Privacy Policy

Overview

GoldSaju ("we") runs CavePray (cavepray.com). This policy explains what personal information we collect, why, and the choices you have. We follow the Korean Personal Information Protection Act and, where it applies, the GDPR.

1. Information we collect

• Sign-in with Google: your name, email address, profile picture and locale. We request only the openid, email and profile scopes.
• What you create: rooms you open or join, room settings and decoration (pictures, music, video links), chat, letters and gifts, meditation time, your private journal, letters to yourself and intentions (visible only to you), cave habit records, transcriptions, mottos and wall drawings, aura (light) history, notification settings.
• Payments: payment status, order numbers and amounts. Card details are handled by our merchant of record, Polar; we never receive them.
• Age check (19+): your date of birth is used once to check your age before paying and is not stored; we keep only the time of the confirmation.
• Payouts (room keepers and hosts): payout account details and, for Korean withholding tax, your legal name, resident/alien/business registration number or passport/tax ID, and optionally an address.
• Questions and sessions: your questions, the answers and booking details.
• Organizations: organization name, member emails and attendance minutes.
• Support integrations: if a room keeper connects Buy Me a Coffee or Ko-fi, those services send us the supporter's name (when public), message and amount. We do not store supporter email addresses.
• Automatically: access logs, device/browser information and connection-quality metrics (network operator/ASN, country, latency), used only in aggregate.

2. Sensitive information and identification numbers

The tradition of a room and organization membership may reveal religious beliefs, which is sensitive information (PIPA Art. 23, GDPR Art. 9). We process it only with your separate, explicit consent and only to provide the rooms.

Identification numbers are collected only for withholding tax and payment statements required by the Korean Income Tax Act (Art. 164), with separate consent. They are encrypted (AES-GCM), shown only masked and accessed only to file payment statements.

3. Why we use it

• Signing you in and managing your account
• Providing rooms, invitations, organizations, memorial caves, cave habits and questions
• Payments, refunds, payouts, withholding tax and payment statements
• Notifications (in-app, web push, email) when you turn them on
• Handling reports, preventing abuse and keeping the service safe
• Improving quality with statistics that do not identify you

4. Use of Google user data

We use the name, email address and profile picture we receive from Google Sign-In only to sign you in, identify your account and show your name and picture in the app.

CavePray's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google user data, use it for advertising, or transfer it to others except as needed to provide the service; humans read it only with your consent, for security, or to comply with the law.

You can remove CavePray's access in your Google Account (Security → Third-party apps) at any time, and delete everything we hold with My rooms → Delete account.

5. How long we keep it

• Account and usage data: deleted without delay when you delete your account (backups within 30 days)
• Payment and refund records: 5 years (Korean e-commerce law)
• Payout and withholding records, including identification numbers: 5 years after the last payout (Framework Act on National Taxes Art. 85-3), even if the account is deleted
• Connection metrics: 45 days
• Visitors of public demo rooms: not stored

6. Service providers and international transfers

We use the providers below; some process data outside Korea. Transfers happen over the network as you use the service, under contracts and each provider's safeguards. You may refuse by deleting your account, but the service cannot work without them.

7. Sharing

We do not share personal information with third parties except with your consent or when required by law. Withholding records are filed with the Korean National Tax Service as the law requires.

8. Real-time connections and voice

People in the same room may connect directly (WebRTC), so their devices can see each other's IP address; otherwise Cloudflare relays the connection. Voice is never recorded or stored.

9. Cookies and browser storage

We use a session cookie (cp_session) to keep you signed in and a one-time cookie to secure sign-in. Preferences such as language and music are kept in your browser's localStorage.

To learn which pages are used, we use Google Analytics cookies (such as _ga). We do not use advertising, remarketing, Google signals or ad personalisation, and we strip invite codes, payment ids and room addresses before anything is sent. Operator pages are not measured.

To opt out, turn on Global Privacy Control (GPC) in your browser, block cookies, or use Google's opt-out add-on (tools.google.com/dlpage/gaoptout). The service works the same either way.

10. Your rights

You can access, correct, delete, restrict or withdraw consent at any time — edit in My rooms, delete your account there, or contact us and we will act without delay.

People under 14 may not sign up, and payments and support are for people aged 19 or older.

11. Security

• HTTPS everywhere
• Encryption of identification numbers and third-party tokens
• Session tokens stored only as hashes
• Restricted, audited admin access (including any export of identification numbers)
• Signed, verified webhooks

12. Privacy officer and contact

Privacy officer: GoldSaju · Contact: the contact link at the bottom of the site

13. Changes

Effective 2026-11-02. We announce changes in the service 7 days before they take effect (30 days for material or unfavourable changes).