Privacy Policy
Effective October 22, 2026
The short version
- You sign in with Apple, Google or an email link. We keep your email address, your birthday, your name if you give one, your profile photo if you add one, the people you pick and your records on our servers, so your account works on any device.
- Your profile photo is shown only to you. It is deleted with your account.
- No ads in the app and no data sales. We use analytics and error reports to improve the app. Unless you switch it off, we also share your sign-up and purchases with advertising partners so we can measure our own ads. We never send them what you write, your birthday or your photo.
- Purchases go through Apple. We never see your card. A service called RevenueCat tells us whether your purchase is active.
- You can download your data and delete your account in Settings. Questions: [email protected].
1. Who we are
At My Age is operated by Ailen (애일런), a business based in Seoul, Republic of Korea. This policy covers the At My Age app and the website at atmyage.app, which introduces the app, shows these pages and passes sign-in and invite links on to the app. When we say “we”, we mean Ailen. When we say “the app”, we mean the app and the website together.
2. Signing in
The app needs an account. There are no passwords. You can sign in three ways:
- Apple. Apple gives the app a signed token. Our server checks it and reads one thing from it: your email address. If you choose Apple’s “Hide My Email”, that is the private relay address Apple creates for you. Apple’s sign-in sheet may also offer to share your name; we do not read or store it.
- Google, where the app offers it. Google gives the app a signed token, which our server sends to Google to verify. We read your email address from it and nothing else.
- Email link. You type your email address and we send a link that works once and expires after 15 minutes. Tapping it opens atmyage.app, which hands the link to the app.
Each email address has one account, whichever way you sign in. After sign-in the app holds a session key on your device. With “Keep me signed in” on, it stays until you sign out or until it has gone unused for 90 days.
3. What we keep on our servers
This is saved to your account so that it is there when you sign in on any device:
| What | Why |
|---|---|
| Your email address, and which sign-in methods you have used (Apple, Google, email) | To recognise your account and to send sign-in links |
| Your birthday | To line your age up with theirs |
| Your name, if you add one | Shown in the app and on your cards |
| Your profile photo, if you add one: a small copy (256 pixels across) that the app makes on your phone. The original picture is not uploaded | Shown to you in the app on every device, and drawn onto your cards |
| The people you picked, including people set aside after Unlimited ended | Your timeline |
| Your records and plans: the date, the text you wrote, whether it is a plan, and when it was created and last changed | Your timeline, on every device |
| Your plan: Free or Unlimited, which product, its status, when it started and when it ends | To switch Unlimited on and off |
| Your invite code, whether you used a friend’s code and whose it was, how many reward months you have earned, and any gifted Unlimited time | To give invite rewards |
| When a shared card last opened an extra person for you | The seven-day unlock |
| When your account was created and last changed | Invite codes work only in an account’s first 14 days; keeping devices in step |
| Reports and requests you send us (section 9) | To fix the data and add people |
| A one-way ID (a scrambled, hashed form of your internal account ID), and your ad-sharing choices: whether you switched off ad sharing and, on iPhone, your answer to Apple’s tracking question | To use as your ID in analytics (section 5) and to obey your choices about advertising measurement (section 5A) |
Each account also has a random internal ID. We do not use what you write or save in the app (your records, plans, birthday, name and photo) for advertising or profiling, and we do not sell it. Sections 5 and 5A list the limited information that does go to analytics and advertising companies.
Analytics events. The app also records what you do in it, as short events, in an analytics service called PostHog (section 7). The events are: app opened; sign-in started and completed, and which method (Apple, Google or email); birthday set; person added or removed; view changed; an entry, a source link or a report opened or sent; record or plan saved, edited or deleted; card saved or shared; invite link shared or opened; the Unlimited screen shown, a plan chosen, a purchase started, completed, cancelled or failed; purchases restored; account deletion requested; and an error message shown. Each event carries only coarse details: your app version and platform, your plan (Free, or Unlimited and whether it was paid for or earned), how much you use the app (for example “new” or “regular”), an age range of ten years such as 30–39, counts such as how many people are on your timeline, the public figure’s ID, how you found the app (for example an invite link or an ad campaign) and your country, worked out from your IP address when the event arrives. Events use your one-way ID, not your name or email. We do not record your screen.
What we never put in analytics, error reports or notification tools (PostHog, Sentry, OneSignal): your email address or name; your profile photo; your birthday or exact age; anything you write in a record, plan, report or request, or the exact date of a record; sign-in links, one-time codes or session keys; invite codes; the price you paid; your precise location; your contacts or photos. Our code checks every event against a fixed list and discards anything that is not on it.
4. What stays on your device
- The picture you choose for your profile photo. The app shrinks it on your phone and uploads only the small copy (section 3); the original never leaves your photo library.
- A copy of your account data (birthday, name, profile photo, people, records), so the app opens quickly and can be read offline. Offline you can read; changes need a connection and are kept only after our server confirms them.
- A copy of a record you just deleted, for up to 30 days, so that “Undo” can bring it back.
- Your session key, your display choices (which columns are hidden, timeline view), and an invite code from a link you opened before signing in.
- Settings kept by the analytics and advertising tools inside the app: a random ID they make, events waiting to be sent, and your answer to the ad-sharing switch (section 5A). Signing out gives the analytics tool a new random ID.
Signing out or deleting your account clears your birthday, name, people, records and photo from the device.
Device permissions. The app needs no device permission to work, so there is no required permission. Three are optional: if you add a profile photo and choose “Take Photo”, your phone asks whether the app may use the camera; the app asks whether it may send you notifications (section 9); and on iPhone the app asks Apple’s question whether it may track you across other companies’ apps and websites (section 5A). Photos you pick from your library are handed to the app one at a time through your phone’s own picker; the app cannot browse your library. If you say no to any of these, everything else in the app keeps working.
5. Usage counts, analytics and logs
Anonymous tallies. The app counts a few actions so we can see what is used: app opened, person added, birthday set, record saved, card saved or shared, invite link copied or shared, and purchase started. Each count is sent to our own server and stored in Cloudflare’s Analytics Engine. A count can carry the public figure’s ID (for “person added”), an age range such as 25–34 (never your age or birthday), the plan you tapped, and whether you arrived through an invite link. It carries no account ID, no email, no device ID and no cookie, our code does not read or store your IP address for it, and it never includes what you wrote. We cannot tie a count to you.
Invite link openings. When the app opens an invite link before you have signed in, we add one to that code’s counter. To count each opening once, we keep a one-way scramble (hash) of your IP address combined with the code for 24 hours, then it is erased. We do not keep the IP address itself.
Server logs. Our servers run on Cloudflare. Like any host, Cloudflare processes your IP address and basic request details in order to deliver the app and the website and to keep them secure. Our own operational logs record errors and purchase status changes, which can include an account’s internal ID. Cloudflare keeps these logs for no more than seven days.
The website. The pages at atmyage.app use two tools to see how visitors find the app. Google Analytics 4 counts page views and taps on the App Store and Google Play buttons; we use none of Google’s advertising features. The Meta Pixel tells Meta about the same page views and button taps so we can measure our Meta ads. Both set cookies in your browser: _ga and _ga_… from Google (up to two years) and _fbp from Meta (90 days), plus _fbc if you arrived by tapping a Meta ad (90 days). They receive the page address without anything after a “?” or “#”, the site that referred you (its domain only), campaign tags such as utm_source, and the browser details and IP address that any website visit reveals. They never receive a sign-in link, an invite code or an account ID, because the website has no sign-in. The Meta Pixel is not loaded at all on sign-in and invite-link pages. Website analytics data is kept in Google Analytics for no longer than 14 months.
Do Not Track and Global Privacy Control. If your browser sends a Do Not Track or Global Privacy Control signal, the website does not load Google Analytics or the Meta Pixel for your visit, and treats it as your opt-out of advertising measurement (section 13). Browsers send these signals for websites only, so in the app use the choices described in section 5A.
Analytics and error tools in the app. These are PostHog (what people do in the app, section 3) and Sentry (errors and crashes), both listed in section 7. Sentry’s error reports contain the error, your app version, device model and operating system version, your platform and plan, and your one-way ID; our code removes email addresses, tokens and request contents before they leave your phone or our servers, and Sentry keeps them for about 90 days. Neither tool is used to follow you across other apps or websites. Advertising measurement is a separate matter, explained in section 5A. If we add another tool, we will name it here before it goes live.
5A. Advertising measurement
The app shows no ads. We do advertise At My Age on other companies’ platforms, for example on Meta (Facebook and Instagram). To learn whether an ad led someone to install the app, sign up or buy Unlimited, we use AppsFlyer, a measurement service that matches app installs and in-app events to the ad that led to them, and Meta, which receives the sign-up and the purchase so it can measure and improve our ads. Sharing information for this purpose is what California law calls “sharing” (section 13). It is not a sale.
| What is shared | With | When |
|---|---|---|
| That the app was installed, that you finished signing up (the first time you save your birthday), that you saved your first record (the fact only, never what you wrote) and that you bought Unlimited, each with its time; for a purchase, also the product, price and currency | AppsFlyer, and Meta for sign-up and purchase | Only if ad sharing is on for you (below) |
| Your phone’s advertising identifier: the IDFA on iPhone, the Google advertising ID on Android | AppsFlyer | On iPhone only if you tap Allow on Apple’s tracking question. On Android unless you have deleted your advertising ID |
| Your IP address, device model, operating system and app version | AppsFlyer; Meta (IP address and browser or app type, at sign-up only) | Same as above |
| A scrambled (hashed) form of your email address and of your internal account ID, sent from our server so Meta can match the sign-up or purchase to a Meta account | Meta | Same as above. On iPhone, never unless you allowed tracking |
We do not share your name, birthday, profile photo, records, plans, the people you picked or invite codes for advertising, and we do not share your age. Meta receives the hashed email address only from our server, never from your phone.
Where we ask first. If you are in the European Economic Area, the United Kingdom, Switzerland, South Korea, Japan, Brazil or Canada, or we cannot tell where you are, sharing for advertising measurement is off until you allow it in the app. The app asks once, after you save your first record, and until you tap Allow nothing listed in this section is sent to AppsFlyer or Meta. Our basis is your consent; you can withdraw it at any time in Settings, as easily as you gave it. Withdrawing does not affect what was sent before, and saying no changes nothing else in the app. Everywhere else, including the United States, sharing is on until you switch it off (below). On iPhone, in either case, nothing is sent unless you also tap Allow on Apple’s tracking question.
Your choices
- iPhone. The first time it matters, the app shows Apple’s question, “Allow At My Age to track your activity across other companies’ apps and websites?”. If you tap “Ask App Not to Track”, we do not give AppsFlyer your advertising identifier and we do not send Meta your hashed email address or ID. You can change your answer at any time in iOS Settings → Privacy & Security → Tracking.
- iPhone and Android. Settings → “Share purchase and sign-up with ad partners”. Switch it off and we stop sending your sign-up and purchases to AppsFlyer and Meta from then on. On Android, where there is no tracking question, it is on until you switch it off, except in the countries where we ask first (above), where it stays off until you allow it. On iPhone it only has an effect if you also allowed tracking.
- Android. You can also delete your advertising ID or opt out of ad personalisation in your phone’s settings (Settings → Privacy → Ads).
- Website. A Do Not Track or Global Privacy Control signal from your browser stops the website’s Google and Meta tools (section 5).
Switching off sharing does not call back what was already sent. Meta gives us no way to delete one person’s events sent through its Conversions API, and keeps event data under its own terms, currently for up to two years. Deleting your account (section 11) therefore does not remove them from Meta. For data held by AppsFlyer, email [email protected] and we will pass your deletion request on. Each company uses what it receives under its own privacy policy: AppsFlyer, Meta, and Google for the website.
6. Purchases
Unlimited is bought through Apple’s App Store with your Apple Account. Apple handles the payment under its own terms and privacy policy. We never receive your card details, your billing address or your Apple Account name.
To know whether a purchase is active we use RevenueCat, a service that talks to the App Store for us. The app tells RevenueCat your account’s random internal ID (not your email, name or birthday), and RevenueCat receives the purchase information from Apple: which product, when it was bought, when it renews or ends, and whether it was cancelled or refunded. Our server asks RevenueCat for that status and saves the result to your account (section 3). RevenueCat can also pass a purchase on to AppsFlyer for advertising measurement, under the rules in section 5A. RevenueCat’s software inside the app also receives some technical details on its own, such as your IP address, country, device model and operating system version, under RevenueCat’s privacy policy.
Subscriptions are managed and cancelled in your Apple settings, and refunds are requested from Apple. See the Terms of Service.
7. Other companies involved
| Who | Why | What they receive |
|---|---|---|
| Cloudflare | Runs our servers, database and the website; stores the anonymous tallies | Everything in sections 3 and 5, on our behalf; your IP address and request details as the host |
| Resend | Sends the sign-in email, and forwards your reports and requests to our support inbox | Your email address and the content of that email |
| Apple | Sign in with Apple; App Store purchases | Apple already knows who you are; we send Apple nothing about what you do in the app, except that for advertising measurement the app may give Apple’s own ad-attribution system (SKAdNetwork) a small anonymous code, such as “installed” or “bought”, with no account or device attached |
| Sign in with Google, where offered | The sign-in token Google itself issued, sent back to Google to be verified | |
| RevenueCat | Confirms App Store purchases (section 6) | Your account’s random internal ID and your purchase information |
| PostHog (United States) | Product analytics: which parts of the app are used, so we can improve it | The events and coarse details listed in section 3, under your one-way ID, and the country your IP address resolves to. Never your name, email, birthday, photo or anything you wrote |
| Sentry (United States) | Error and crash reports from the app and from our servers | The error, app version, device model and operating system version, platform and plan, and your one-way ID. Emails, tokens, request bodies and IP addresses are removed first. Kept about 90 days |
| Google Analytics 4 | Counts visits to the website and taps on the store buttons (section 5) | Page address without anything after “?” or “#”, referring site, campaign tags, cookies _ga and _ga_…, and the IP address and browser details of your visit, under Google’s privacy policy. Not loaded if your browser sends Do Not Track or Global Privacy Control |
| Meta | Measures our ads (section 5A): the Pixel on the website, and sign-up and purchase events sent from our server | Website: page views and store-button taps, cookies _fbp and _fbc, IP address and browser details. App: hashed email and ID, IP address and browser or app type at sign-up, the event, and for a purchase its price and currency, only as section 5A allows |
| AppsFlyer | Matches installs and in-app events to the ad that led to them (section 5A) | Advertising identifier (iPhone only if you allowed tracking), IP address, device model, operating system, app version, install time, your one-way ID, and the install, sign-up, first-record and purchase events |
| OneSignal | Delivers push notifications (section 9) | Your phone’s push token, your one-way ID, and a few settings such as your plan, whether you have saved a record and your platform. Never your name, email or what you wrote |
| Wikimedia Commons | The portraits shown for some people are bundled with the app; the credit links point to Wikimedia Commons | Only if you tap a credit link: your IP address and browser details. The app itself does not contact Wikimedia to show a portrait |
| Source links | Every entry links to its source (for example Wikipedia) | Only if you tap the link; the site you open has its own policy |
| Google Fonts | Loads the typeface on the website pages at atmyage.app. The app itself carries its font inside and does not contact Google for it | Your IP address and browser details, under Google’s privacy policy |
Except for Meta, AppsFlyer and Google Analytics, which measure advertising and website visits (sections 5 and 5A), these companies act for us or at your request. We do not sell your personal information. The limited information we share for advertising measurement is described in section 5A, and you can switch that off. Our database is hosted by Cloudflare in its Asia-Pacific region, and Cloudflare’s network handles requests from locations around the world.
8. Cards and invite links
Cards are images made on your device. Sharing or saving one is your choice. A card shows the ages and years, the other person’s name and entry, your name if you have added one (otherwise “You”), your record, your photo if you have added one, and the At My Age name (on the free plan, also the address atmyage.app). When you share through your phone’s share sheet, the app adds your invite link to the message, and the app you choose (Messages, Instagram and so on) handles it under its own policy.
Your invite link contains only your invite code, six random letters and numbers. It does not contain your name, email or birthday. When a friend uses your code, each of you gets the reward; neither of you is shown the other’s email address or name; the app shows you only how many reward months you have earned.
9. Reports, requests, email and notifications
When you send “Report incorrect info” or “Request a person”, we save what you wrote together with your account ID, and a copy is emailed to our support inbox with your account’s email address so that we can reply. Please do not put sensitive information in these messages.
The only email the app sends you is the sign-in link you ask for. We do not send marketing email. Notifications. The app can send you push notifications, for example a reminder to save a record. It asks your permission first, after you have saved your first record, and works the same without them. To deliver them we use OneSignal (section 7), which receives your phone’s push token, your one-way ID and a few settings about how you use the app. You can turn notifications off at any time in your phone’s settings (iPhone: Settings → Notifications → At My Age; Android: Settings → Apps → At My Age → Notifications) and in the app’s Settings.
Korea. If you are in the Republic of Korea, we send you notifications that promote the app or Unlimited only after you have given a separate consent to receive them, which you can withdraw at any time in the app’s Settings, and we never send them between 21:00 and 08:00 Korean time. Messages about your account or purchases are not promotions.
10. How long we keep it
- Your account and everything in section 3: until 30 days after you delete your account (section 11). We do not delete inactive accounts automatically.
- Records you delete: they disappear from the app right away and are permanently removed from our servers within 30 days (there is no undo after that). When your account is permanently deleted, any records still waiting are removed with it.
- Sign-in links: usable once, for 15 minutes; records of expired links are cleaned out periodically. We store only a one-way hash of the link, never the link itself.
- Sessions: ended when you sign out, or after 90 days without use.
- Short-lived counters that stop abuse (how many sign-in links an email address asked for, how many reports an account sent): one hour.
- Anonymous tallies: they are not personal data and are kept for about three months.
- Purchase records: the customer record RevenueCat holds for your account is kept until your account is permanently deleted, 30 days after you delete it, when we ask RevenueCat to delete it (section 11). Purchase and transaction records held by Apple are kept under Apple’s own policy; we cannot delete them. Apple is the seller, so we never receive your payment details or individual transaction records. The financial reports Apple sends us are totals that do not identify you, and we keep them for as long as accounting and tax law requires (in Korea, five years).
- Analytics, error and notification data: your profile and events in PostHog and OneSignal are deleted when your account is permanently deleted (section 11). Sentry error reports are kept about 90 days. Website visit data in Google Analytics is kept no longer than 14 months. Data already sent to Meta and AppsFlyer for advertising measurement stays with them under their policies (section 5A); Meta keeps event data for up to two years under its terms.
11. Downloading and deleting your data
Download. Settings → Download my data saves a file with your email address, birthday, name, the people on your timeline, all your records and your profile photo if you have one. The file is made on your device; you choose where it goes.
Delete. Settings → Delete account signs you out on every device and hides your account at once, and the copy on your device is cleared. If you sign in again with the same email (or the same Apple or Google account) within 30 days, your account comes back exactly as it was. After 30 days we permanently remove from our servers: your account (email, birthday, name, profile photo, people, plan and invite information), all your records including ones you had deleted earlier, your reports and requests, your sessions and any unused sign-in links (a clean-up runs once a day, so it can take up to a day longer). At that point we also ask RevenueCat to delete the customer record it holds under your account’s internal ID and delete your profile in PostHog and OneSignal, and, if you used Sign in with Apple, we revoke the app’s access to your Apple ID. If RevenueCat cannot be reached at that moment, your account is still deleted and we complete the RevenueCat deletion by hand. Once the 30 days have passed we cannot undo any of this; signing in after that starts a new, empty account.
What deleting your account does not do:
- It does not cancel a subscription. Cancel in your Apple settings first.
- It does not erase the purchase and transaction records Apple holds for your Apple Account; those are Apple’s, and we cannot delete them. Records we are required by law to keep are retained for the legally required period (section 10).
- It does not recall report or request emails that already reached our support inbox. Email us and we will delete them.
- It does not recall what was already sent to Meta and AppsFlyer for advertising measurement (section 5A). Meta gives us no way to delete one person’s events.
- The anonymous tallies stay, because they were never linked to you.
- Friends who joined with your code keep their reward. Their accounts keep your old internal ID as “invited by”, which no longer points to anyone.
If you cannot get into the app, you can ask for deletion by email at atmyage.app/delete-account: enter the email address of your account and we send a confirmation link to it. The link works once and expires in an hour. When you open it, your account is hidden at once and permanently deleted 30 days later, exactly as if you had deleted it in the app. If the email does not arrive, write to [email protected] from the address on your account.
12. Children
At My Age is for people aged 13 and over, or 14 and over in the Republic of Korea. The app checks the birthday you enter against the minimum for your device’s region. It is not directed at younger children and we do not knowingly collect personal information from them. If you are a parent or guardian and believe your child under 13 (under 14 in the Republic of Korea) has an account, email [email protected] from your own address with the subject “Child account”. We will delete the account and everything saved to it within 7 days and tell you when it is done. For a purchase made by a child, request a refund from Apple; we will help with whatever Apple asks of us.
13. Your rights and choices
In the app
You can see and change your birthday and name, replace or remove your profile photo, add and remove people, edit and delete records, download everything (section 11) and delete your account, all without asking us. Your email address cannot be changed in the app; email us if you need that.
California residents
Under the CCPA/CPRA you have the right to know what personal information we collect, to have it deleted or corrected, to opt out of its sale or sharing, and not to be discriminated against for exercising these rights. We do not sell personal information. When we give AppsFlyer and Meta your sign-up and purchase so we can measure our ads (section 5A), California law may treat that as “sharing” for cross-context behavioral advertising. In the past 12 months this covered identifiers (hashed email, hashed account ID, device and advertising identifiers, IP address), commercial information (purchases) and app activity (install, sign-up, first record). We do not use or share sensitive personal information for this.
Do Not Sell or Share My Personal Information. To opt out, switch off “Share purchase and sign-up with ad partners” in the app’s Settings, or email [email protected] from the address on your account with the subject “Do not sell or share”. On the website, your browser’s Global Privacy Control signal is treated as the same opt-out (section 5). We do not discriminate against you for opting out. For any other request, use the app’s own controls or email us from the address on your account, which is how we verify it.
Residents of the EEA, the United Kingdom and Switzerland
Our legal bases are: performing our contract with you (your account, saving and syncing your data, purchases, invite rewards), and our legitimate interests in keeping the service secure, preventing abuse and understanding in aggregate how the app is used (logs, counters and anonymous tallies). You have the rights of access, rectification, erasure, restriction, portability and objection, and the right to complain to your data protection authority. Ailen is in Korea and our providers operate in the United States and other countries, so your data is processed outside the country where you live. The app is currently offered outside the European Union and the United Kingdom; before we offer it there, we will put the required transfer safeguards and representative in place, ask for your consent before using advertising measurement or non-essential cookies on the website, and update this section.
Residents of Korea
You have the rights provided by the Personal Information Protection Act, including access, correction, deletion and suspension of processing. Use the contact below.
For any request we answer within 30 days.
14. Security
The app talks to our servers over HTTPS only. There are no passwords to leak. Session keys and sign-in links are stored on our servers only as one-way hashes, and sign-in links work once and expire in 15 minutes. Tokens from Apple and Google are verified on our server before an account is opened. Payments happen inside Apple’s systems. Our database is on access-controlled infrastructure. No system is perfectly secure.
15. Changes to this policy
When we change this policy we will post the new version here with a new effective date. If a change matters to you, for example a new kind of data, notifications or a new provider, we will also say so inside the app before it takes effect.
16. Contact
Ailen (애일런)
12 Teheran-ro 70-gil, #402-M355, Gangnam-gu, Seoul 06193, Republic of Korea
[email protected]