Privacy Policy

This is an English translation of the Korean Privacy Policy. If the two versions differ, the Korean version prevails.

Monadux (the “Company”) provides the member services of Loreve, its web novel writing app. The Company has this Privacy Policy to protect users’ personal information under applicable laws, including the Personal Information Protection Act of Korea, and to handle related complaints quickly.

1. Information the Company Does Not Process: Manuscripts and Local Data

• Loreve’s local features, such as the manuscript, codex, characters, notes, search, world map, and schedule, run on the user’s device without signing up, and their content is not sent to the Company.
• AI agent chat history and saved memories are also stored only on the user’s device (in project folders and the app data folder).
• The App has no usage analytics, error reporting, or advertising features. The only information the App sends to the Company is the account information in Section 2 and AI agent requests.

2. Personal Information Processed and Purposes

The Company processes only the minimum personal information needed for the following purposes.

• Users should take care not to put sensitive information, such as health, religion, or political views, or other people’s personal information into user instructions or AI requests. Information about other people contained in manuscripts is, like AI request content, processed but not stored.
• The Company does not accept sign-ups from children under 14, and destroys information about a child under 14 immediately if it learns that such information was collected.

3. Processing of AI Agent Requests

1. When a user sends a request to the AI agent, the request content is sent through the Company’s servers to AI processing providers, and the answer returns the same way.
2. The Company’s servers do not store request content or answers. To resume after a dropped connection, answers are kept in server memory for up to 10 minutes and then deleted. Only the usage records in Section 2 are kept, for billing.
3. The Company does not use request content for training, and only sends requests to AI processing providers under the condition that they do not train on the content. AI processing providers may keep request content for a limited period under their own policies, such as for abuse monitoring. The companies that process requests are fixed to those in the table in Section 4, and requests are not sent outside these companies, whichever AI model the user chooses.
4. Paragraph 3 does not apply to web search or reading web pages. When web search is used, search queries are sent to the search provider. When reading web pages is turned on, the addresses of the pages to read and the content of those pages are processed separately from manuscripts and conversations. This processing is not covered by the no-training and no-retention conditions and follows each provider’s policies. Manuscripts and conversations are not part of this exception.
5. The AI agent is designed not to put story content in search queries. Reading web pages is off by default, and users can turn web search and reading web pages on or off separately in the App’s Settings > Agent.

4. Outsourcing and International Transfers

The Company entrusts the processing of personal information as follows to provide the services. All of these companies are located outside Korea. These transfers are outsourcing and storage necessary to enter into and perform the contract with the user, and are disclosed through this Privacy Policy (Article 28-8(1)(iii) of the Act). Transfers take place over encrypted networks each time the services are used.

• Amazon, Google, and Microsoft may process data in their own data centers outside the USA (such as in the EU, Japan, or Australia).
• Each company’s privacy contact can be found in the privacy policy it publishes. If you contact the Company (Section 13), the Company will check and let you know.
• If you do not want your information transferred abroad, you can choose not to use the member services or delete your account. In that case, you cannot use member services such as the AI agent, but you can still use the local features.
• In its outsourcing contracts, the Company requires the companies not to use personal information outside the entrusted purpose, to manage it securely, and to limit further outsourcing, and it checks that they comply.
• If the companies the Company entrusts change, the Company updates this Privacy Policy and announces it.

5. Provision to Third Parties

1. The Company does not use users’ personal information outside the purposes in Section 2 or provide it to others, except when the user consents or the law specifically provides otherwise.
2. Paid services are sold by Polar Software, Inc. (USA) as the seller. When a user proceeds to checkout, the Company provides the user’s email and member ID to Polar for payment, and Polar receives payment information directly and processes it under its own privacy policy. The Company obtains separate consent for this provision on the checkout screen, and payment is not possible without it.

6. Retention and Destruction

1. When a member deletes their account, the Company destroys their personal information without delay. However, the following information is stored separately for the set period and then destroyed.

2. Even before account deletion, the following information is destroyed at the set time (checked daily): one-time values for email verification, password reset, and app sign-in, once used or expired; ended (expired or signed-out) sign-in sessions and their IP address, browser information, and device name, 3 months after they end; and the IP address and browser information of web sign-in sessions that last more than 3 months, once 3 months have passed.
3. Electronic files are deleted in a way that cannot be recovered, and paper documents are shredded or incinerated.
4. The Company does not separately destroy or set aside accounts that have not been used for a long time. Accounts are kept until the member deletes them.

7. Users’ Rights and How to Exercise Them

1. Users can at any time request access to, correction, deletion, or suspension of processing of their personal information, and withdraw consent.
   • Name and marketing email preference: the App’s Settings > Agent or Account
   • Password and signed-in devices: the web account page
   • User instructions and saved memories: the App’s Settings > Agent (saved memories are on the user’s device)
   • Account deletion: the App’s Settings > Account or the web account page
   • Other requests: master@monadux.xyz
2. The Company handles requests within 10 days of receipt and informs the user of the result. The Company may refuse deletion requests for information it must keep by law, and will explain why.
3. Legal guardians or authorized representatives can also exercise these rights, in which case they must submit a letter of authorization.

8. Automated Decisions

The Company does not make decisions that have legal effects or a significant impact on users solely by automated means without human involvement. Credit deductions are calculated from the model the user chose and the amount of use, and users can check usage for each answer.

9. Security Measures

• Passwords and sign-in tokens are stored in a form that cannot be restored.
• All communication between the App and the servers, and between the servers and entrusted companies, is encrypted.
• The App protects sign-in information with the operating system’s encrypted storage and does not pass sign-in information to the App’s interface code.
• The Company keeps the number of people handling personal information to a minimum, manages access rights, and keeps access logs.
• When a password is changed or reset, all other sign-in sessions are ended, and if a sign-in token that was already used is used again, that device is signed out.

10. Cookies

1. The website (loreve.monadux.xyz) does not use analytics or advertising cookies.
   • Visit statistics are collected anonymously without cookies using Cloudflare Web Analytics. Visitors are not individually identified or tracked across other websites.
   • If a visitor chooses the site language, a cookie (loreve_lang, 1 year) remembers that choice. If they do not choose, the site uses the browser’s language setting and stores no cookie.
   • To protect the site, Cloudflare may set security cookies that filter out automated attacks.
2. The web account page uses only a cookie to keep users signed in, and a cookie that briefly (10 minutes) holds consent details when signing up with an external account for the first time.
3. The Company does not use tools that collect information about behavior on other websites, such as advertising pixels.
4. Users can block cookies in their browser’s cookie and site data settings. If they do, the website’s language choice is not remembered, and they cannot sign in to the web account page.

11. Advertising Messages

• Emails about events and new features are sent only to members who agreed to receive them. The subject line indicates that the email is an advertisement, and the email explains how to unsubscribe.
• Members who agreed are reminded of their consent every 2 years.
• These emails are not sent between 9 p.m. and 8 a.m. (Korea time).
• Members can unsubscribe at any time in the App’s Settings > Account or through the link in the email.

12. Users Outside Korea (EU, UK, California, USA, etc.)

1. Legal bases: performance of a contract (GDPR Article 6(1)(b): accounts, AI agent, Credits, payments), legitimate interests (point (f): security, preventing misuse, deleted-account markers), legal obligation (point (c): keeping payment records), and consent (point (a): notice emails).
2. Rights: access, rectification, erasure, restriction of processing, portability (receiving information in a machine-readable format), objection to processing, withdrawal of consent, and the right to lodge a complaint with the supervisory authority in the user’s country of residence. These rights can be exercised as described in Section 7.
3. Safeguards for international transfers: For transfers to Korea, the USA, and Singapore, the Company applies the safeguards required by law, such as adequacy decisions, data processing agreements (DPAs) with entrusted companies, and standard contractual clauses (SCCs).
4. EU and UK representative: The Company has no establishment in the EU or the UK and processes the personal information of users there only occasionally and on a small scale, so it does not designate a representative under GDPR Article 27. Users in the EU and the UK can contact the Company using the details in Section 13.
5. California users: The Company does not sell personal information or share it for targeted advertising. Users can request access to, deletion of, and correction of the information collected, and will not be discriminated against for exercising these rights.

13. Chief Privacy Officer and Complaints

• Chief privacy officer: Lee Kyunghoon (Representative)
• Contact: master@monadux.xyz
• Company: Monadux, 7-24, Baekjegobun-ro 12-gil, Songpa-gu, Seoul, Republic of Korea, business registration number 717-26-02111

Reports and consultations about privacy violations can also be made to the following Korean authorities:

• Personal Information Dispute Mediation Committee: 1833-6972, www.kopico.go.kr
• Personal Information Infringement Report Center (Korea Internet & Security Agency): 118 (within Korea), privacy.kisa.or.kr
• Supreme Prosecutors’ Office: 1301 (within Korea), www.spo.go.kr
• Korean National Police Agency: 182 (within Korea), ecrm.police.go.kr

14. Changes to This Privacy Policy

When this Privacy Policy changes, the Company announces it on the website and in the App at least 7 days before the effective date. Changes that are important to users’ rights, such as to the items collected, purposes, outsourcing, or international transfers, are announced at least 30 days in advance and also by email.

Addendum

This Privacy Policy takes effect on November 13, 2026.