Privacy Policy

When you sign up

Name, date of birth, phone number, and the email address (username) you choose

While you use the service

The subject, body, attachments and sender of email received at your address; replies you send; events, offer details and Instagram figures you enter (followers, reel views, saves)

When you talk with ritchi

What you send ritchi and ask it, what ritchi remembers from your chats (a profile such as what to call you, what you like, people who matter and your neighborhood, and stories from work and life), and your mood as read from your chats

When you allow notifications in the app

The device's push token, its type (iOS · Android) and the app version

Collected automatically

Access logs, device and browser details, usage records

We do not collect resident registration numbers or location. Instagram figures are only the ones you enter yourself.

Required

Verifying your identity and logging you in (including a human check against automated requests when you ask for a login code), issuing your email address and receiving mail

Required

Reading received mail to extract offer details and to make summaries, going-rate checks and reply drafts

Optional

ritchi's AI features (if you agree to the AI processing): answering chats and email questions, polishing reply drafts automatically or on request, sorting offer details from received mail, summarizing chats and organizing memory for later answers and what ritchi says when it reaches out

Optional

Sending notifications for new mail, replies and deadlines, and when ritchi reaches out (push notifications included)

You can sign up without agreeing to the optional items, and receiving mail, summaries, going rates and replies all work the same. If a purpose is added, we will ask for your consent separately.

Account details

Until you delete your account

Mail body, attachments, summaries

Until you delete your accountRaw files for receiving: up to 7 days

Chats with ritchi, what it remembers and your mood as read from your chats

Until you delete your account

Push tokens

Until you log out on that device or delete your account

Login and access logs

3 monthsBasis: Protection of Communications Secrets Act

When the period ends or the purpose is met, we destroy the information without delay. As the service is free, there is no duty to keep transaction records.

We do not give personal information to third parties.

The only exceptions are when you agree separately or a law specifically provides for it.

To provide the service, the company entrusts the processing of personal information as follows. Processors may not use it for anything beyond the work entrusted to them (the exception Cloudflare has published is set out below the table).

Servers and storage

Amazon Web Services, Inc. (AWS) · runs the infrastructure and stores data in the Seoul regionKept until the contract ends or you delete your account

Text messages

Twilio Inc. (Twilio Verify) · sends login codes by text and checks the code you enterKept until verification is complete (up to 10 minutes after the request). After that, Twilio keeps only the delivery record for its own retention period.

Stopping automated requests

Cloudflare, Inc. (Turnstile) · checks that a login code request comes from a personKept until the check is done. What Cloudflare uses to improve its own bot detection is set out below the table.

Receiving and sending mail

Amazon Web Services, Inc. (AWS SES) · receives mail sent to your address and sends repliesKept until the contract ends or you delete your account

Support mailbox

Google LLC (Google Workspace) · receives and answers inquiries to support@ritchi.meKept until the contract ends or the inquiry is closed

AI features

Anthropic, PBC (Claude API) · answers chats and email questions, polishes reply drafts automatically or on request, sorts offer details from received mail, summarizes chats and organizes memory, and writes what ritchi says when it reaches outDeleted within 30 days of receipt (up to 2 years for content flagged under its usage policy; safety classification scores for up to 7 years). Data may be retained longer if required by law. What it receives is not used to train AI.

Push notifications

650 Industries, Inc. (Expo) · registers the push token of a device that allowed notifications in the app and passes notifications on to Apple's and Google's push notification servicesNotification contents only until passed to Apple's and Google's push notification services (never stored in a database); push tokens under the processor's own retention

Cloudflare has published that it also uses the signals from the human check (the IP address you connect from and browser and device details) to improve its own bot detection. That part is a purpose Cloudflare sets for itself, not work we entrust, and Cloudflare keeps that data under its own retention.

If the work entrusted or the processors change, we publish it in this policy before the change.

Servers and storage are in Korea (Seoul). The personal information transferred abroad is what the tables below set out: your phone number when a login code is sent by text, the human check details when you request a login code, device details and notification contents for app notifications, and what ritchi's AI features use. If recipients are added or changed, we will update this policy before the change and notify you.

What is transferred

Phone number

Destination country

United States

When and how

When you request a login code, sent over an encrypted connection (HTTPS)

Recipient

Twilio Inc. · 101 Spear Street, San Francisco, CA, USA · privacy@twilio.com

Purpose and retention

Used only to send the code by text and check that it matches. The purpose ends once verification is complete (up to 10 minutes after the request), and Twilio keeps only the delivery record for its own retention period.

How to refuse

Tell us through our support channel and we will not transfer it. However, phone verification is how you log in, so if you refuse, you cannot log in or sign up.

What is transferred

The IP address you connect from, browser and device details (User-Agent, characteristics of the encrypted connection), and the address of the site that called the human check

Destination country

United States. Cloudflare stores data mainly in the United States and the European Economic Area and may access it from other countries where it operates.

When and how

When you request a login code, the human check widget on that screen sends it over an encrypted connection (HTTPS)

Recipient

Cloudflare, Inc. · 101 Townsend St., San Francisco, CA, USA · dpo@cloudflare.com

Purpose and retention

Used to stop automated requests (bots). The purpose we entrust ends once the check is done. Cloudflare has published that it also uses the same signals to improve its own bot detection; that part is a purpose Cloudflare sets for itself, and Cloudflare keeps the data under its own retention.

How to refuse

If you do not request a login code, nothing is transferred. However, the human check is a condition for sending the code, so if you refuse, you cannot log in or sign up.

What is transferred

The push token of a device that allowed notifications in the app (the one Apple or Google gave the device) and the app's installation ID; when a notification is sent, its title, body and the screen it opens

Destination country

United States

When and how

When you allow notifications in the app and when a notification is sent, over an encrypted connection (HTTPS)

Recipient

650 Industries, Inc. (Expo) · 624 University Ave FL1, Palo Alto, CA, USA · expo.dev/contact

Purpose and retention

Used only to deliver notifications to the device. Notification contents are kept only until passed to Apple's and Google's push notification services and never stored in a database. Expo keeps push tokens under its own retention.

How to refuse

Refuse when the app asks to allow notifications, and nothing is transferred. Once allowed, turning off ritchi notifications stops notification contents from being sent, and logging out on the device deletes its push token from our server. The service works the same without notifications.

What is transferred

What ritchi's AI features use: Received mail (sender name and email address, time received, subject, body and attachment file names), replies you have sent, chats and questions with ritchi, what ritchi remembers (moods and notes) and chat summaries, reply drafts you write or polish (including automatic polishing) and polishing instructions, your profile (name, rates, categories, conditions and Instagram statistics), ongoing offers, events, payments and your account's time zone. The phone number and verification codes from sign-up are never sent. What you write in chats and mail is sent as written; only numbers of 10 or more digits (such as account and card numbers) in the ritchi tab chat are masked. Phone-number formats and numbers separated by periods stay unmasked. Deleted memories are not sent.

Destination country

United States (Anthropic's storage). The computation that makes an answer may run in other countries Anthropic chooses.

When and how

After you agree to the AI processing: when you chat with ritchi or ask about mail, when reply drafts are polished automatically or on request, when offer details are sorted from mail received after consent, when chats and memory are summarized, and when ritchi reaches out first (at most once a day). Our server sends the data over an encrypted connection (HTTPS).

Recipient

Anthropic, PBC · 548 Market St, PMB 90375, San Francisco, CA, USA · privacy@anthropic.com

Purpose and retention

Used only to sort offer details from received mail, answer email questions, polish reply drafts, chat with ritchi and write what it says when it reaches out, summarize chats and organize memory. Anthropic deletes content within 30 days of receipt (up to 2 years for content flagged under its usage policy; safety classification scores for up to 7 years), unless law requires longer retention. It is not used to train AI. Under its contract with us, Anthropic protects personal information to at least the same level as this Privacy Policy.

How to refuse

If you do not agree to the AI processing, nothing is transferred to Anthropic. You can still use mail, the calendar and cards; only AI features are turned off. You can withdraw your consent at any time in Me > Settings > ritchi's AI, and nothing is transferred after that.

You can ask to see, correct or delete your personal information, or to stop its processing, at any time (Personal Information Protection Act, Article 35). Optional consents can be changed in Me > Settings, and you can delete your account right in the app.

To ask in writing, send the request form (Annex 8 of the Act's Enforcement Rule) to our support channel. Someone acting for you must also submit the power of attorney (Annex 11). You can also ask to see your information via the Personal Information Protection Commission's Personal Information Portal (privacy.go.kr).

People under 19 cannot sign up. We check the date of birth at sign-up and stop the sign-up there if you are under 19, so we never collect the personal information of children under 14.

When you delete your account, we revoke login access and delete the account, received mail bodies, summaries and going-rate checks, events, notifications, invites, chats with ritchi, what it remembers and your mood as read from your chats, and push tokens from the service. We also request deletion of stored raw mail and attachments and confirm the result. If storage has an outage, file deletion may take longer.

A deleted email address (username) is blocked from being used again.

Otherwise mail meant for the previous owner would reach whoever took it next. Records needed to confirm that files were deleted may be kept for as long as that confirmation takes.

Connections to the service are encrypted, and login codes waiting to be sent are stored encrypted. Access is limited per account, so no one can see another member's mail or calendar.

We use the cookies needed to keep you logged in and to check phone verification. We do not track you for advertising.

You can block cookies in your browser settings (Chrome: Settings > Privacy and security > Third-party cookies), but you will not stay logged in.

When this policy changes, we post the change and its effective date here first. It takes effect 7 days after posting; for important changes, such as what we collect or why, we announce them at least 30 days ahead.

2026-10-16: AI processing items, protection level and English version added (no change to the processing itself).

Privacy officer

Harim Choi (CEO)

Email

support@ritchi.me

Operator

ABZ Inc.

Representative

Harim Choi

Address

16F, DREAM PLUS Gangnam, 311 Gangnam-daero, Seocho-gu, Seoul, Republic of Korea

If you need to report an infringement of your personal information or get advice about one, you can contact these offices.

Personal Information Infringement Report Center

118 (no area code) · privacy.kisa.or.kr

Personal Information Dispute Mediation Committee

1833-6972 (no area code) · www.kopico.go.kr

Supreme Prosecutors' Office, Cyber Crime Unit

02-3480-3573 · www.spo.go.kr

Korean National Police Agency, Cyber Investigation Bureau

182 (no area code) · ecrm.police.go.kr