sign-in will then be unavailable.
9. Security Measures
- Encryption in transit (HTTPS) and one-way hashing of passwords
- Row Level Security and least-privilege access control over stored data
- Separated administrator permissions with an audit trail of actions
- Signed, short-lived URLs for replay videos to prevent unauthorised access
- Minimising the number of staff handling personal data and periodic security reviews
10. Privacy Officer
| Item | Detail |
|---|---|
| Privacy officer | 정정환 |
| Contact | overspec.app@gmail.com |
Users may raise any privacy enquiry, complaint or remedy request with the privacy officer, and the Company will respond without delay.
11. Remedies for Infringement
For reports or advice regarding privacy infringement, the following Korean authorities can be contacted:
- Personal Information Dispute Mediation Committee — 1833-6972 (www.kopico.go.kr)
- Korea Internet & Security Agency privacy centre — 118 (privacy.kisa.or.kr)
- Supreme Prosecutors' Office cybercrime division — 1301 (www.spo.go.kr)
- National Police Agency cyber bureau — 182 (ecrm.police.go.kr)
12. Changes to This Policy
This Privacy Policy applies from 2026-07-26. Any addition, deletion or amendment will be announced within the Service at least 7 days before it takes effect, or 30 days in advance where it materially affects users' rights.