Drift LetterDRIFT LETTER · JC STUDIO

PRIVACY

Privacy Policy

Effective: October 25, 2026 · Operator: JC Studio

Your letters and bottle records are stored only on your phone and are not sent to our servers. When ocean data is downloaded, the rough area of sea around your bottle is passed to public ocean data servers. Usage statistics, ads and payment services handle limited technical information separately. The text of your letters is never sent to any server.

1. Scope and contact

This policy applies to the Drift Letter app provided by JC Studio and to this information and support website. Questions about privacy and requests to exercise your rights can be sent to whdcjf8172@gmail.com.

2. Information processed on your device

Letters and bottles
The letters you write, the bottle colour you pick, the beach and time each bottle was sent from, the hour-by-hour positions of its drift, the sea’s log (current, wind, water temperature and distance for each day) and where the bottle came ashore are saved on your device. They are used to move your bottles and to let you open your letters again.
Your beach and drawer
Your chosen beach, the lighthouse keeper’s bottles that wash up on it and the bottles you keep in your drawer, the number of bottles you have sent that day, your language setting, and whether you own Premium (a copy of the result confirmed with the store) are stored.
Copies of ocean data
So that the same current, wind and water-temperature data is not downloaded again on the same day, up to the 16 most recent batches are kept on your device. This data is not linked to your letters.

There is no sign-up or login, and the app has no fields asking for your name or contact details. If a letter contains text that looks like a phone number, email address, postal address or link, the app will not let you seal it. The app does not request location permission; you choose your beach yourself from a list. It does not request access to the camera, microphone or contacts either. The current version of Drift Letter is a solo version: your letters are not sent to other people or uploaded to any server.

3. When ocean data and fonts are downloaded

To move your bottles and draw the sea on screen, the app downloads data from public servers. While handling these requests, each server may process your device’s IP address and the time and address of the request; how long this is kept follows each organisation’s own policies.

These requests never include the text of your letters, your installation identifier or your advertising ID. However, because the request contains the area of sea near your beach, please be aware that it could suggest the rough region where your beach is. The only addresses the app fetches data from on the screen’s behalf are the three data server addresses above (ncss.hycom.org, tds.hycom.org and pae-paha.pacioos.hawaii.edu).

4. Usage statistics

To understand how many people use the app and how often it is opened, the public mobile app sends the following minimal information to our Supabase server. It is used to run the service and analyse usage, not to analyse your letters or your interests for advertising.

The installation identifier is created separately from any account or advertising ID, but because it can link usage records from the same installation, we do not describe it as fully anonymous. Letters, bottles, beaches, position records, advertising ID and purchase information are not included in these statistics. We do not store IP addresses in the analytics database, but technical information may be processed in Supabase’s access and security logs. Our private Telegram admin summary receives only aggregate numbers, never installation identifiers or personal records.

Retention: Raw per-launch records are kept for 7 days, daily per-installation summaries for 180 days, and basic installation information for 365 days after last use. Temporary counters used for rate limiting are kept for 1 day. Data past these periods is cleaned up daily, so it may remain until the next cleanup runs.

Stopping and deleting: Turn off Usage statistics in the app’s Settings to stop further collection. Information already sent is not deleted automatically; choose Delete my statistics to delete the server records linked to this installation, after which sending stays off. A separate secret token used to verify deletion requests is stored on your device, and only a hash of it is stored on the server for verification. If deletion fails, the app asks you to try again.

Uninstalling the app, clearing its data or resetting your phone does not immediately delete server records. If the previous installation number or deletion credential can no longer be verified, we may be unable to find and delete those records. The retention periods above still apply.

Blocking late requests after deletion: So that deleted statistics are not recreated by a request that arrives late, only the SHA-256 hash of the deletion token and the time of deletion are kept, separately from installation information, for 7 days. This deletion record contains no installation identifier, letters or launch counts, and it is removed by the daily cleanup after 7 days.

5. Ads and privacy choices

The app shows a banner ad at the very bottom of the screen and a rewarded ad that plays only when you choose it (to send one more bottle after the day’s free bottle, up to twice a day). It does not show interstitial (full-screen) ads. If you own Drift Letter Premium, ads are not requested or shown. The Google Mobile Ads SDK and its consent management tools may collect or share the following information to deliver and measure ads, analyse usage, manage privacy choices and prevent fraud.

The text of your letters, your beach and your bottles’ positions are never included in ad requests. Ad requests are limited to content rated PG. In regions where consent is required, the app requests personalised or non-personalised ads according to your choice; elsewhere it may request personalised ads. If your choice cannot be read, it requests non-personalised ads. Even if the advertising ID is removed or you choose non-personalised ads, some processing needed to deliver ads and keep them secure may continue. Retention and deletion of ad information follow Google’s policies and your device and account choices.

In regions where it is required, Google’s consent message is shown first, and the ads SDK is initialised and ads are requested only when ad requests are allowed. You can reopen the choices from Ad privacy settings in the app’s Settings; this item appears only when needed, depending on your region and Google’s consent status. You can also reset or delete your advertising ID in Android settings.

6. Premium purchase

Drift Letter Premium is a one-time lifetime purchase sold through Google Play billing; it is not a subscription. To process purchases, restore them and check purchase status, the app uses Google Play billing and RevenueCat. In doing so, a random app user ID created for each installation by the RevenueCat SDK, the identifiers of the product and transaction, and the purchase time and status are processed. Payment details such as card numbers are handled by Google; we never receive them. Your letters and bottle records are not sent to payment services.

When a purchase is made, RevenueCat may send the purchase event (anonymous app user ID, product, amount and currency, country) to our Supabase server for revenue reporting. Purchase records are kept under Google Play’s and RevenueCat’s policies to allow restoring purchases and handling refunds, and they are not deleted when you clear the app’s data or uninstall it.

7. Support email and website visits

Support email: When you contact us, we handle your email address, what you write and any attachments in order to solve the problem and reply. Please send only what is needed. Once your inquiry has been handled, information we no longer need is deleted; if the law requires us to keep it, it is kept only to the extent and for the period required. Email is handled through Google’s Gmail service.

This website: This site uses no ads, analytics scripts, forms, logins or cookies of its own. Cloudflare, which delivers and secures the site, may process your IP address, the requested address and time, browser information and security-related technical information when you visit. Letters and records from the app are never passed to this website.

8. Service providers and processing abroad

The following providers process information as needed to run the app and support. Related information may be processed outside your country of residence, for example in the United States. The text of your letters is never passed to these providers.

Supabase
Server, database and access security for usage statistics. The database is located in the Seoul region of the Republic of Korea, but processing abroad may occur through globally routed APIs and service operations. The items and retention are described in section 4. Supabase Privacy Policy
Google
AdMob ad delivery, measurement, fraud prevention and privacy choices; Google Play billing; font delivery through Google Fonts; and support email through Gmail. Retention follows each Google service’s policies. Google Privacy Policy · How Google uses information from ads
RevenueCat
Confirming and restoring Premium purchases and managing purchase status. The information in section 6 is sent over HTTPS and kept under RevenueCat’s policy. RevenueCat Privacy Policy
HYCOM data servers · PacIOOS
Current, wind, water-temperature and wave data (public ocean data). Technical information such as your IP address may be processed when they receive the requests described in section 3, and it is kept under each organisation’s policies. These are not contractors working for us under a processing agreement; they are the organisations whose public data the app downloads.
jsDelivr
Delivery of the screen font files (Pretendard). Technical information such as your IP address may be processed with each request. jsDelivr Privacy Policy
Cloudflare
Delivery and security of this public information website. Cloudflare Privacy Policy

International transfers of personal information

JC Studio is based in the Republic of Korea. Depending on where you live, the information above may be processed in Korea, the United States or other countries outside your own.

The recipients and items of personal information transferred abroad are listed below. In every case, the information is sent over an encrypted connection (HTTPS) each time you use the relevant feature.

If you do not want your information transferred abroad, you can choose not to use the relevant feature or uninstall the app. Ocean data and fonts are needed for the app’s main screens, so these transfers happen while you use the app. You can turn off usage statistics in the app’s Settings, ad privacy choices work as described in section 5, and if you own Premium, ads are not requested.

9. Retention, deletion and your rights

Records on your device: Clearing Drift Letter’s app data in Android settings or uninstalling the app removes all letters, bottles, your drawer and your settings. Deleting device records does not delete usage statistics already sent to the server, so it is best to use Delete my statistics first. Step-by-step instructions are on the Support page.

Backup and transfer: Drift Letter is set not to use Android’s automatic app data backup. We cannot view or recover letters stored only on your device.

Other information: Usage statistics follow section 4; ad information follows Google’s policies and your choices; technical information from ocean data, font and website requests follows each organisation’s policies; support emails are kept for as long as needed to handle the inquiry. Deleting usage statistics does not also delete Google ad records or support emails.

Under applicable law, you may request access to, correction or deletion of your personal information, or suspension of its processing, or withdraw your consent. We may ask for the minimum information needed to find the records and to confirm that you are the person concerned or their authorised representative. Depending on where you live, you may also have the right to object to certain processing and to lodge a complaint with your local data protection authority. The app has no member accounts, so there is no separate account deletion procedure.

10. Security and children

We use HTTPS/TLS for server communication and for this site, and limit server access to what is necessary. Letters stored on your device are not encrypted by the app itself, so please also keep your phone’s screen lock on. No method of storage or transmission is completely secure.

This app is not designed for children. If a parent or guardian finds a problem with how a child’s personal information is handled, please contact the support email.

11. Privacy officer and remedies

Privacy officer
Name: Jongcheol Lee (owner)
Email: whdcjf8172@gmail.com

We reply to access, correction, deletion and suspension requests sent to the email above within 10 days.

Remedies
For advice on or reports of privacy infringement, you can also contact these Korean agencies.

12. Changes and contact

We update this policy and its date when features, providers or relevant laws change. If there is an important change in how personal information is handled, such as a feature for exchanging letters with other people, we will let you know in advance through the app, the store or this website, and ask for additional consent where required.

Operator and privacy contact: JC Studio
Email: whdcjf8172@gmail.com

Revision history