Privacy Policy · DigMol

In short

The operator is a Singapore company. Data is processed and stored outside your country. (see section 7)
You sign up and log in with an email address or a Google, Apple, Kakao or Naver account. We receive your email address, name and profile photo. We do not collect your date of birth or any national identification number.
To calculate rewards and prevent abuse we process device identifiers, wallet addresses and activity records.
Location and camera are accessed only when you use the relevant feature and only with your permission.
For step rewards (pedometer) we read your step count and physical activity recognition data (health and fitness data) only with your permission. We never use this data for advertising or sell it. (see section 1)
You can ask to access or delete your data at any time. Transactions recorded on a blockchain cannot be deleted.

This summary is for convenience only. The full text below is what governs.

11. Personal data we collect

We collect only what the Service needs. We do not collect your date of birth or any national identification number.

Basis	Data	When collected
Required	Account information: email address, name (nickname), profile photo, social account identifier	On sign-up and login (email sign-up or Google, Apple, Kakao or Naver login)
Required	Password (stored with irreversible one-way encryption)	On email sign-up
Required	Device identifier (including advertising ID), OS and device model, app version	Automatically on first launch
Required	Blockchain wallet address, transaction hashes	On wallet connection and reward payout
Required	Activity records (accruals, timestamps, booster multiplier), invitation code and acquisition source	Automatically during use
Optional	Location data (GPS coordinates, distance travelled)	When you use the walking reward (after consent)
Optional	Health and fitness data: step count and physical activity recognition (walking, running, stationary, in vehicle, cycling)	When you use the pedometer / step reward (after granting permission)
Optional	Photographs and capture metadata	When you use the photo feature (after consent)
Optional	Push notification token	When you opt in to notifications
Optional	Email address	When you enter it to contact or report to us
Automatic	IP address, access timestamps, cookies, usage records, error logs	Automatically during use

How we handle health and fitness data (step count and physical activity)

How we access it — Only when you use the pedometer (step reward) feature and grant the device permission. On Android we use the device step sensor and activity recognition through the "Physical activity" permission and, where applicable, step counts from Health Connect (read-only). On iOS we use step counts and activity state through the "Motion & Fitness" permission and, where applicable, step counts from Apple Health (HealthKit, read-only).
What we collect — Your cumulative step count for the day, and your activity state (walking, running, stationary, in vehicle, cycling) with its confidence level. We do not collect heart rate, weight, sleep, medical conditions or any other health information, and we never write data to Health Connect or Apple Health.
How we use it — Solely to calculate MOL accrual and pay step rewards, to display your step count in the app, and to prevent abuse by excluding abnormal steps such as those recorded while in a vehicle or by shaking the device.
Processing and storage — Activity state is used only on your device to verify steps and is never sent to our servers. Only your daily step count is linked to your account and transmitted, encrypted, to our servers for reward calculation.
Sharing and restrictions — We do not sell health and fitness data, use it for advertising, marketing or personalised ads, or share it with advertising networks, data brokers or other third parties, and we do not use it to determine eligibility for credit or insurance. Apart from our cloud infrastructure provider (section 5) acting on our behalf, we do not share it except where required by law.

The use of information received from Health Connect will adhere to the Health Connect Permissions policy, including the Limited Use requirements. Information received from Apple Health (HealthKit) is likewise used only for the purposes above in accordance with Apple's HealthKit guidelines. You can revoke access at any time in your device settings or in Health Connect / the Health app, and you can ask us to delete step data stored on our servers by writing to privacy@digmol.com.

What we receive — When you log in with a Google, Apple, Kakao or Naver account, we receive only your account identifier, email address, name and profile photo from that service. For Google accounts we request no permissions beyond basic profile information (openid, email, profile), and we do not access your contacts, Gmail, Drive or any other Google data.
How we use it — Solely to identify you, log you in and verify your identity, prevent duplicate accounts and abuse, and display your profile in the app.
Storage — This information is linked to your account and transmitted over an encrypted connection to, and stored on, the Company's servers. We never receive your social account password, and access tokens from the social service are used only to verify the login and are not stored.
Sharing and limits — Information received through social login is never sold, never used for advertising, marketing or personalised ads, and never provided to third parties such as ad networks or data brokers. It is not shared with anyone other than our cloud infrastructure provider (section 5), except where required by law.
Deletion — When you delete your account, your email address, name, profile photo and password are destroyed immediately. You can remove DigMol's access at any time in your Google Account settings (myaccount.google.com/permissions).

DigMol's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

22. Why we use it

Account management — identifying users, logging in and verifying identity, resetting passwords, preventing duplicate accounts, processing account deletion
Providing the Service — recognising activity, counting steps, calculating MOL accrual, paying rewards, showing history
Preventing abuse — detecting duplicate accounts, automation and location spoofing, and excluding abnormal steps such as those taken in a vehicle
Managing invitations — attributing installs to invitation links and paying both sides
Improving the Service — usage analytics, error diagnosis, feature development
Support — receiving and answering enquiries and reports
Notices — essential announcements about terms, reward policy and maintenance (marketing messages only where you have opted in)
Legal compliance — obligations under Singapore and Korean law, sanctions screening, and responding to lawful requests from authorities

33. Retention

We destroy personal data without delay once the purpose of collection has been achieved, except as set out below.

Data	Retention	Basis
Account information (email address, name, profile photo, password)	Destroyed immediately on account deletion	-
Social account identifier (email address for email sign-up)	7 days after account deletion (destroyed afterwards)	Preventing abuse through immediate re-registration
Device identifiers and activity records	30 days after termination	Preventing repeat abuse and handling enquiries
Abuse records	3 years	Preventing recurrence and handling disputes
Location data	Destroyed immediately after each use (only aggregate distance is kept)	Location data legislation
Step data	Daily step counts: 30 days after termination (activity state is processed only on your device and is not stored on our servers)	Reward settlement and handling enquiries
Support and enquiry records	3 years	Consumer complaint and dispute records
Access logs and IP addresses	3 months	Communications privacy legislation
Anti-money-laundering records	5 years	Applicable Singapore and Korean law

Wallet addresses and transaction history are recorded on a blockchain and cannot be deleted by the Company. This is inherent to distributed ledger technology; please take it into account before connecting a wallet.

44. Disclosure to third parties

We do not disclose personal data to third parties, except in the following cases.

Where you have given prior, express consent
Where a law so provides, or where a Korean or Singapore investigative authority makes a request following the procedure prescribed by law
Where data is provided in a form from which no individual can be identified, for statistical or academic purposes

55. Processors

We engage the following processors so that the Service can run. Each contract sets out data protection obligations clearly, and we supervise performance against them.

Processor	Purpose	Retention
Cloud infrastructure provider	Server operation and data storage	Until the contract ends
Push notification provider	Sending app push messages	Until the contract ends
Advertising network	Serving rewarded ads and verifying views	Until the contract ends
Analytics provider	Usage analytics and error collection	Until the contract ends

The specific processors may change as the Service evolves; changes are published in this policy. Most processor servers are located outside your country, so please also read section 7 (cross-border transfer).

66. Your rights

You may exercise the following rights at any time.

Access your personal data
Have inaccurate data corrected
Have data deleted (except where retention is required by law)
Ask us to stop processing
Withdraw consent (for optional items)
Refuse cross-border transfer (which may make the Service unavailable to you)

You can exercise these rights through the in-app settings or by writing to privacy@digmol.com. We respond within 10 days of receiving a request. Where you ask for deletion, we destroy the data so that it cannot be restored or reconstructed.

Location, camera, physical activity (Motion & Fitness) and health data (Health Connect / Apple Health) permissions can be withdrawn at any time in your device settings or in the relevant health app. Withdrawing them disables the related reward features, such as walking, pedometer and photo rewards.

77. Cross-border transfer

Please read this. The Company is incorporated in Singapore and its infrastructure is located outside your country. Your personal data is therefore transferred out of your country for processing and storage.

The following disclosure is made in accordance with Article 28-8 of the Personal Information Protection Act of the Republic of Korea and the transfer limitation obligation under the Singapore PDPA.

Item	Detail
Recipient	BUKCS PTE. LTD. (service operator) and the processors listed in section 5
Destination	Singapore and the countries in which each processor's servers are located
Data transferred	All items listed in section 1
Timing and method	Transmitted on an ongoing basis over encrypted network connections as you use the Service
Purpose	All purposes listed in section 2
Retention	As set out in section 3
How to refuse	Write to privacy@digmol.com. Because the transfer is essential to providing the Service, refusing it may restrict or prevent your use of it.

We apply protection to transferred data comparable to the standard required by the law of your country, including encryption in transit and access controls.

88. Children

We do not collect personal data from children under 14 and the Service is not directed at them. If we find that we hold such data, we destroy it immediately and suspend the account. Where the law of your country sets a higher age of consent, that threshold applies.

99. Cookies and similar technologies

On the website we use cookies and local storage to keep track of invitation attribution and to understand how the Service is used.

Essential cookies — preserving invitation codes and language preference, maintaining a session. Required for the Service.
Analytics storage — page visit statistics and error diagnosis.

You can refuse cookies in your browser settings. Blocking essential cookies may prevent invitation rewards from being attributed correctly.

1010. Security measures

Technical — encryption in transit (HTTPS/TLS), encryption of sensitive data at rest, least-privilege access, intrusion prevention
Organisational — minimising the number of staff who handle personal data, regular training, an internal management plan, retention and review of access logs
Physical — access control at the facilities where data is stored

We never collect or store your private key or recovery phrase. No member of our staff will ever ask for it — any such request is an impersonation attempt. Do not respond, and please report it to us.

1111. Contact

We have appointed the following person to oversee personal data processing and handle complaints.

Data protection officer: (to be appointed)
Contact: privacy@digmol.com

Complaints about personal data handling may also be raised with a supervisory authority.

Singapore — Personal Data Protection Commission (PDPC), pdpc.gov.sg
Republic of Korea — Personal Information Dispute Mediation Committee, kopico.go.kr / 1833-6972
Republic of Korea — Privacy Infringement Report Centre, privacy.kisa.or.kr / 118

1212. Changes to this policy

This policy may be revised to reflect changes in law, policy or the Service. Changes and their effective date are announced in the app or on the website at least 7 days in advance. Where a change materially affects your rights, notice is given 30 days in advance and, where necessary, separate consent is obtained.