Privacy Policy

GA4 privacy amendment — advance notice

Google Analytics 4 is NOT ACTIVE. We propose adding optional analytics from Google LLC to understand page visits and ranking and share actions. This amendment is separate from the English translation published November 1, 2026, effective November 8, 2026.

Notice publication: November 6, 2026 Amendment effective date: December 7, 2026. We will give at least 30 days' advance notice from actual public publication before this amendment takes effect. Code changes and previews do not start that period. Collection also requires separate launch approval.

• Information and purpose: generalized page names, approved topic codes, and events such as starting or saving a ranking and tapping a share button. Google may also process device/browser information, approximate location and cookie-based identifiers. We would not send share tokens, nicknames, sign-in IDs, picks, custom text, full URLs, queries, hashes or referrers.
• Your choice: GA4 would remain off unless you choose "Allow". You could decline without losing ranking features and change your choice through "Analytics settings". GA4 may set first-party _ga cookies, normally lasting up to about two years; your consent choice would be stored locally. Withdrawal would stop further events; clearing site cookies removes existing identifiers. This choice would cover GA4 only—not AdSense, hosting cookies or Lovable analytics.
• International transfer: Google LLC would receive analytics information over the internet during opted-in visits for usage measurement. Processing may take place in the United States and elsewhere on Google's global infrastructure. See the Google Privacy Policy.
• Retention and settings: our configured event-data retention is 2 months; user-data retention is 14 months. Enhanced measurement and Google signals are OFF. These periods apply to covered event-level and user-level data, not necessarily aggregated reports. Google deletes eligible expired data on its processing schedule; identifier retention may reset with new activity if that option is enabled. The activity-reset and separate export settings remain unverified. See Google's retention explanation.

The existing policy continues to govern until the amendment takes effect. Questions: jibibiji@naver.com.

Overview

NweS (엔위에스) ("we" or "us"), based in the Republic of Korea, operates RANK YOUR TOP by OFF PLANET (the "service"). This policy explains what information the service handles, why, how long it's kept, who helps us process it, and the choices you have.

1. Information we handle

You can use the service without signing up. We don't ask for your name, email, or phone number. We do handle the following information, and some of it, such as IDs, IP addresses, and device details, can be personal information, especially when combined.

Information you give us

• Your rankings: the Top 5 you save for a topic (the official picks you chose and their order).
• Custom names: any pick you type in yourself that isn't on the official list (up to 24 characters).
• Result nickname: the nickname you enter when saving a result (2–12 characters). People who receive your result, invite, or comparison link can see it.
• Emails to us: if you email us, we receive your email address and whatever you include.

Information created when you use the service

• Anonymous account: when you start a ranking (for example, by picking your first option), the service automatically creates an anonymous account with a random user ID and a sign-in session.
• Sharing details: the random tokens used in result, invite, and comparison links, which invite (if any) you responded to, and when results were created or updated.

Information stored only in your browser

• Drafts: the picks, order, custom names, and nickname you're working on before you save. These stay in your browser and aren't sent to our servers until you save.

Information collected automatically by our providers

• Access logs: records kept on our hosting and database providers' systems when you visit, such as IP address, time of access, the address requested, and browser details.
• Visit analytics: pages visited, how you arrived (referrer), device and browser type, language, and an approximate country estimated from your time zone.
• Google AdSense code: Google may collect technical information directly, as described in section 4.

2. How we use information

• To save and restore your rankings and show your result pages
• To create share links and run invites and friend comparisons
• To show overall stats that don't identify anyone (such as how many people took part and how often each option was ranked)
• To understand how many people visit and improve the service
• To fix errors, keep the service secure, and prevent abuse
• To verify our site with Google AdSense and prepare for possibly showing ads in the future
• To respond to emails you send us

3. What's public

Result, invite, and comparison links can be opened by anyone who has the link. When you share one, the people who open it see the ranking, your result nickname, and any custom names in it. Nicknames aren't used in overall stats or search listings. Overall stats don't show information that identifies anyone, and custom names appear in stats only grouped together as "Other."

4. Cookies and browser storage

The OFF PLANET app itself doesn't currently set its own cookies. Your anonymous sign-in session and drafts are kept in your browser's local storage. The service uses these storage technologies:

• Local storage, anonymous session: saved once you start a ranking and kept until you sign out or clear your browser data.
• Local storage, drafts: your in-progress picks for each topic, removed when you save or clear your browser data.
• Session storage, scroll position: remembers where you were on a page when you navigate; cleared when you close the tab.
• Hosting cookies: a cookie that keeps serving you a consistent version of the site (about 24 hours), and a security cookie (__cf_bm, 30 minutes) set by our hosting network provider, Cloudflare, to tell people apart from automated bad traffic. These are needed to run the service and aren't used for advertising or tracking.
• Visit analytics: the analytics script may store a random session ID for up to 30 minutes to group a single visit. It doesn't track you across visits or build a profile.

Google AdSense: We don't currently show ads on the service, but Google AdSense code runs on our site to verify it and prepare for possibly using Google's ad services. Through this code, Google LLC may process technical information such as your IP address and browser and device details, and may use cookies or other identifiers. Whether this happens can depend on your setup and Google's settings. Learn more in how Google uses information from sites that use its services.

If we start showing ads, Google and other ad providers may use cookies and other identifiers to show ads based on your visits, and you can manage personalized ads in Google's My Ad Center. Before showing any ads, we'll review what information is actually processed and what notices or choices are required, and update this policy.

You can delete or block cookies and site data in your browser settings. If you block local storage, saving rankings and restoring drafts may not work.

5. Service providers

We use the following providers to run the service. They process information on our behalf to provide infrastructure, which is different from giving information to a third party for its own purposes.

• Supabase Pte. Ltd.: database and anonymous sign-in. Database location: Seoul, South Korea (Northeast Asia). (Supabase Privacy Policy)
• Lovable (Lovable Labs): hosting, deployment, and visit analytics. (Lovable Privacy Policy, list of subprocessors)
• Cloudflare: delivers the site over its network and provides security (blocking bad traffic) as a subprocessor of Lovable. We don't have a direct contract with Cloudflare.

6. When information is shared

We don't sell your personal information for money. Our service providers are listed in section 5. Separately, Google may collect or process technical information directly through the AdSense code, as explained in section 4. Some US state laws define "sale" or "sharing" broadly, and could treat that kind of third-party collection that way; see section 12. Otherwise, we don't give personal information to third parties unless required by law or in response to a valid legal request. When you send someone a share link, showing them your ranking is your choice.

7. How long we keep information

• Saved rankings, result nicknames, and custom names on our servers: kept until you delete them or the service ends. We don't set a fixed retention period.
• Anonymous accounts: not deleted automatically right now. Deleting a ranking doesn't delete the anonymous account itself. If this changes, we'll update this policy first.
• Browser drafts: stay on your device only, and are removed when you save the ranking or clear your browser data.
• Access logs and visit analytics: we don't keep separate access logs ourselves. Logs and analytics on our hosting and database providers' systems are kept for the periods set in each provider's own policies (see section 5), then deleted. We don't set those periods.

8. Deleting your results

• "Delete my result" works only in a browser that's signed in with the anonymous account that saved the result.
• Deleting removes the ranking and its five ranked picks together. The result, invite, and comparison pages based on it stop working, and the ranking is removed from overall stats.
• Having a share link doesn't prove you own a result, because the people you shared it with have the link too. If you can no longer use the browser that created a result, you can email us, but if we can't safely confirm it's yours, we can't delete it.

9. How we protect information

• Actions only an owner should take, like saving or deleting a ranking, are limited by sign-in checks, database access controls, and narrowly scoped functions.
• Result, invite, and comparison pages are designed to be viewable by anyone with the hard-to-guess random link.
• Public topic information and overall stats are available only through narrowly scoped, read-only functions.
• Connections are encrypted with HTTPS, and admin access is kept to the minimum needed.

No method of storage or transmission is completely secure, but we work to protect the information we handle.

10. Where information is processed

• Database: the service's core data (rankings, custom names, share tokens, and anonymous accounts) is stored in a database located in Seoul, South Korea (Northeast Asia). If you use the service from the United States or elsewhere, this means your information is transferred to and stored in South Korea.
• Hosting and analytics: when you visit, access logs and visit information are processed through our hosting provider's network and may be processed outside South Korea.
  • Recipients: Lovable (Lovable Labs) and its subprocessors, including Cloudflare
  • Information: IP address, time of access, address requested, browser and device details, visit analytics, and hosting cookies
  • Countries: pages are delivered through a hosting network spread around the world so they load from a location near you, so processing isn't limited to one country. Provider locations and processing countries are in each provider's policy and subprocessor list in section 5.
  • When and how: sent over the internet each time you visit
  • How long: for the periods set in each provider's own policies
  • If you don't want your information processed outside South Korea, you can stop using the service. We can't provide the service without this hosting.
• Google AdSense: we don't currently show ads, but Google AdSense verification code runs on our site.
  • Company: Google LLC
  • Information that may be processed: IP address, browser and device details, other technical access information, and cookies or other identifiers used by Google
  • Purpose: verifying our site with AdSense and running related services
  • When and how: may be sent over the internet when Google's code runs during your visit
  • Where: may be processed on Google's global infrastructure. See the Google Privacy Policy for where it's processed and how long it's kept.
  Before we show any ads, we'll review the companies involved, cookies and identifiers, international processing, and any required notices or consent, and update this policy.

11. Your choices and requests

• Delete your ranking: use "Delete my result" on the result page, in the browser where you saved it, at any time.
• Other requests: to ask to access, correct, delete, or stop processing other personal information, email us at the address below. Because the service uses anonymous accounts, we may not be able to confirm that the information you're asking about is yours. If we can't, we may not be able to complete the request, and we'll tell you why.
• In South Korea: you can also contact the Personal Information Infringement Report Center (118 within Korea) or the Personal Information Dispute Mediation Committee (1833-6972).

12. US state privacy rights

Depending on where you live, state privacy laws (such as California's) may give you rights to know what personal information is collected, to access, correct, or delete it, and to opt out of the "sale" or "sharing" of personal information or targeted advertising. These laws apply only to businesses that meet certain thresholds, and whether they apply to us depends on those requirements. Whether or not a specific law applies, you can send us any of these requests using the contact below, and we'll handle them as described in section 11, including the limits that come from anonymous accounts. We won't treat you differently for making a request.

The service doesn't currently respond to browser "Do Not Track" or Global Privacy Control signals itself.

13. Children

The service isn't intended for children under 13. We don't ask for age and don't verify it. If you believe a child under 13 has entered personal information on the service, such as in a nickname or custom name, please email us with the relevant link. We'll review it and may remove the content.

14. Changes to this policy

If we change this policy, we'll post a notice on the service 7 days before the change takes effect. For important changes, or changes that work against you (such as using information for new purposes, collecting new kinds of information, or adding international transfers), we'll give at least 30 days' notice, or longer if the law requires.

15. Contact

NweS (엔위에스), Operations Manager · jibibiji@naver.com

Version history

• October 17, 2026: original policy (in Korean) took effect.
• October 26, 2026: clarified that a Google AdSense site-verification script runs and that Google may process access information. No ads are shown.
• GA4 amendment: notice published November 6, 2026; effective date December 7, 2026. GA4 is not active.
• November 1, 2026: English translation published for US visitors, with added sections on US state privacy rights and children. Takes effect November 8, 2026; until then, the prior Korean policy applies.