Privacy Policy
SosomLab (“we”, “us”, or “the Company”) complies with applicable data protection laws and maintains the following Privacy Policy to protect the personal information of users of SosomLab Notify (the “Service”).
1. Personal Information We Collect
The Service stores the following personal information on its server.
| Category | Items | When collected |
|---|---|---|
| Account information | Email address, sign-in method (email / Google), email verification status | At sign-up and sign-in |
| Password | Password (stored only as a non-reversible hash, never in its original form) | When you sign up with email or set/change a password |
| Google profile | Your Google account name and profile photo address | When you sign in with Google |
| Usage records | Total sign-in count, last sign-in time, account creation/update time, account status (administrator permission, suspension) | Generated automatically at sign-in and during account management |
| Device information | Push notification token (Expo Push Token), device platform (Android/iOS), token registration time | When you allow notifications after signing in |
| Email verification code | 6-digit verification code (stored as a hash, not in its original form), issue time, number of attempts | When you request sign-up, password reset, or account deletion |
If you do not allow notifications, no push notification token is collected; in that case you cannot receive messages from other users.
2. How Messages Are Processed
The Service lets users send notification messages to other users. Messages are processed as follows.
- Delivery path: The message title and body, the sender’s email address, and the recipients’ email addresses pass through our server and are handed to a push delivery service (Expo) and the operating system’s push service (Google FCM on Android, Apple APNs on iOS) in order to be delivered.
- Not stored on the server: Our server processes message content and recipient lists only to deliver them and does not save them in its database.
- Stored on your device: Received messages, sent messages (including per-recipient delivery status), and the list of addresses you recently exchanged messages with are stored only on your device.
- Sender shown: Recipients see the sender’s email address together with the message.
- Receipts (automatic): When a message arrives on a device, a “delivered” signal, and when the recipient opens it, a “read” signal, is automatically sent back to the sender together with the recipient’s email address and shown in the sender’s sent list. These signals travel the same path and are not stored on the server.
- Registration check: After sending, the sender’s device shows whether each recipient is registered with the Service and able to receive notifications.
3. Purpose of Collection and Use
- Identifying members, sign-in, and account management (including email verification, password reset, and account deletion confirmation)
- Delivering notification messages and receipt signals between users
- Checking account status (e.g., signing out deleted or suspended accounts) and preventing misuse
- Understanding how the Service is operated (sign-up and sign-in statistics) and responding to inquiries
4. Retention and Use Period
| Item | Retention |
|---|---|
| Account information, password hash, Google profile, usage records | Until you withdraw (delete your account) — destroyed without delay upon deletion |
| Push notification token and device information | Until you sign out on that device or delete your account |
| Email verification code | Valid for 10 minutes after issue; deleted once verified |
| Message content and recipient lists | Not retained on the server (processing ends once delivery is handed off) |
| Messages and sent list stored on your device | Until you delete them in the app, delete your account in the app, or uninstall the app |
- Uninstalling the app by itself does not delete your account information or push notification token from the server. To delete server data as well, delete your account using the methods in Section 6.
- Where retention is required by applicable law, we retain the information for the period prescribed by that law.
5. Provision to Third Parties
We do not provide your personal information to external parties beyond the scope disclosed in this policy, except in the following cases:
- When you send a message, the sender’s email address and the message are delivered to the recipients as the essential function of the Service (see Section 2)
- When you have given prior consent
- When required by law, or by lawful procedure for investigative purposes
6. Your Rights and How to Exercise Them
You may at any time request access to, correction of, deletion of, or suspension of processing of your personal information. We will take the necessary action without delay.
- Delete your account in the app: Profile → Delete account. Your account information and the push notification tokens of all your devices are deleted from the server, and the received messages and sent list stored on that device are deleted as well. Other signed-in devices are signed out automatically.
- Delete your account on the web (without the app): On the account deletion page, enter your registered email address and the confirmation code sent to that address; your account information and push notification tokens are then deleted from the server. Messages stored on a device are deleted when you uninstall the app.
- Change your password: In the app’s Profile screen.
- Other requests: Contact us at the address in Section 10.
7. Outsourcing and Overseas Transfer of Processing
We entrust the following processing to service providers in order to provide the Service, and this involves transferring personal information overseas. Transfers take place over the network whenever the Service is used, and each provider processes the information for as long as needed to perform the entrusted task (until the contract ends or you withdraw).
| Provider | Entrusted task | Items transferred | Country |
|---|---|---|---|
| Cloudflare, Inc. | Running the Service’s server and storing account information and push notification tokens | The server-stored items in Section 1, and messages in transit | United States and other countries where Cloudflare operates data centers |
| Resend (Plus Five Five, Inc.) | Sending service emails such as verification codes | Email address, verification code | United States |
| Google LLC | Google sign-in; delivering push notifications on Android (FCM) | Google account email, name, and profile photo; push notification token; messages | United States |
| Expo (650 Industries, Inc.) | Relaying push notifications | Push notification token; messages (title, body, sender email) and receipt signals | United States |
| Apple Inc. | Delivering push notifications on iOS devices (APNs) | Push notification token; messages | United States |
If you do not want your information transferred overseas, you may stop using the Service and delete your account. Because this processing is essential to providing the Service, the Service cannot be used if you refuse the transfer.
8. Destruction of Personal Information
Personal information for which a reason for destruction has arisen is destroyed safely so that it cannot be recovered or reproduced. Information in electronic file form is deleted using technical methods that render it unrecoverable.
9. Security Measures
We implement reasonable technical and administrative safeguards to protect personal information, including:
- Encryption of data in transit (HTTPS)
- Storing passwords and email verification codes only as hashes, never in their original form
- Access control: member information (email address, sign-up and sign-in times, etc.) can be viewed only by operators who have been granted permission to run the Service
10. Privacy Officer and Contact
For inquiries, complaints, or remedies relating to the processing of personal information, please contact:
- Email: [email protected]
11. Notice of Changes
If this Privacy Policy is supplemented, deleted, or amended, we will provide notice through the in-app notice or this page at least 7 days before the changes take effect.
Revision History
- 2026-10-12: Revised to describe all of the information we actually process.
- Added collected items: password (as a hash), Google profile name and photo, usage records such as sign-in count and times, device platform, and email verification codes
- New Section 2 on message processing: messages are not kept on the server and are stored only on your device; “delivered” and “read” receipts are sent to the sender automatically
- Completed the list of processors and overseas transfers: Cloudflare, Resend, Google (sign-in, FCM), Expo, and Apple (APNs), with their tasks, items, and countries
- Corrected when push notification tokens are deleted: on sign-out or account deletion, not automatically on app uninstall
- Added how to delete your account: the in-app menu and the web account deletion page