Privacy Notice

1. Who is responsible and how to contact us

OrangeCheval is responsible for the processing described in this notice. For privacy questions, access requests, or deletion requests, email privacy@orangecheval.com.

2. Information we collect

• Account information. Your email address, authentication provider, account identifier, confirmation status, and account timestamps. We do not have access to passwords in readable form; credentials are securely hashed and processed by our authentication provider.
• Google sign-in information. If you continue with Google, Google provides your name, email address, profile image, and a stable Google account identifier through the standard OpenID Connect profile. We do not request access to Gmail, Google Drive, Google Contacts, calendars, files, or other Google service content.
• Apple sign-in information. If you continue with Apple, Apple provides your email address or an Apple private relay address and a stable Apple account identifier. The web OAuth flow does not provide your full name. We do not request access to iCloud, contacts, photos, files, or other Apple service content.
• Kakao sign-in information. If you log in with Kakao, Kakao provides your nickname, email address, profile image, and a stable Kakao account identifier through its standard login profile. We do not request access to your messages, friends, or other Kakao content.
• LINE sign-in information. If you log in with LINE, LINE provides your display name, email address, profile image, and a stable LINE account identifier through the standard OpenID Connect profile. We do not request access to your messages, friends, timeline, or other LINE content.
• Alert preferences. The markets and bag families or styles you choose, together with preference-update timestamps.
• Notification information. A browser push endpoint, encryption keys, browser or device user-agent information, delivery timestamps, and failure counts when you enable push notifications.
• Usage and technical information. Page views, referral and campaign information, bounded product events, error information, device and browser details, browser language preferences, network information, the country associated with your public IP address, and masked session replay. When you visit the bare domain, we use any explicit saved language choice first, then your browser language, and then the country code as a fallback to select a published site language. We also use the country code to suggest a storefront market, including an unsaved default during alert setup, without requesting your device’s precise location. Form inputs and visible page text are masked in replay, and recorded network URLs have query strings and fragments removed.

3. How we use information

• Create, authenticate, secure, and administer your account.
• Save your selected markets and bag preferences and send requested availability or test notifications.
• Operate, troubleshoot, protect, measure, and improve OrangeCheval.
• Prevent abuse, investigate errors, enforce our Terms of Use, and comply with legal obligations.
• Respond to support, privacy, and account-deletion requests.

4. Google, Apple, Kakao, and LINE sign-in data

OrangeCheval uses Google information only to create, secure, and sign you into your OrangeCheval account. It is not used for advertising, sold, or used to determine creditworthiness. We do not separately save Google access or refresh tokens in the OrangeCheval application database, and we do not request offline access.

Basic Google profile data is not sent to PostHog. After authentication, analytics may use an internal OrangeCheval account identifier; it does not receive your Google account identifier, email address, name, or profile image.

OrangeCheval’s use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements.

OrangeCheval uses Apple information only to create, secure, and sign you into your OrangeCheval account. It is not used for advertising, sold, or used to determine creditworthiness. We do not separately save Apple access or refresh tokens in the OrangeCheval application database.

Apple sign-in information is not sent to PostHog. After authentication, analytics may use an internal OrangeCheval account identifier; it does not receive your Apple account identifier or email address.

OrangeCheval uses Kakao information only to create, secure, and sign you into your OrangeCheval account. It is not used for advertising, sold, or used to determine creditworthiness. We request only the basic profile information and email configured for Kakao Login and do not separately save Kakao access or refresh tokens in the OrangeCheval application database.

Basic Kakao profile data is not sent to PostHog. After authentication, analytics may use an internal OrangeCheval account identifier; it does not receive your Kakao account identifier, email address, nickname, or profile image.

OrangeCheval uses LINE information only to create, secure, and sign you into your OrangeCheval account. It is not used for advertising, sold, or used to determine creditworthiness. We request only the OpenID Connect profile and email scopes and do not separately save LINE access or refresh tokens in the OrangeCheval application database.

Basic LINE profile data is not sent to PostHog. After authentication, analytics may use an internal OrangeCheval account identifier; it does not receive your LINE account identifier, email address, display name, or profile image.

5. When we share information

We do not sell personal information. We share information only as needed with service providers that process it for us, when you direct us to, to protect rights and safety, or when law requires it.

• Authentication and data hosting are currently provided by Supabase; Google, Apple, Kakao, and LINE process sign-in requests when you choose their respective login options.
• Website hosting, analytics, and performance measurement are provided by Vercel.
• Product analytics, error capture, and masked session replay are provided by PostHog US Cloud.
• Account email and notifications are delivered by Resend and the browser push services you enable.

6. Cookies and local storage

OrangeCheval and its providers use cookies, browser storage, and similar technologies for authentication, security, app installation, notification setup, remembering state, analytics, and performance measurement. When you choose a site language or stay on the current site after a language suggestion, OrangeCheval saves the locale in local storage until you clear it and in a first-party cookie for up to one year so future bare-domain visits can honor that choice. When you change the public storefront market shown on a bag page, OrangeCheval stores that choice on your device so it can preserve the relevant view. You can block or clear these technologies using browser or device settings, although blocking necessary storage may prevent account or notification features from working.

7. Retention and deletion

We keep account and preference information while your account is active. Unconfirmed accounts are scheduled for deletion after seven days. Operational, security, and analytics records may be kept for a limited period needed for the purposes above or as required by law.

You can permanently delete your account in the signed-in account settings or request deletion by emailing privacy@orangecheval.com from the address on the account. Account deletion removes the authentication account, stored bag preferences, selected markets, and saved push subscriptions. Limited security, operational, or analytics records may remain for the retention periods described above, and backups expire on provider schedules. You may separately disconnect OrangeCheval from your Google Account, Apple Account settings, Kakao Account connected services, or LINE’s Authorized apps settings at any time.

8. Your choices and rights

You may ask to access, correct, delete, or receive a copy of personal information, or object to or restrict certain processing. Available rights depend on where you live. You can disable push notifications in your browser or device settings, sign out, revoke Google access through your Google Account, stop using OrangeCheval through your Apple Account settings, disconnect OrangeCheval from your Kakao Account connected services, or revoke LINE access through LINE’s Authorized apps settings. We may need to verify your identity before completing a request.

9. International processing and security

OrangeCheval and its providers may process information in the United States and other countries. We use reasonable technical and organizational safeguards, but no online service can guarantee absolute security.

10. Children

OrangeCheval is not directed to children under 13, and we do not knowingly collect their personal information. Contact us if you believe a child has provided personal information.

11. Changes

We may update this notice as OrangeCheval changes. We will post the revised notice here, change the effective date, and provide additional notice when required. See the Terms of Use for the rules governing the service.