PEEK Privacy Policy
Effective date: October 10, 2026
This document is an English translation of the Korean 일본 이용자를 위한 안내. The Korean version is the original. If this translation and the Korean version differ, the Korean version prevails.
Under Japan’s Act on the Protection of Personal Information (APPI), the Operator provides the following information. Other matters follow the main text of the Privacy Policy.
The name of the business operator is the Operator’s name given under “Chief Privacy Officer” in the Privacy Policy. The country of location is the Republic of Korea. If you ask through the contact point in 3 below, we will tell you the address without delay.
The purposes of use of personal data are the same as in “Purposes and Legal Bases of Processing” in the Privacy Policy.
You may request, at peekapp.support@gmail.com, notification of the purposes of use, disclosure (including provision as an electronic file), correction, addition or deletion, suspension of use or erasure, suspension of provision to third parties, and disclosure of records of provision to third parties. We verify your identity by confirming that the request was sent from the email address you signed up with, and we charge no fee. Complaints and inquiries are handled at the same contact point.
We take the measures described in “Security Measures” in the Privacy Policy, and the Operator is responsible for the handling of personal data. Understanding of the external environment: personal data is processed in the Republic of Korea, the United States, Singapore, Israel, the EU (Czech Republic, Germany) and countries that cannot be identified (table in 5 below), and the Operator takes security control measures after understanding the personal information protection systems of those countries.
By agreeing to this Policy, you also agree to the provision of personal data to the foreign vendors below.
Please check before you agree. Each country’s personal information protection system can be found in the “Survey on Systems for the Protection of Personal Information in Foreign Countries” (country reports) published by Japan’s Personal Information Protection Commission. The EU is not covered by these reports because the Commission has designated it as having a personal information protection system equivalent to Japan’s.
“I agree to the Privacy Policy” on the sign-up screen includes this consent. The items and purposes for each vendor are in the “Transfers abroad” table of the Privacy Policy; the country where each vendor is located and its protective measures are shown below.
| Vendor | Country where the vendor is located | Protective measures taken by the vendor |
|---|---|---|
| AWS | Republic of Korea | Run by the Operator; management access by key only; encryption in transit |
| Supabase | Singapore | Row-level access restrictions per account, encryption in transit |
| PowerSync | United States | Encryption in transit, processing under the vendor’s privacy policy |
| Vercel | United States | Enforced encrypted connections (HSTS) and security headers |
| Expo | United States | Nothing other than the number of items saved is put in notification text, encryption in transit |
| RevenueCat | United States | Request to delete the customer record when you delete your account, encryption in transit |
| Singapore (Gemini API) · United States (YouTube Data API) | Inputs and outputs of the paid Gemini API are not used to improve Google’s products (Gemini API Additional Terms of Service), encryption in transit | |
| OpenAI | United States | API data is not used for development or improvement without explicit consent; we ask that responses not be stored; Data Processing Addendum |
| Hetzner | Germany | Run by the Operator; only requests carrying the correct secret key are accepted; encryption in transit |
| Oracle | United States | Run by the Operator; key-based access only and no service ports open; encryption in transit |
| Content retrieval service providers | United States, Israel, Czech Republic, and countries that cannot be identified (individual retrieval services used through an API marketplace) | Only link URLs are passed on |
| PostHog | United States | Session recording and automatic screen capture turned off; link URLs, saved content and the like removed right before sending |
| Sentry | United States | Saved content, search terms, URL query strings, email addresses and authentication tokens removed before sending |
| Apple | United States | No ad tracking permission (ATT) and no advertising identifier (IDFA) used; campaign, keyword and other details kept by the Operator only in a form not linked to any account (the result of the check through RevenueCat is kept by RevenueCat) |