MonkMate Datenschutzerklärung

LEEDLAB (the "Company") lawfully processes and securely manages personal information in providing the MonkMate Service in order to protect the freedom and rights of data subjects. The Company discloses the following procedures and standards for personal information processing under Article 30 of the Personal Information Protection Act of the Republic of Korea. Additional information for users outside the Republic of Korea is in Section 12.

• Announced: October 10, 2026
• Effective date: October 17, 2026

Table of Contents

1. Covered Services and Where Personal Information Is Stored
2. Purpose of Processing, Collected Items, and Retention Period
3. Provision of Personal Information to Third Parties
4. Entrustment of Personal Information Processing
5. Overseas Transfer of Personal Information
6. Destruction Procedure and Method
7. Rights and Obligations of Data Subjects and How to Exercise Them
8. Measures to Ensure the Security of Personal Information
9. Installation, Operation, and Refusal of Automatic Collection Tools
10. Collection, Use, and Refusal of Behavioral Information (Advertising)
11. Children's Personal Information
12. Additional Information for Users Outside the Republic of Korea
13. Privacy Officer and Access Requests
14. Remedies for Infringement of Rights
15. Changes to This Privacy Policy

1. Covered Services and Where Personal Information Is Stored

This Privacy Policy applies to the following services provided by the Company.

• The MonkMate macOS app and its privileged helper
• The MonkMate iPhone app and its Screen Time extensions
• The MonkMate Chrome extension
• The MonkMate website (monkmate.pro) and service API (app.monkmate.pro)

The servers and database operated by the Company are located in the Republic of Korea (processor: SmileServe Co., Ltd.). Wherever you use the Service, personal information stored on the Company's servers, such as your account, focus history, and payment information, is processed in the Republic of Korea. Requests to the service API and website pass through Amazon Web Services CloudFront points of presence around the world and are delivered to the servers in the Republic of Korea over encrypted connections.

Much of your information, including the apps and websites you block, your Screen Time selections, and your session settings, is stored only on your device and is not sent to the Company's servers. The table in Section 2 shows where each item is stored.

2. Purpose of Processing, Collected Items, and Retention Period

The Company collects and uses the minimum personal information necessary to provide the Service.

If the purpose of processing changes, the Company will take the measures required under Article 18 of the Personal Information Protection Act.

However, the following information is retained according to applicable laws.

• Protection of Communications Secrets Act: website visit records and other communication confirmation data (3 months)
• Electronic Commerce Act: records on contracts or withdrawal of subscription (5 years)
• Electronic Commerce Act: records on payment and supply of goods or services (5 years)
• Electronic Commerce Act: records on consumer complaints or dispute handling (3 years)
• Electronic Commerce Act: records on labeling and advertising (6 months)

Membership Withdrawal and Long-Term Inactivity Policy

• Membership withdrawal is processed after the User confirms a verification code sent to the email address registered to the account. Any sealed Screen Time passcode vault must be released first.
• When withdrawal is requested, account use is blocked immediately, login tokens are revoked, and any active Paddle subscription is cancelled. App Store subscriptions must be cancelled by the User in their Apple account settings.
• The profile, login integration information, device registration information, focus records, block attempt statistics, Screen Time passcode vaults, and similar data of a withdrawn account are kept for 30 days from the withdrawal date to confirm mistaken withdrawals and respond to unauthorized use, and are then destroyed without delay. During this period, the User cannot sign up again with the same social account or email address, and the withdrawn account is not restored.
• For accounts with payment history, the email address, name, and profile image are removed after 30 days, and payment and refund records are kept separately for the period required by the Electronic Commerce Act.
• Blocked targets, sessions, helper state, and Keychain credentials stored on the User's device may need to be deleted by the User by deleting the app, deleting app data, or using the provided features.
• The Company does not automatically convert long-term inactive accounts to dormant status. If a separate operating policy becomes necessary, the Company will announce it in advance before applying it.

Sensitive Information, Pseudonymized Information, Automated Decisions, and Video Devices

• Sensitive information: The Company does not collect or process sensitive information.
• Pseudonymized information: The Company does not separately create or process pseudonymized information.
• Automated decisions: The Company does not operate automated decisions that have legal effects or similarly significant effects on data subjects.
• Fixed or mobile video information processing devices: The Company does not operate fixed or mobile video information processing devices.

3. Provision of Personal Information to Third Parties

In principle, the Company does not provide personal information of data subjects to outside parties. However, the Company provides personal information to the minimum extent only when the data subject consents or there is a legal basis.

The Company may provide personal information without consent within the scope set forth in Articles 17 and 18 of the Personal Information Protection Act, such as when urgent protection of life, body, or property is necessary under applicable laws.

4. Entrustment of Personal Information Processing

The Company entrusts personal information processing as follows for smooth service operation.

When entering into an entrustment agreement, the Company fulfills its management and supervision obligations over processors under Article 26 of the Personal Information Protection Act.

5. Overseas Transfer of Personal Information

The Company transfers personal information overseas (provision, entrusted processing, or storage) in the course of providing the Service, and provides the following information under Article 28-8 of the Personal Information Protection Act. All transfers take place when the Service is used, over TLS-encrypted connections. You may refuse an overseas transfer by contacting admin@monkmate.pro, in which case the related feature in the table below cannot be used.

6. Destruction Procedure and Method

The Company destroys personal information without delay when it is no longer necessary, such as when the retention period expires or the purpose of processing is achieved.

• Destruction procedure: Select the information to be destroyed when a reason for destruction occurs, and destroy it after internal approval
• Destruction method for electronic files: Delete using technical methods that make recovery impossible
• Destruction method for printed materials: Shred or incinerate

If retention is required by other laws, the information is stored separately and destroyed when the statutory period ends.

When a member withdraws, account use is blocked immediately, and identification information and service usage records are destroyed 30 days after the withdrawal date. Payment and refund records are stored separately under Section 2 and then destroyed.

Local data stored on the User's device may not be deleted automatically by withdrawal processing on the Company's servers. The User may delete local data by deleting the app, deleting app data, deleting Keychain items, or using deletion features provided by the Service.

7. Rights and Obligations of Data Subjects and How to Exercise Them

Data subjects may exercise the following rights against the Company at any time.

• Request access to personal information
• Request correction or deletion of personal information
• Request suspension of processing
• Withdraw consent
• Refuse or request an explanation of automated decisions, where applicable

These rights may be exercised by contacting admin@monkmate.pro, and the Company will act within 10 days in accordance with applicable laws. Membership withdrawal can be completed directly in the app.

Some rights may be restricted by law. The Company cannot directly access or delete local data stored only on the User's device, so it will explain how the User can delete that data.

8. Measures to Ensure the Security of Personal Information

The Company implements the following measures to protect personal information.

• Administrative measures: establishing and operating an internal management plan, minimizing access rights, conducting regular reviews
• Technical measures: encryption in transit (HTTPS/TLS) on every leg from the User's device to the Company's servers, servers that accept only requests passing through CloudFront, token lifetime and rotation policies, hashing of refresh tokens, verification codes, and device identifiers, AES-256-GCM encryption with separated keys for Screen Time passcodes, request rate limiting, security updates
• Operational measures: log monitoring, abnormal activity detection, failure response operations
• Local protection measures: storing credentials in the macOS Keychain and the iPhone App Group, storing blocked targets and session information on the User's device, checking helper permission state

9. Installation, Operation, and Refusal of Automatic Collection Tools

The Company uses cookies or similar technologies in providing the Service.

• Website (monkmate.pro): the strictly necessary cookie mm_consent (12 months), which remembers the cookie choice, is always used; cookies, browser storage, and a visitor ID for Channel Talk chat support are stored only when the User consents. Consent can be changed or withdrawn at any time under “Cookie Settings” at the bottom of the site; withdrawing ends chat support and deletes Channel Talk cookies. The Company does not use separate visitor analytics on the website. The iPhone App Store button goes through an AppsFlyer link (monkmate.onelink.me) to the App Store, and AppsFlyer collects the click information. If the website address carries a referring channel marker (ch), that value is added to the App Store button link and is not stored on the User's device.
• Service API: an authorization header and a checkout session cookie are used to keep users signed in, keep the checkout session, and prevent unauthorized use.
• macOS app: refresh token in the Keychain, blocked targets, sessions, onboarding, and notification state in UserDefaults, helper state, app version, device identifier hash
• iPhone app: login information, blocking settings, and session state in App Group storage, a device identifier value generated by the app, the Expo installation identifier, the AppsFlyer installation identifier, and the advertising identifier (IDFA, only if the User allows tracking)
• Outbound requests: when you add a website to block in the macOS app, the app connects directly to that website to show its title and icon, so the website operator can see your IP address. The blocked page loads icons of allowed websites from Google's icon service.
• How to refuse: block or delete cookies in browser settings, log out of the app, delete app data, delete Keychain items, or turn off tracking in iPhone Settings > Privacy & Security > Tracking
• Effect of refusal: some features such as staying signed in, session recovery, saving blocked targets, payment confirmation, and chat support may be restricted

Cookie setting methods for each browser can be checked through guidance pages provided by each browser provider.

10. Collection, Use, and Refusal of Behavioral Information (Advertising)

The Company shows Google AdMob ads to users of the iPhone app who use it for free. There are no ads for Pro users, in the macOS app, or in the Chrome extension.

• Who collects and processes behavioral information: Google LLC (collected directly by the AdMob SDK inside the iPhone app)
• Items: advertising identifier (IDFA), ad impressions and clicks, IP address, device and OS information
• Method: collected automatically when ads are shown while the app is in use
• Conditions for personalized ads: the advertising identifier is provided only if the User allows tracking in the iOS App Tracking Transparency prompt, and for users in the European Economic Area, the United Kingdom, and Switzerland, ads are requested only after consent is given in Google's consent form
• Information not used: the Company does not use your blocklists, focus history, or block attempt statistics for advertising and does not provide them to Google
• Retention: according to Google's policy. Nothing is stored on the Company's servers
• How to refuse: turn off tracking for MonkMate in iPhone Settings > Privacy & Security > Tracking, change consent under "Ad privacy choices" in the app settings, or remove ads with a Pro subscription

The Company uses AppsFlyer to measure which website, social media post, or ad led to an install of the iPhone app ("App install source measurement" in Section 2). This information is used only to analyze marketing performance, not for personalized ads, and the advertising identifier is passed to AppsFlyer only if the User allows tracking in the iOS App Tracking Transparency prompt. Choices that users in the European Economic Area, the United Kingdom, and Switzerland make in Google's consent form are also passed to AppsFlyer.

Access logs and error logs processed for service stabilization, security, and failure response are not used for advertising.

11. Children's Personal Information

MonkMate is not directed to children under 14, and the Company does not knowingly collect personal information from children under 14. Where the law of the User's country sets a higher age (for example, 16 in some countries of the European Economic Area), users under that age may not sign up or consent to personalized ads without the consent of a parent or legal guardian. If the Company learns that it has collected personal information from such a user, it will destroy it without delay. Parents and legal guardians may request access or deletion at admin@monkmate.pro.

12. Additional Information for Users Outside the Republic of Korea

Controller

LEEDLAB (리드랩), represented by Lee Dongjoo, Republic of Korea business registration number 225-04-68233, contact admin@monkmate.pro

Transfer to the Republic of Korea

Because the Company's servers are located in the Republic of Korea, personal information of users outside the Republic of Korea is transferred to and processed in the Republic of Korea (Section 1). The Company's processors process personal information in the countries listed in Sections 4 and 5.

Users in the European Economic Area, the United Kingdom, and Switzerland

• Legal bases (GDPR Article 6): providing the Service, including accounts, sync, and payments, is based on performance of a contract; security, rate limiting, error tracking, prevention of unauthorized use, internal operations notifications, and app install source measurement are based on the Company's legitimate interests; keeping tax and transaction records is based on legal obligations; and personalized ads and use of the advertising identifier are based on consent. You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.
• Transfer mechanisms: the European Commission and the UK Government have adopted adequacy decisions for the Republic of Korea. Transfers to processors in the United States and other countries rely on the processor's EU-U.S. Data Privacy Framework certification or Standard Contractual Clauses.
• Your rights: you have the right to access, rectify, erase, restrict processing, data portability, object to processing (including processing based on legitimate interests), and withdraw consent. The Company responds within one month of receiving a request. You may also lodge a complaint with the data protection supervisory authority in your country.

Users in the United States

• The Company does not sell personal information for money.
• Google AdMob personalized ads shown to free iPhone users may be considered "sharing" for targeted advertising under some state laws. You can opt out by turning off tracking in iPhone Settings or under "Ad privacy choices" in the app settings.
• You may request access, deletion, or correction at admin@monkmate.pro, and the Company does not discriminate against users for exercising their rights.

13. Privacy Officer and Access Requests

The Company operates the following contact channel to oversee personal information processing and handle inquiries from data subjects.

14. Remedies for Infringement of Rights

Data subjects may contact the following institutions for reports or consultation on personal information infringement.

• Personal Information Dispute Mediation Committee: 1833-6972, https://www.kopico.go.kr
• Privacy Infringement Report Center: 118, https://privacy.kisa.or.kr
• Supreme Prosecutors' Office: 1301, https://www.spo.go.kr
• Korean National Police Agency: 182, https://ecrm.cyber.go.kr
• Central Administrative Appeals Commission: 110, https://www.simpan.go.kr

Users outside the Republic of Korea may also lodge a complaint with the data protection supervisory authority in their country (EEA authorities: https://www.edpb.europa.eu/about-edpb/about-edpb/members_en, United Kingdom: https://ico.org.uk).

15. Changes to This Privacy Policy

This Privacy Policy applies from October 17, 2026. When the Company changes this Privacy Policy, it will announce the change on the website and in the app at least 7 days before it takes effect (30 days for changes that significantly affect Users' rights).

• Effective October 17, 2026: added the 30-day restriction on signing up again with the same social account or email address after withdrawal, coverage of the iPhone app and Chrome extension, server location (Republic of Korea), focus records, block attempt statistics, and Screen Time passcode vaults stored on servers, advertising (Google AdMob), app install source measurement (AppsFlyer), Paddle and Apple payments, entrustment to and overseas transfer for Expo, Slack, Channel Talk, AWS, and AppsFlyer, and information on children and users outside the Republic of Korea
• Effective October 9, 2026: added email-verified membership withdrawal, destruction after 30 days of retention, entrustment to Resend, website cookie consent, and entrustment to Channel Corp.
• Effective June 10, 2026: initial version

If access to a previous version is needed, a request may be submitted to admin@monkmate.pro.