PONO Privacy Policy

This English version is a reference translation of the Korean policy. If there is any difference, the Korean version prevails. Effective 19 October 2026.

0. At a glance

• Your records stay on this phone. Our server keeps only what is needed to send alerts, and only for as long as it is needed.
• If you only record on your own, no account is created. An account is created the first time you use a feature that needs the server, such as connecting a support person or signing up for the PONO Plus launch notice.
• We do not collect phone numbers, email addresses or location.
• Symptoms, reflections, notes and your health information are never sent to the server.
• When you start connecting a support person, we ask for your separate consent for the RED/AMBER level and support-person notes (health-related information) that pass through the server.
• PONO is not for children under 14.
• We do not remove a support connection just because the app has not been used for a while. The cases in which data is deleted are fixed and listed in section 4.
• You can delete everything on this phone and on the server at any time with [Delete all data] in Settings.

1. Operator

• Service: PONO
• Operator: JANE
• Contact: pono.support@gmail.com
• Privacy officer: the operator · pono.support@gmail.com

2. What information is kept where

2-1. Kept only on this phone (never sent to the server)

The operator cannot see this information. It is removed from this phone when you remove the app. Copies in your phone's backup follow that service's policy (below). If you save a backup file beforehand, you can restore it on a new phone with [Bring my records].

Your phone's backup and device-transfer features If you use your phone's backup or device-transfer feature, depending on the operating system and device settings, your PONO records may be included in your Google account's or your phone maker's backup, or moved to a new phone. That backup is kept under that service's policy, and the PONO operator cannot access your phone's backup. Support-person connections are not included in phone backups. Whether a backup or transfer actually happens may differ by device and settings.

2-2. Kept on the server for a short time

Symptoms and reflections are not included here.

2-3. Kept on the server for connections

2-4. Kept on your support person's phone

• 48 hours is the same as the time a support person has to leave or edit a note. After that, the copy on their phone is deleted automatically.
• Notes that reach your phone become part of your records (2-1). You can delete them (5-3).
• Notes not yet delivered to your phone keep being delivered by the server even after the copy on the support person's phone is deleted (up to 7 days, 2-2).

2-5. What we do not collect

Phone numbers · email addresses · location (GPS) · country · when you last opened the app · advertising ID · contacts.

The operator does not store IP addresses. However, Google, which issues the accounts, processes connection IP addresses and device information for account security and abuse prevention (section 6).

3. What it is used for

• When you tap RED or AMBER, alerts are sent to your connected support people.
• Your support person's response is shown on your screen.
• Notes from your support person are delivered to your phone.
• Invites and connection requests are processed.
• If you signed up for the PONO Plus launch notice, we tell you once when it becomes available on this phone. It is not used for ads or any other messages.
• When a connection is removed, the person who remains is told once. The patient side sees "Connection with ○○ was removed. Alerts no longer go to this person." and the support person side sees "Connection with ○○ was removed." If both directions with the same person end at once (when you are each other's support person), one notice is sent instead of two: "All connections with ○○ were removed. Alerts no longer go between you." We never say who removed it or why.

It is not used for anything else (advertising, sale, statistical analysis). It is not provided to third parties.

3-1. Health-related information (sensitive information) and separate consent

PONO does not send symptoms or reflections to the server. However, to alert your support person, the information below passes through the server, and because it sits together with your name, it may be regarded as health information. That is why we ask for consent separately from other information (Korean Personal Information Protection Act, Article 23).

• When we ask: once, the first time you tap [Create invite code]. We do not ask if you only record on your own.
• For the person becoming a support person: when they enter an invite code and tap [Request connection], we tell them what they will receive and what they will send (name, responses, witnessed notes), and confirm that they are 14 or older. How their notes are delivered and deleted is also written in the note screen.
• Consent record: the version of the notice and the time you agreed are kept on this phone and on the server (account record). The server does not accept invite creation or code entry from an account without this record. If the notice changes, we ask again.
• Withdrawal: Settings → My info → My server account → [Delete server account] (5-2). Server information and the consent record are deleted together; records on your phone stay.

4. How long it is kept

Each kind of data has its own period. It is not "everything is kept for 90 days".

4-1. Keeping connection and alert information (exact rule)

Information kept on the server for connections and alert delivery is kept while the connection lasts. We do not remove a support connection or delete an account just because the app has not been used for a long time. An account that started connecting but never finished is deleted after 7 days, and an account left after all its connections were removed is deleted after 30 days. An account whose own push address was confirmed invalid is deleted 30 days after it was confirmed. Episode delivery information, support-person notes and invite codes each have their own shorter retention periods.

• PONO is for people who do not know when their symptoms will come back. So connections stay even if nothing is recorded for months. The operator does not store when you last used the app.
• When the push service answers that "this push address is no longer valid", that address is deleted right away. If it belongs to the support person, the patient's screen shows "Disconnected" and suggests checking the connection. If it belongs to the patient, the support person's screen shows "Disconnected" and "If this lasts 30 days, the connection is removed automatically." The mark disappears when that phone sends a new push address.
• If it stays that way for 30 days (the app does not send a new address in the meantime), that account is deleted. Reinstalling always creates a new account, so an account whose address became invalid cannot be used again. The people it was connected with get one "connection was removed" notice. Simply turning a phone off or not using it for a long time does not make the address invalid.
• So that the push address does not expire, the app refreshes it regularly.

4-2. How we check whether a push address is valid

• Once a week, the server asks the push service whether stored push addresses are valid. No real alert is sent and nothing arrives on the phone. This check is not about whether you used the app recently; it is a technical check of whether the address is valid. The same applies when an invalid answer comes back while sending a real alert.
• The screen shows only "Disconnected". The operator does not know the reason (app removed, new phone, expired address etc.) and does not guess.

4-3. If you remove or reinstall the app

• Records on the phone are removed with the app.
• Phones do not tell the server when an app is removed. Removing the app is not the same as deleting your data.
• Information left on the server is deleted automatically 30 days after the push address is confirmed invalid (4-1). This is confirmed right away when the next alert is sent to that phone, or in the weekly check (so usually 30 days to about 5 weeks). With no app and no contact details, we cannot tell you that it was deleted.
• To delete right away, tap [Delete all data] or [Delete server account] before removing the app.
• If you reinstall, we do not guarantee recovery of your previous account. Support connections must be made again with a new invite code. Records can be restored from a backup file with [Bring my records] on the first screen, and they are merged with any records already there.

5. Deletion

5-1. [Delete all data] (Settings → Data)

Deletes the following at once:

1. Records, reflections and My info on this phone
2. On the server: name, language, alert delivery details, account record, all connections, invite codes, episodes in progress, undelivered support-person notes, PONO Plus launch notice sign-up, and number of people you can connect
3. This phone's push address
4. The anonymous account

The server deletes item 2 first, checks again that nothing is left, and deletes the anonymous account last. If something is left or the last step fails, only the account ID is kept, and deletion is run again from the start at the weekly check.

The people you were connected with get one "Connection with ○○ was removed" notice. They are not told that data was deleted. This notice uses only the name the server held for the connection, and nothing is kept on the server after it is sent.

Copies in your phone's backup and backup files or PDFs you saved yourself are not deleted by this feature.

5-2. [Delete server account] (Settings → My info → My server account)

Keeps the records on your phone and deletes only the server information. It deletes the same things as items 2, 3 and 4 in 5-1. Support connections and the Plus launch notice sign-up end, and the people you were connected with get one "connection was removed" notice. If an episode is in progress, you can delete after it ends. Connecting again creates a new account. This is also how you withdraw consent to the processing of health-related information (3-1).

If your account was deleted by the automatic clean-up (section 4), the app notices when you next open it and shows a one-time "Your server account was removed" message.

5-3. Deleting individual items

• Records, reflections, GREEN entries: you can delete them one by one in the calendar.
• Notes from your support person: you can delete them. The copy on the support person's phone is deleted automatically 48 hours after the episode ends (2-4).
• PONO Plus launch notice: turning it off in Settings → PONO Plus deletes the sign-up on the server right away.
• Support connection: [Unlink] in Contacts. The other person gets one "connection was removed" notice (who removed it is not shown). No notice is sent when you cancel or decline a request that was not yet accepted.
• After unlinking, that support person no longer receives alerts for new episodes.
• For an episode they were already alerted to, they can view it until 48 hours after it ends (level, times, response status) and record what they saw. If it is still in progress, they keep getting that episode's alerts until it ends.
• To end this right away too, turn on [Also end access to the recent episode now] or [Also cut them off from the episode in progress] in the unlink confirmation. The server then ends that support person's view and note access and further alerts for that episode immediately. Alerts that already reached their phone cannot be recalled. Notes they already left stay in your records.
• [Delete all data] also ends this access immediately.

5-4. Requesting deletion from outside the app

See the Data deletion page for details.

• If you have the app: [Delete server account] (5-2) or [Delete all data] (5-1).
• If you already removed the app: if you never connected, within 7 days; if you were connected or signed up for the Plus notice, 30 days after the push address is confirmed invalid (usually about 5 weeks), automatically (4-1).
• You can also ask by email (pono.support@gmail.com). However, PONO keeps nothing but a name, so we cannot confirm which account belongs to the person asking. To avoid cutting someone else's support connection by mistake, unless we can confirm it is you, we will point you to the automatic deletion above.

6. Processors and transfers outside Korea

To provide the service, PONO uses the overseas providers below to process personal information, and in doing so personal information is transferred to and stored outside Korea. This is done to perform the contract for providing the service. None of the transfers below happen if you only record on your own. They start when you begin connecting a support person or sign up for the PONO Plus launch notice.

① Google LLC (contact: googlekrsupport@google.com) - Country, timing and method: the United States and countries where Google data centres are located / encrypted transfer over the network when you use a feature that needs the server - Recipient and contact: see the email above - Items: anonymous account ID, connection information (IP address; device information — OS version, device model, manufacturer; app version), push address and installation ID, alert contents (name, level, response status, start time) - Purpose: issuing and securing accounts without sign-in, delivering alerts - Retention: until deleted by [Delete all data] or under the rules in 4-1. Alerts that cannot be delivered are discarded after 10 minutes to 1 hour. Connection IP addresses collected for Google's system security and abuse prevention are kept for a few weeks and then destroyed, and account information is finally removed within up to 180 days after deletion under Google's system policy.

② Cloudflare, Inc. (contact: PrivacyQuestions@cloudflare.com) - Country, timing and method: the United States and countries where Cloudflare data centres are located (processed close to the user) / encrypted transfer when the service is requested - Recipient and contact: see the email above - Items: connection information (IP address) and the information in 2-2 and 2-3 (while it is being delivered and processed) - Purpose: running the alert server and managing live episodes (waiting for support-person responses) - Retention: episode information in progress until it ends. Alert recipients' names for 48 hours after it ends. If a support-person note is not yet delivered, its deletion schedule (account ID and time) for up to 7 days. System logs are kept for 3 days and then destroyed

③ Storage in Korea - Provider: Google LLC (Cloud Firestore, Seoul data centre) - Data: service operating data (items in 2-2 and 2-3)

④ How to refuse the transfer, and what happens - How: you can stop using the app and delete the transferred information with [Delete all data] in Settings. PONO server information and the anonymous account are deleted right away, and some records left in the providers' systems are destroyed according to the retention periods above. - What happens: support connections and alerts work on top of the providers above (Google, Cloudflare), so if you refuse the transfer you cannot use these features. You can still record on your own.

7. Your rights

• Access: you can see your records in the app right away, get a PDF with [View my records], and a file with [Save backup file].
• Correction: change your name and My info in Settings → My info. Changing your name also changes it on the server.
• Deletion and suspension: you can delete directly in the ways in section 5.
• Withdrawing consent: you can withdraw at any time with [Delete server account] (3-1). Your records on the phone and recording on your own are not affected.
• Asking the operator: PONO does not sign you up with a name or contact details, so the operator cannot confirm which account belongs to the person asking. That is why access and deletion are built into the app. If you have already removed the app, data is cleaned up by the automatic deletion in 5-4, and the operator acts on email requests only when it can confirm the request comes from you.

8. How it is kept safe

• Communication between the phone and the server is encrypted (HTTPS).
• Server information can be read only by the people concerned (your info only by you, a connection only by its two people, an episode only by the patient and the support people it alerted, support-person notes only by the receiving patient), and only the server can write it.
• Support people's screens never show other support people's names.
• The secret keys that run the server are kept only in the server's secret store and are never put in the app.
• Records stored on the phone are protected by the phone's lock and the operating system's app isolation.

9. Children

PONO does not accept users under 14. When information first starts going to the server (when you start connecting a support person or enter an invite code), we confirm that you are 14 or older. We do not collect age or date of birth.

10. When this policy changes

We will tell you in the app 7 days before a change takes effect. For changes that lengthen retention or add information collected, we will tell you 30 days before. If what you consented to changes, we will ask for your consent again (3-1).

• Effective date: 19 October 2026