Bloffy Privacy Policy
- Announced: 2026-10-20
- Effective: 2026-10-20
Bloffy (the "Company", "we") complies with the Personal Information Protection Act (개인정보 보호법) and other applicable laws in providing the blogging service Bloffy (the "Service"), and processes users' personal information as follows.
1. Personal Information We Process and How We Collect It
1.1 Members
| Category | Items | When collected |
|---|---|---|
| Required | Email, password (stored encrypted in a form that cannot be recovered), name | Sign-up |
| Collected automatically | Access IP, browser information (User-Agent), device identifier, sign-in time and last-used time | Each time you sign in |
| Generated while using the Service | Posts and images the member has written, blog settings (blog name, address, languages, time zone, connected custom domain), the recipient's email entered when inviting a blog member | During use |
A member's name is shown publicly on the blog as the author of posts. Email is not shown publicly.
1.2 Blog Visitors (No Account)
Visitor analytics. To produce blog visitor analytics, we collect the following information when a page is opened.
- Page visited, referral source (referrer), campaign parameters (UTM), country, device type, operating system, browser type, time spent on the page
We do not store visitors' IP addresses or raw browser information in visitor analytics. To tell the same visitor apart within a single day, we store only a one-way encrypted value that cannot be reversed, made by mixing the IP and browser information with a random value that changes per blog and per day. This value becomes a different value the next day, so the same visitor cannot be tracked across days. Blogs do not set cookies or any other identifiers in the browser.
Server access logs. For security and incident response, our servers and delivery network record the IP address, browser information, requested address, and time of every request as access logs. These logs are kept separate from visitor analytics and are not used for analytics. The retention period follows 3.3.
1.3 Inquiries and Appeals
The sender's email address and the content of mail sent to trust@bloffy.co are used to handle inquiries and to respond to appeals against operator actions.
2. Purposes of Use
| Purpose | Items processed |
|---|---|
| Sign-up, identity verification, account management | Email, password, name |
| Providing the Service (writing and publishing blogs, inviting members, showing authors, providing analytics) | Posts, name, invitee email, visitor analytics |
| Security and abuse prevention (checking sign-ins from other devices, session management, preventing automated sign-ups, responding to security incidents) | Access IP, browser information, device identifier, sign-in records, server access logs |
| Service notices (email verification, password reset, notice of operator actions) | Email, name |
| Handling inquiries, reproducing failures, investigating and acting on violations of the Terms of Service | Inquiry mail, account and post information (see 9) |
| Usage analysis to improve the Service | Visit records of the introduction pages and workspace screens, and the member's internal ID when signed in (Google Analytics in 5) |
| Fulfilling legal obligations (retaining access logs, responding to lawful requests from investigative agencies) | Server access logs, account information |
3. Retention Period and Destruction
3.1 Principle
Once the purpose of processing is achieved, we destroy personal information without delay.
3.2 When a Member Deletes Their Account
| Target | Processing |
|---|---|
| Name and email | Replaced immediately upon deletion with values that cannot be recovered |
| Password, sign-in records (sessions), verification codes, preview links, sent invitations | Deleted immediately upon deletion |
| Blogs, posts, and images in workspaces the member administers | Made private immediately and deleted within 30 days (image files within a further 14 days at most) |
| Posts uploaded to other members' workspaces | Remain in accordance with Article 9 of the Terms of Service; the author is shown as "Deleted user" |
| Operator action records | Remain for the period in 3.3 below |
3.3 Retention Period by Item
| Item | Period |
|---|---|
| Staying signed in (session) | 30 days after last use, 90 days at most. Records of signed-out or expired sessions (including access IP and browser information) are kept for 3 months and then deleted |
| Server access logs (1.2) | 3 months |
| Email verification code / password reset code | 24 hours / 60 minutes |
| Preview links for unpublished posts | 24 hours after issue |
| Blog member invitations | 7 days (expire if not accepted) |
| Deleted posts (Trash) | Permanently deleted after 30 days |
| Daily aggregates of visitor analytics | Until the blog is deleted |
| Pseudonymized individual visit records (the one-way encrypted values in 1.2) | Retained for aggregation and analysis in a form that cannot identify individuals |
| Inquiry and appeal mail | 1 year after handling is complete |
| Operator action records (the target and reason of suspensions, post deletions, account deletion processing, operator access, and so on — including the affected member's email and name) | Kept for 1 year from the date of the action to respond to disputes and appeals, then deleted. These remain for this period even if the member deletes their account |
3.4 Retention Required by Law
Information that applicable law requires us to retain is kept for that period, separately from other information.
| Basis | Items | Period |
|---|---|---|
| Protection of Communications Secrets Act (통신비밀보호법) | Service access records (sign-in records, server access logs) | 3 months |
| Act on Consumer Protection in Electronic Commerce (전자상거래법) (once paid services are introduced) | Records of contracts and withdrawal of offers, records of payment and supply of services | 5 years |
| Act on Consumer Protection in Electronic Commerce (전자상거래법) (once paid services are introduced) | Records of consumer complaints and dispute handling | 3 years |
| Act on Consumer Protection in Electronic Commerce (전자상거래법) (once paid services are introduced) | Records of labeling and advertising | 6 months |
3.5 Method of Destruction
Electronic files are deleted in a way that cannot be recovered. Copies remaining in database backups disappear with them once the backup retention cycle (7 days at most) has passed.
4. Provision to Third Parties and Information Visible to Other Users
- We do not provide users' personal information to third parties. Exceptions are where the law specifically provides otherwise, or where an investigative agency requests it following the procedures set out in law.
- The following is visible to other users as a function of the Service.
- A member's name: shown publicly to blog visitors as the author of posts.
- Blog member invitations: the inviting member's name and the blog name are delivered to the invitee. The invitee's email is visible in that blog's member list until the invitation is accepted.
- Blog member list: blog members' names, emails, and roles are visible to that blog's admins and members.
5. Outsourcing of Processing and Transfers Abroad
To provide the Service, we entrust the processing of personal information to the following providers. Some of this processing takes place outside Korea.
| Provider | Entrusted work | Destination country | Items transferred | When and how transferred | Contact |
|---|---|---|---|---|---|
| Google LLC (Google Cloud) | Storing and operating servers, databases, and visitor analytics; retaining server request logs | Republic of Korea (Seoul region) | All Service data | Transmitted over the network when the Service is used | policies.google.com/privacy |
| Cloudflare, Inc. | Website delivery and security (CDN, access logs), image storage, custom domain connection, automated sign-up prevention (Turnstile), receiving and forwarding trust@ email | United States and worldwide | Access IP, browser information, uploaded images, connected domains, email sent to trust@ | Transmitted over the network when the Service is used | cloudflare.com/privacypolicy |
| Resend, Inc. | Sending Service email (verification, reset, invitations, operational notices) | United States | Email (including invitees' email), name, blog name | Transmitted over the network when email is sent | resend.com/legal/privacy-policy |
| Google LLC (Gmail) | Operating the trust@bloffy.co inbox | United States and elsewhere | Sender address and content of mail sent to trust@ | Forwarded when mail is received | policies.google.com/privacy |
| Google LLC (Google Analytics) | Usage analysis of Service screens | United States | Visit records of Service screens, cookie identifier, referral source, and the member's internal ID when signed in (email and name are not sent) | Transmitted over the network when Service screens are visited | policies.google.com/privacy |
- Retention period: until the outsourcing contract ends, or until the retention period in this Policy
- Google Analytics is not required. If you access from the EU, EEA, UK, or Switzerland, you can decline it in the consent banner on your first visit, and declining does not affect your use of the Service (see 6).
- The other providers are essential to providing the Service, so if you refuse the transfer you cannot use the Service. If you do not want your data transferred abroad, you can stop using the Service and delete your account.
6. Automatic Collection Devices (Cookies)
| Cookie | Where | Purpose | Duration |
|---|---|---|---|
session-token |
Workspace (bloffy.co) | Staying signed in | 90 days at most |
NEXT_LOCALE |
Workspace and introduction pages (bloffy.co) | Remembering your chosen display language | Until the browser is closed |
Google Analytics cookies (_ga and others) |
Workspace and introduction pages (bloffy.co) | Usage analysis | Per Google's policy |
- On blogs (
*.bloffy.blogand custom domains), we set no cookies. The delivery network provider (Cloudflare) may set cookies for security purposes. - On the sign-up, sign-in, and password reset screens, Cloudflare Turnstile runs to block automated sign-ups.
- If you access from the EU, EEA, UK, or Switzerland, you choose whether to allow or decline Google Analytics cookies in the consent banner on your first visit. Google Analytics does not run until you consent, and you can change your choice at any time under "Cookie settings" at the bottom of the page.
- You can refuse cookies in your browser settings. However, if you refuse
session-token, you cannot use features that require signing in.
7. Your Rights and How to Exercise Them
You may exercise the following rights at any time.
| Right | How |
|---|---|
| Access and correction | Check and edit your name and password in account settings |
| Reviewing and blocking sign-ins | Check the session list in account settings and sign out other devices |
| Deletion, suspension of processing, withdrawal of consent | Delete your account in account settings (see 3.2) |
| Other requests (changing your email, requesting a copy of your data, and so on) | Email trust@bloffy.co. After verifying your identity, we handle the request within 10 days; if we cannot handle it within that period, we tell you the reason and the expected completion date |
8. Children Under 14
The Service does not accept sign-ups from children under 14. If we learn that a child under 14 has signed up, we delete that account and its information without delay.
9. Operator Access to Personal Information
- Our operators can view members' email, name, blogs, posts, and sign-in records in the operator console. Only operators signed in from permitted locations can access the console.
- Operators may access a member's workspace with the same view as that member, to the extent necessary to handle inquiries, reproduce failures, or investigate violations of the Terms of Service. Each access is limited to 30 minutes, and the operator, time, and target account are kept in the operator action records (retention period in 3.3).
- Operators do not use information learned through this access for purposes other than those in paragraph 2, nor disclose it externally.
10. Security Measures
- Passwords are stored encrypted in a way that cannot be recovered. Verification codes and preview links are also stored as one-way encrypted values, not in their original form.
- All communication is encrypted (HTTPS).
- Servers and databases are placed on a private network that cannot be accessed directly from outside.
- The operator console can be accessed only from permitted locations, and operator actions are recorded.
- We keep the number of people with access to personal information to a minimum.
11. Privacy Officer and Handling of Grievances
| Category | Details |
|---|---|
| Privacy officer (개인정보 보호책임자) | Kiju Lee (이기주) |
| Grievances and access requests | trust@bloffy.co |
12. Remedies for Rights Infringement
You can report or consult about personal information infringement with the following agencies.
| Agency | Contact |
|---|---|
| Personal Information Infringement Report Center (개인정보침해 신고센터) | 118 · privacy.kisa.or.kr |
| Personal Information Dispute Mediation Committee (개인정보 분쟁조정위원회) | 1833-6972 · www.kopico.go.kr |
| Supreme Prosecutors' Office, Cyber Investigation Division (대검찰청 사이버수사과) | 1301 · www.spo.go.kr |
| Korean National Police Agency, Cyber Investigation Bureau (경찰청 사이버수사국) | 182 · ecrm.cyber.go.kr |
Users residing outside Korea may also report or consult with the personal information supervisory authority of their country of residence. Residents of the EU, EEA, and UK have the right to lodge a complaint with the supervisory authority where they reside.
13. Targeted Advertising and Location Information
We do not collect behavioral information for targeted advertising, and we do not process personal location information. The "country" in visitor analytics is estimated from the IP address only to the country level.
14. Changes to This Policy
If this Policy changes, we announce it in the Service at least 7 days before it takes effect. Changes that are significant to users' rights are announced at least 30 days in advance and notified individually at the sign-up email.
This Policy is written in Korean. Versions in other languages are translations provided to aid understanding; if a translation differs from the Korean version, the Korean version prevails.