Privacy Policy

1.Why personal information is processed

The operator processes the minimum personal information needed for the purposes below. It is not used for anything else, and if a purpose changes the operator will take the steps the law requires, such as asking for separate consent.

• Providing AI interpretation: writing the AI interpretation you request for the style reports.
• Providing the Instagram report: reading the posts you chose from your own account and writing a report on the picture your feed presents. It comes as a free basic reading and first look, and as a paid deep reading bought in the app.
• Confirming purchases: checking that a deep reading bought in the app was really paid for, and making sure one purchase is not used for many readings.
• Keeping the service stable and secure: managing access logs and processing records of AI requests (without their content), limiting excessive requests and daily usage, and responding to faults and misuse.
• Handling enquiries and rights requests: checking and answering enquiries sent by email or phone (refund requests included) and requests for access, correction, deletion or suspension of processing.

2.What is processed, and on what legal basis

3.What is stored only on your device

The following is stored only on your device. The operator's server holds no copy, and the operator cannot access it.

• Your answers and the state of any test in progress
• Records of the attention tasks (response times and accuracy, plus device details such as how you responded and the screen size), and drawings
• Finished reports. A report includes the AI interpretation if you received one, and an Instagram report includes small preview images and caption excerpts of the posts or images it cites as evidence, plus your account name when it was read from an export file or the Instagram Login connection.
• The fact that you passed the adult check, the time from which the check can be made again if a date of birth under the required age was entered, whether you allowed AI interpretation and when, your appearance (theme) and haptics settings, and whether you have already seen the introduction shown when the app is first opened. The date of birth itself is not stored.
• The categories and one-line description the AI assigned to each post when an Instagram report was made. They are kept for 7 days so that the same post is not sent twice, and no picture is stored. If you stop a reading part-way or leave the reading screen, the categories received in that reading are removed with it.
• Purchase details, if you bought a deep reading in the mobile app. The proof of the purchase a reading is running under (the transaction record the store signed, or the purchase token) and its transaction number are kept until the report arrives, so that the reading can carry on with that purchase after the app is closed and reopened and you can ask again if the result did not reach you. They are removed once the report is delivered or the purchase is closed or set aside. The transaction numbers of purchases the server would not accept, or that used up their attempts without a report being delivered, are kept, the 50 most recent at most, so that those purchases are not used again. Neither holds your name, email address or payment details.

It is kept in your device's browser or app storage (IndexedDB). The theme, a single marker of whether this device has any saved report or test in progress, and the time you went to request your Instagram export are kept in the browser's local storage. The deep reading purchase details are kept in the app's own preferences storage, inside the mobile app only, and never on the web. None of it appears on another device or browser, and it is deleted if you uninstall the app or clear this site's data in your browser.

In Settings you can take a copy of your reports, tests in progress and settings with “Export my data”, and remove your reports, tests in progress, adult confirmation and consent, settings, theme and language choice in one step with “Delete everything on this device”. The temporary store of post categories, the marker of whether this device has any saved report or test in progress, and the time you requested your Instagram export are cleared on the spot as well. Two things are handled differently. If a date of birth under the required age was entered and the time from which the check can be made again has not yet passed, that time stays until it passes. The deep reading purchase details are not removed by this function; they are removed at the times given above, or when you uninstall the app. “Save PDF” on a report also makes the file on this device and sends nothing of the report to the server. Files you export or save as PDF are yours to look after.

The mobile apps are set to keep this storage out of device backups (cloud backups included). Your reports therefore do not follow you when you change or restore a device; to move them, use “Export my data”. The deep reading purchase details, however, sit in the app's preferences storage, which this setting does not cover, so they can be included in a device backup.

4.Children under 14

The service is for adults only. In Korea that means 19 or over. It is not directed at children under 14, and the operator does not knowingly collect the personal information of children under 14.

Your age is checked once: the first time you start a test or the Instagram report, and before you consent to AI interpretation. You enter your date of birth on screen and your age is worked out on your device. The date you enter is not stored and is not sent to the operator.

If you are an adult, only the fact that you passed the check is stored, on your device. If the date of birth entered is under the required age, the service cannot be used, and only the time from which the check can be made again (10 minutes later) is stored on the device. That time is not sent to the operator either, and it is removed the next time the app is opened after it has passed.

If the operator learns that personal information of a child under 14 has been processed, it will delete it or take whatever other step is needed without delay.

5.How long personal information is kept

The payment for a deep reading is handled by the app store itself; the only thing the operator keeps about it is the purchase use record in the table above.

6.How personal information is destroyed

When a retention period ends or the purpose has been achieved and the personal information is no longer needed, the operator destroys it without delay.

• Content received for AI interpretation and the Instagram report (including the transaction record and purchase token received to confirm a deep reading purchase), and content read through the Instagram Login connection: processed in server memory only and never written to disk or a database. Nothing remains on the server after the result is returned.
• Rate-limit counter: carries an expiry time and is deleted automatically once the length of its limit window has passed since it was first written.
• Purchase use record: carries an expiry time and is deleted automatically after 400 days.
• Access logs, processing records of AI requests and enquiry records: deleted, in a way that cannot be recovered or restored, when the retention period ends.
• Information on your device: you delete it yourself in Settings.

Where another law requires personal information to be kept, the operator stores it separately from other personal information and states the legal basis, the items and the period in this policy.

7.Provision to third parties

The operator does not provide your personal information to third parties. It does not sell personal information, and does not use or provide it for advertising.

The entrusted processing and overseas transfer described below are arrangements under which a processor works on the operator's behalf. They are distinct from provision to a third party.

If you use the Instagram Login connection, you sign in and approve on the screen of Instagram (Meta Platforms, Inc.), and what Instagram processes in the course of that is governed by Instagram's own privacy policy. The operator does not provide your personal information to Instagram in the process. It only presents to Instagram the authorisation code and token that Instagram itself issued, in order to read the posts of your own account.

If you buy a deep reading in the app, the payment takes place on the app store's own screen, and what the app store processes in the course of that is governed by the app store's own privacy policy. The operator does not provide your personal information to the app store in the process. It only presents the purchase token the app store itself issued, with the app's identifier and the product ID, to that store's payment system, to confirm the order number and the purchase state and, where the store requires it, to report that the purchase has been used.

8.Additional use or provision

Not applicable. The operator does not use or provide personal information for any purpose other than the one it was collected for.

9.Processors (entrusted processing)

To provide the service, the operator entrusts the processing of personal information as follows.

When it concludes a processing agreement, the operator sets out in writing, as Article 26 of the Personal Information Protection Act requires, the ban on processing beyond the entrusted purpose, technical and managerial safeguards, limits on sub-processing, supervision of the processor, and liability including damages, and it supervises whether the processor handles personal information safely. Processors are required to protect personal information to a standard equal to or higher than this policy and the applicable law.

Sub-processing by Anthropic, PBC: Cloud infrastructure (Google Cloud Platform, Amazon Web Services, Microsoft Azure, worldwide) and traffic routing (Cloudflare); data is stored in the United States. The full list is at https://trust.anthropic.com/subprocessors.

If the entrusted work or a processor changes, the operator will publish the change in this policy without delay.

10.Overseas transfer of personal information

To provide the service, the operator entrusts the processing of personal information to recipients outside Korea as set out below, and gives the following notice under Article 28-8(2) of the Personal Information Protection Act.

For overseas transfers, the operator agrees the protective measures of Article 29-10 of the Enforcement Decree (security measures, and measures for handling complaints and resolving disputes) with the recipient in advance and reflects them in the contract.

11.Use of generative AI

AI interpretation in the service is written by generative artificial intelligence (AI). It is not written by a person and is not individually reviewed by a professional. To provide it, the operator uses an external generative AI service (the Claude API from Anthropic, PBC). The basic reading and the deep reading of the Instagram report use different models from the same provider, and what is passed on to the AI service provider is the same for both. The first look uses the same model as the deep reading and reads the chosen images and captions in one request.

• An AI interpretation can be wrong or may not fit you.
• Before sending posts for an Instagram report, please leave out any post that contains another person's personal information or sensitive content.
• Please report an interpretation that is inappropriate or wrong to contact@craving.win.

12.Sensitive information and whether it can become public

• Answers and results of the self-checks (your answers to questions about mood and attention, records of the attention tasks, drawings and scores) may count as information about health. They are calculated and stored only on your device and are not sent to the operator's server.
• The posts you choose for an Instagram report can reveal things about health, beliefs, political views, sex life and similar matters. Under Article 23(1)1 of the Personal Information Protection Act, the operator processes them only with a consent that is separate from consent to any other processing.
• The Instagram report is designed not to infer health or mental-health conditions, sexual orientation, race or ethnicity, religion, political views, income, intelligence, attachment style, anything about minors, or anything about other people who appear in your photos.
• Posts in which a minor, health, sex, mourning, alcohol or smoking, or words about self-harm are detected are not used as evidence for any interpretation, and posts about religion or politics are left out of interpretations about values. Of these, posts that show or name a minor, show a medical setting or carry words about self-harm are left out of every figure in the report, except that their posting dates count toward posting rhythm. To be detected at all, however, such posts are sent to the AI service at the coding step.
• A first look started directly, without coding (when you have fewer than 12 posts that can be sent), has no step that detects anything post by post, so the per-post exclusions above do not apply to it. Instead the AI is instructed not to write about health, the body or looks, age, relationships, beliefs, political views, origin, money or ability, or about anyone other than the account owner or about a minor, and before anything is shown its text goes through the same wording checks as a reading, with any statement that fails removed.
• A first look offered after coding, because too few posts could be read, leaves out the posts the coding step kept from every interpretation (those above in which a minor, health, sex, mourning, alcohol or smoking, words about self-harm and the like were detected). If words about self-harm were detected, no first look is offered, and help contacts are shown instead.

13.Security measures

The operator takes the following measures to process personal information safely.

• Nothing stored: the server handles content received for AI interpretation and the Instagram report in memory only and does not store it. There is no database of user records or reports.
• Encryption in transit: connections between your device and the server, and between the server and the AI service, are encrypted (TLS).
• No logging of request content: the scores, images, text and tokens you send are not written to server logs. For AI requests only the step, the outcome, the model, the time taken, token counts, the inference region and counts are recorded, and any value that is not a number or a short identifier-like word is removed before it is written. When an error occurs, only diagnostic details such as the kind of error and its code are recorded, and values that could carry request content, such as the error message, are not.
• Minimised before sending: images for the Instagram report are sent only after being downscaled and stripped of capture details and other metadata. If an image the server receives still carries metadata, the server re-encodes it to remove that before passing it to the AI service. Other accounts' names (@) in captions are masked on your device and once more on the server.
• IP address minimised for rate limiting: rate limiting uses a one-way hash in place of the IP address itself. Access logs do contain the IP address.
• No Instagram token stored: the access token received through the Instagram Login connection is not stored on the server. It is encrypted and left with your browser only, and is no longer accepted after 30 minutes.
• Purchase records minimised: once a deep reading purchase has been confirmed, only a one-way hash of the transaction number and a record of its use are kept; the transaction record and purchase token the app sends are not stored.
• Request limits: the number and size of requests are limited, and the total number of AI requests handled in a day is capped, to protect the server.
• AI inference region pinned and checked: every AI request names the United States as its inference region, the region each response reports is recorded, and a warning is logged if any other region appears.
• Kept out of device backups: the mobile apps are set to keep the storage that holds your reports out of device backups.

14.Pseudonymised information

Not applicable. The operator does not process pseudonymised information.

15.Cookies and similar technologies, and how to refuse them

The service uses only the two cookies below. Neither contains anything that identifies you.

Apart from cookies, browser storage is used as follows. Local storage holds your appearance (theme) setting and a single marker of whether this device has any saved report or test in progress (used to choose the opening screen). When you open Instagram's export page from the Instagram feed reading, the time you did so is kept as well, so that you can go straight to choosing the file when you come back (it says nothing about the account or the file, and it is removed once a file is read or after 7 days). Your answers, reports, settings, the records of the adult check and of consent, and the temporary store of post categories are kept in IndexedDB. Session storage is not used. In the mobile app, the deep reading purchase details are kept in the app's own preferences storage (What is stored only on your device). What is sent when you ask for an AI interpretation or an Instagram report (a deep reading's purchase proof included) is only what is listed under What is processed, and on what legal basis; none of the rest of this is sent to the server.

To refuse cookies, block or delete them in your browser settings. The service still works without them, although your language choice may not be remembered and an Instagram Login connection may not complete. “Delete everything on this device” in Settings also removes the language cookie.

The operator uses no advertising or analytics trackers. It does not collect online behavioural information and does not allow third parties to collect it.

To run the service, the operator's server counts how often a few things happen each day: arrivals at the website (a first page load coming from elsewhere), openings of the Instagram report's screen, finished readings and AI interpretations, deep-reading purchases and refund notices, feed readings that failed on the server, and requests turned away by the daily cap on free use. The counts are split only by app (per operating system) or web and by payment environment (real or test). They are plain numbers that distinguish no one: no IP address, device or browser identifier, transaction number or request content is used for them. They are kept in Upstash, Inc. and deleted automatically after 40 days. The operator receives the counts once a day, and is told straight away when a reading or AI interpretation is finished, a purchase completes, a feed reading fails on the server, a refund notice goes out or a daily cap is reached, and when a day's count reaches a set step such as 10, 50 or 100. These notices go to the Telegram messaging service and hold nothing beyond these numbers and categories.

16.Your rights and how to exercise them

As the data subject, you may at any time ask the operator for access to your personal information, for its correction or deletion, or for processing to be suspended, and you may withdraw consent.

If you believe someone else submitted your posts, see Opt-out and privacy requests for how to make a request.

17.Automated decisions

Not applicable. A report is reference information given to you. The operator does not use a fully automated system to process personal information in order to make decisions that significantly affect your rights or duties.

18.Privacy officer

The operator has designated the privacy officer below to take overall responsibility for the processing of personal information and to handle complaints and remedies relating to it.

You can take any privacy question, complaint or request for a remedy that arises from using the service to the privacy officer, and the operator will answer and act without delay.

19.Where to seek a remedy

To seek a remedy for an infringement of your personal information, you can apply to the bodies below in Korea for dispute resolution or advice.

20.Additional information for users in the EEA and the UK

When the operator processes the personal information of people in the European Economic Area (EEA) or the United Kingdom, the EU General Data Protection Regulation (Regulation (EU) 2016/679, the “GDPR”) or the UK GDPR and the Data Protection Act 2018 may apply. This section adds what those laws require to be stated, on top of the rest of this policy. For those users, where this section differs from another section, this section prevails.

Where processing rests on legitimate interests, the operator limits its effect on you: rate limiting uses a hash mixed with a secret value instead of your IP address, processing records leave out the content of requests, and retention periods are kept short. You may object to this processing at any time on grounds relating to your particular situation.

You are under no statutory or contractual obligation to provide personal information. What becomes unavailable if you do not consent or do not provide it is stated under “Your right to refuse” in What is processed, and on what legal basis.

Information is stored on or read from your device only where that is needed to provide a feature you asked for or to remember a setting you chose. No advertising or analytics cookies or trackers are used, so no cookie banner is shown. What is stored is listed under What is stored only on your device and Cookies and similar technologies, and how to refuse them.

The reports evaluate personal aspects automatically, from your answers or the posts you chose, so they may count as profiling under the GDPR. This happens only when you ask for it, its result is shown only to you, and it is not used to make any decision about you. The operator makes no automated decision that has legal or similarly significant effects on you (Article 22).

Retention periods are those stated under How long personal information is kept. The service is for adults only, so no processing to which Article 8 of the GDPR on children's consent applies takes place.

21.Information for users in the United States

The operator does not sell personal information, does not share or use it for targeted advertising, and uses no advertising or analytics trackers. Sensitive information processed for the Instagram report is used only to produce the report you asked for.

Where a US state privacy law applies to the operator, you may ask to access, correct or delete the personal information the operator processes, and you will not be treated less favourably for exercising your rights. Send a request to contact@craving.win yourself or through an authorised agent. If the operator declines a request it will tell you why, and you can appeal to the same address.

22.Users in other countries

If the law of the country where you live gives you rights this policy does not mention, you can exercise them at contact@craving.win, and the operator will handle the request under that law. Wherever you are, the operator processes personal information only as this policy describes.

23.Changes to this policy

This privacy policy applies from 16 November 2026.

If content is added, removed or revised, the operator will announce the change in the service before it takes effect and publish the previous policy alongside it so the two can be compared.

Changed on 16 November 2026: sections for users in the EEA and the UK, the United States and other countries were added.

Previous privacy policies: the version in force from 1 November 2026