Privacy policy

Records on your device

Hobocode stores note text, categories, place names and addresses you enter, saved coordinates, creation and edit times, selected photo copies and storage identifiers in app-private storage on this iPhone. Drafts, recovery inputs and trash are kept in the same place. Drafts and recovery inputs help preserve unfinished writing. The app does not check your iCloud account or separate records by account. If iPhone backup (iCloud Backup or a computer backup) is on, these records may also be included in the backup according to your Apple settings. There is no separate Hobocode sign-up.

Selected photos

The system photo picker gives the app the photos you choose. Hobocode creates app-owned JPEG copies, applies orientation and resizes images; it does not copy original EXIF, GPS or IPTC metadata into those copies. The original in Apple Photos is not deleted when you remove an attachment. Up to six photos can be attached to a note. The current version does not provide video attachment or in-app camera capture.

Location and nearby reminders

With permission, coordinates, accuracy and observation time are used to attach a location or compare saved facilities on your device. Automatic reminders are optional and require Always location, Precise Location and notification permission. When enabled, location can be used while the app is not in the foreground. Per-place nearby/away/notification times and reminder settings are kept locally to prevent repeat alerts; notification groups expire after 24 hours and are cleaned up when the app can run. This does not detect individual indoor shops or floors. You can turn reminders off in the app and change permissions in iPhone Settings. Manual writing remains available without these permissions.

Maps and place searches

This method applies from the update after 0.1.3. In the new method on iPhone, Hobocode chooses a map provider for each map by the country of the place the map is showing: NAVER Maps for Korea and Apple Maps elsewhere. Near borders or on a widely zoomed-out view, the app may keep the existing map, so you may see an area outside Korea on NAVER Maps or the reverse. The country is determined on your device from region data bundled in the app, and no coordinates are sent for this. To draw a map, the provider receives requests for the visible area, so it can process the area being shown, your IP address and device information. If NAVER Maps is unavailable, Apple Maps is used instead.

In the new method, place search follows the country of the map you opened it from. In a map of Korea, the query you enter is sent through a Cloudflare Workers relay to NAVER search. The request body contains only the query, not your note text, current coordinates or map area. While handling the request, the relay server may receive your IP address and basic device information (such as app and OS version and language); only the query is passed to NAVER. This applies even if your device region is set abroad. If NAVER search fails or finds nothing, the app searches once more with Apple. In maps of other countries, Apple search is used directly and nothing is sent to NAVER. Apple search on a map receives the query and the visible area of that map as a hint for ranking results; if the map is centered on your current location, this area can reveal your approximate location. "Search worldwide" in Korean map results sends only the query to Apple, without an area. The app does not read your current GPS location again during search. When you save a selected result, its place name, address, coordinates and source information are saved with the record on this iPhone. Apple place references can include a place ID and your alias. When looking up an address from a location, the app sends those coordinates to Apple for reverse geocoding.

Versions 0.1.3 and earlier use NAVER Maps and NAVER search (Apple search on failure, limits and similar cases) if the device region is Korea or empty, and otherwise use only Apple Maps and Apple search, in which case the query is not sent to NAVER. Apple search in these versions receives only the query.

In the Android version, maps of Korea use the NAVER Map SDK and maps of other countries use Google Maps (Google Maps SDK for Android, through Google Play services). The country is determined on your device. Google and NAVER can process map requests for the visible area, your IP address and device and app information to display maps, and Google can also process a pseudonymous identifier for the Maps SDK, crash information and interaction information such as panning and zooming to improve its own services. If Google Maps is unavailable, NAVER Maps is used; if NAVER Maps is unavailable, Google Maps can be used in Korea too. Place search sends only the query to the device's address search (Android Geocoder), without your current location, and the country of results is determined on your device. The service that provides the Geocoder, usually Google, processes the request. When looking up an address from a location, the app sends those coordinates to the device Geocoder. Android records are stored only on the device, with no server or cloud backup. The Android version contains no advertising or analytics SDK added by Hobocode.

iCloud data from earlier test versions

Earlier test versions (TestFlight) had optional iCloud sync. If you turned it on, the current app no longer reads or deletes data already sent to iCloud; you can delete it yourself in iPhone Settings > [your name] > iCloud > Manage Account Storage (or Manage Storage). The first time you open the app after updating, it continues with the most recently used record space that was on this iPhone. If an earlier version used both the device record space and per-iCloud-account record spaces on this iPhone, the other records no longer appear in the app but stay on this iPhone, and they are deleted along with the app if you delete it. The app does not delete files while moving records.

Siri and Lock Screen visibility

Siri and App Shortcuts pass the requested note text to the app, which opens in the foreground and requires device unlock. Hobocode does not save a separate voice recording; Apple handles Siri under its own settings and policies. Lock Screen and Dynamic Island displays can expose note excerpts or place information to nearby people, depending on your visibility choices. For automatic Live Activities, the Cloudflare relay processes installation and authentication identifiers and APNs tokens. Apple APNs receives the delivery token and a display payload containing session/place/note identifiers and update and expiry information. Display requests do not include note bodies, photos or precise coordinates; display content comes from records on the device. Permissions, connectivity and iOS limits can prevent display. Ending an activity does not delete the original note.

Retention and deletion

Saved notes remain until you delete them. Trash can be restored within 30 days or permanently deleted earlier. Explicit drafts expire 30 days after creation; expired items and unreferenced photo copies are removed when the app can process storage. Recovery inputs can remain until they are saved, discarded or their related record is removed. Deleting the app can remove the records on this iPhone. Data an earlier test version already sent to iCloud, and iOS system backups, are stored separately from the app (in iCloud or on your computer), so deleting the app does not erase them. Manage them in your device settings or on the computer where the backup is stored; support cannot promise immediate deletion of every Apple-managed backup.

Protection and other services

Hobocode keeps records in app-private storage on this iPhone and uses iOS file protection. This is not a claim of end-to-end encryption or a separate app password. The app uses Apple Siri, APNs and map/search services, NAVER maps/search and Cloudflare relays. The Android version uses Google Maps (Google Maps SDK) and the device Geocoder. Advertising-enabled versions use Google AdMob; the advertising section below explains that processing. Hobocode uses Firebase Remote Config to retrieve settings for advertising features. This configuration request is separate from loading ads and may run before the advertising consent process permits an ad request. Firebase processes an app installation identifier and its authentication token, device country, language and time zone, app identifiers, version and build, and operating system and SDK versions to provide configuration and support service diagnostics. Hobocode does not send note text, selected photos or saved place coordinates as Remote Config parameters. Firebase Analytics is used only for the optional ad measurement described below. Version 0.1.1(101) did not send PostHog analytics; optional PostHog analytics in later versions is described in the app usage analytics section below. This website is hosted by Vercel, loads Google Fonts and includes Vercel Web Analytics for visits and some web interactions. Some pages, including the homepage, also load Google Analytics. Web requests can transmit IP addresses and browser information to service providers. App processing and website analytics are separate.

App usage analytics

Hobocode can send usage statistics to PostHog Inc. in the United States (privacy@posthog.com) to help improve the app. Nothing is sent until you choose. From version 0.1.5, after the introduction, location, notification and ad screens, the last step offers “Turn On Detailed Statistics and Ad Measurement” or “Turn Off and Start”. Earlier versions offer “Turn On Basic Statistics and Start” or “Turn Off and Start” at the same step (version 0.1.4 also offers “Turn On Basic Statistics and Ad Measurement”). Nothing is selected in advance, and every app feature works whichever you choose. In Settings you can choose Don’t send statistics, Basic statistics or Detailed statistics at any time. Choosing basic statistics never turns on detailed statistics. After you turn a level on, data is sent over HTTPS only while the app is in the foreground. Updating the app never changes a statistics choice you already made.

Basic statistics sends only counts: app opens, screen opens (Home, Library, Map, Settings), memo save successes and memo save failures, together with the app version, build, environment (development or production) and the UTC date. Each event carries its own random UUID, reused only when that same event is retried, and the UUID is also the event’s identifier, so events are not linked to each other or to this device. Basic statistics creates no persistent device identifier and sends no permission states, first-launch or first-save times, return-visit or cohort information, or Apple Ads attribution. It never sends memo text, photos, coordinates, addresses, place names, search terms or account information. IP addresses can still be processed in transit, so this is not fully anonymous data. These statistics do not use Firebase Analytics.

Choosing basic statistics does not turn on detailed statistics. From version 0.1.5 you can turn on detailed statistics with “Turn On Detailed Statistics and Ad Measurement” on the last first-run step or in Settings; in earlier versions only in Settings. If you agreed to usage analytics in an earlier version, that choice is kept as detailed statistics, and you can change or turn it off in Settings. While detailed statistics is on and you use the app, it sends screen opens, the start of writing a memo, memo save successes and failures with the save path (editor, Siri or App Intent), memo revisits, permission states, notification opens and notification target displays, the app version, build and environment (development or production), the time of each event with a random UUID per event, the times of first launch and first save, a new, existing or late-consent cohort label with its day count and consent version, and whether an Apple ad led to the install together with that ad’s campaign, ad group and keyword numeric IDs. Events are linked by a random identifier generated on this device. It is not tied to an account, but it is not fully anonymous data. The app does not send memo text, photos, coordinates, addresses, place names, search terms or account information. IP addresses can be processed in transit.

Turning statistics off stops new sends immediately, discards queued events and removes this device’s identifier if one exists. Switching from detailed to basic statistics likewise discards queued events and the device identifier and stops ad attribution. Information already received by PostHog is not deleted automatically by changing the setting. Contact admin@aroido.com to ask about deleting it; basic statistics has no device identifier and withdrawing detailed statistics removes it, so earlier data may be hard to identify.

Under the free plan, data can be viewed and is retained for 1 year. We do not promise that data is deleted immediately after that period. This notice describes the app’s behavior; it does not state that data processing agreements or legal review are complete.

App install ad measurement (Meta and Google)

Versions that offer ad measurement can measure whether an install came from Hobocode’s ads on Google and Meta. This is an optional choice separate from usage analytics and is off by default. It turns on only if you choose “Turn On Detailed Statistics and Ad Measurement” (“Turn On Basic Statistics and Ad Measurement” in version 0.1.4) on the last first-run step or turn on “Allow Ad Measurement” in Settings. Nothing is selected in advance, updating the app never turns it on for an existing installation, and every feature works either way.

With your choice, the app sends Google LLC (US) through Firebase Analytics and Meta Platforms, Inc. (US) through the Meta SDK the app install and app opens, whether you saved a first memo (never its content), app and device information such as app version, device model, OS version and language, and an identifier each SDK creates for this installation (Firebase app instance ID, Meta anonymous ID). IP addresses are processed in transit. Neither SDK collects the advertising identifier (IDFA), and data is sent to Google with ad personalization signals turned off. The app never passes memo text, photos, search terms, addresses, place names, coordinates or account information to these SDKs. Meta’s Automatic Advanced Matching and codeless event features, which can read on-screen text, are kept off in Meta’s settings; if the app detects that Meta has turned either one on, it stops using the Meta SDK on that installation. Google and Meta may use this information to measure ad results and improve ad delivery under their own policies.

You can turn ad measurement off in Settings at any time. Sending to Google stops immediately. The Meta SDK cannot be shut down while the app is running, so during that session only the app’s own Meta events and normal sending stop, and some sending by the SDK itself may continue; after you fully close and reopen the app, nothing is sent to Meta. Information already received is not deleted by changing the setting; ask Google or Meta, or contact admin@aroido.com. Firebase Analytics event data is kept for the property’s retention setting (2 months), and Meta keeps data under its own policy.

Regardless of this choice, the app registers once with Apple’s SKAdNetwork. If you installed from an ad, Apple may tell the ad network about the install in a way that identifies neither you nor your device; the app itself sends nothing for this.

Meta Privacy · Google Privacy · Firebase Privacy

App advertising and privacy choices

Advertising-enabled versions use Google AdMob through the Google Mobile Ads SDK and the User Messaging Platform (UMP) for consent management. Native ads appear among home memos and library place groups, and a banner may appear below a memo. No interstitial or Live Activity ads are included. The app may request permission through iOS App Tracking Transparency (ATT) for advertising. Only if you allow tracking may the Google advertising SDK use the advertising identifier (IDFA), and your applicable regional consent choices still apply. If you decline, access is restricted, or you have not made a choice, the app requests non-personalized ads without using the IDFA. You can use the app’s core features without allowing tracking, and ads may still appear. You can change your tracking permission in iOS Settings.

The app does not put memo text, photos, exact coordinates, addresses, search terms or an app account identifier into advertising requests. The advertising SDK may process IP addresses, device or app identifiers, crash and performance information, and ad impressions and interactions for advertising, measurement, diagnostics and fraud prevention. An IP address can be used to estimate general location. Non-personalized requests do not mean that no data is processed.

ATT permission and UMP consent are separate; the app requests ads only when UMP permits ad requests. Where consent is required, the app checks UMP consent information before requesting ads. When required, privacy choices can be changed through the advertising privacy options in app settings. Changing or withdrawing consent does not automatically delete information already processed by a provider. Google processing, retention and sharing are described in its privacy policy; the app does not promise a single processing country or immediate deletion of provider-held data.

Google Privacy

Questions, choices and updates

Contact 송희섭 at admin@aroido.com about access, correction, deletion or stopping processing. We can explain steps for records on your device and for data an earlier test version sent to iCloud, without asking for your Apple ID password. We cannot view records stored on your device or guarantee restoration of lost records. If you email us, your sender address, message and any attachments you choose to send are handled to answer and resolve the request. We announce material changes on this page and update the effective date.

We retain inquiry emails and attachments only as long as needed to handle the inquiry. Once that purpose is fulfilled, we delete information no longer needed without undue delay, except where retention is required by law.

Relay records and deletion requests

The automatic Live Activity relay stores authentication, session and delivery-control records, including encrypted APNs tokens, in Cloudflare D1. Expired authentication records are eligible for cleanup only when the required checks pass; records needed for active sessions or recovery can remain. Turning the feature off, ending a display or deleting the app does not establish that every server record or provider backup has been erased. Contact admin@aroido.com for questions or deletion requests. This policy does not promise a fixed server-wide deletion deadline or a single processing country.