Privacy Policy

This Privacy Policy explains how RemoteSpace (리모트스페이스) (“we,” “us,” or “our”) collects, uses, stores, and shares information in connection with OutOfMind (getoutofmind.com), including the website at https://getoutofmind.com and related media, channels, or applications (collectively, the “Site” or “Service”).

By using the Service, you acknowledge this Privacy Policy. Our Terms of Service also apply. If you do not agree, do not use the Service.

This Policy applies to guests who use limited free features without an account and to users who create accounts. It covers information we process when you visit the Site, create or share content, react to public traces, submit reports or contact messages, purchase credits, or otherwise interact with the Service.

It does not cover third-party websites, apps, or services that we do not control, even if linked from the Site.

Depending on how you use the Service, we may collect the following categories of information:

Account and identity. When you sign up or sign in, our authentication provider (currently Supabase Auth) processes identifiers such as your user ID and email from social providers (for example Google or X). We may sync your user ID and email into our application database to operate your account, credits, and Archive.

Content you submit. For eligible (typically premium or signed-in) creations, we may store notes and optional recipient fields, locale, effect/mode metadata, moderation status, masked or display versions of text, AI Echo outputs, share settings, and related timestamps. Free Match Burn usage is generally processed on your device and is typically not stored on our servers as an Archive record.

Interactions. We may store empathy or similar reactions (linked to your account, or for guests to a hashed IP address and/or a browser guest fingerprint), content reports (reason, optional detail, reporter account or guest fingerprint, and a masked excerpt), and contact-form submissions (email, category, message, locale, and optional account or fingerprint).

Technical and device data. We may use a randomly generated guest fingerprint and other values stored in your browser’s localStorage (for example UX preferences, draft text, daily free-use markers, and locally remembered reaction IDs). Authentication cookies/sessions may be set by Supabase Auth. We may process your IP address briefly to derive a one-way hash for guest reaction deduplication; we do not use a raw IP as the stored reaction key. We may also process locale and standard request metadata needed to operate and secure the Service.

Payments. If you purchase Paid Services, third-party payment processors may collect billing details. We may store a payment customer identifier and credit-related account fields. We do not store full payment card numbers on our servers when using such processors.

We do not currently operate a first-party analytics SDK in the application. If that changes, we will update this Policy.

We use information to:

• Provide, operate, and improve the Service (including effects, Archive, credits, and account features);

• Generate AI Echo responses and run automated moderation or PII-masking assistance for eligible content;

• Enable optional public sharing, Afterglow, share links, and reactions when you choose those features;

• Process reports, contact messages, and operational/admin review for safety and support;

• Prevent abuse, fraud, spam, and security incidents (including rate limiting);

• Process payments and fulfill Paid Services through processors;

• Communicate with you about the Service (and marketing only if applicable and permitted);

• Comply with law, enforce our Terms, and protect rights, safety, and property;

• Analyze aggregated or de-identified information to understand usage patterns, where feasible.

If you are in a jurisdiction that requires a legal basis for processing (such as the EEA/UK under GDPR), we rely on one or more of the following, as appropriate: performance of a contract (providing the Service you request); legitimate interests (security, abuse prevention, Service improvement, limited operational communications); consent (for example, making content public, or non-essential cookies/marketing if we introduce them and seek consent); and legal obligations.

Where Korean or other local privacy laws apply, we process personal information as necessary to provide the Service, fulfill contracts, comply with law, and for the purposes described in this Policy.

Premium features may send content you submit (such as note text, optional recipient fields, mode, and locale) to third-party AI providers (including OpenAI) to generate Echo responses, assist with moderation, and help detect certain personal-information patterns.

AI outputs and related moderation metadata may be stored with your Archive. We may configure API options intended to limit provider-side storage where available, but we do not guarantee that third-party AI providers never retain or process data under their own systems and policies.

Your use of AI features is also subject to those providers’ terms and privacy policies. Do not submit highly sensitive personal data when possible. AI outputs can be inaccurate and are not professional advice.

Creations are private by default unless you opt to leave a public trace or otherwise share. Public visibility may require moderation and may be refused, delayed, masked, held, or removed.

Public feeds, share links, and reactions may show display text, effect metadata, and related counts. We do not guarantee anonymity. Anyone with access to a public page or link may view, copy, screenshot, or redistribute that content outside the Service. We are not responsible for third-party copying of content you choose to make public.

We share information with service providers that help us operate the Service, including:

• Supabase — authentication, account identity, application database, and related backend infrastructure;

• OpenAI (and similar AI providers) — Echo, moderation assistance, and related processing;

• Payment processors (for example, Lemon Squeezy or similar) — checkout and billing;

• Hosting and infrastructure providers — delivering the Site and APIs.

These processors may only use personal information as needed to provide their services to us, subject to their agreements and policies.

We may also disclose information if required by law, legal process, or governmental request; to protect rights, safety, or security; in connection with a business transfer (merger, acquisition, or asset sale); or with your direction or consent.

We do not sell personal information in the conventional sense of selling a mailing list. If a future “sale” or “sharing” definition under specific U.S. state laws becomes relevant to our practices, we will update this Policy and provide required choices.

We are based in the Republic of Korea. Service providers may process information in the United States, the European Union, or other countries. Those countries may have different data-protection laws than your home country.

Where required, we rely on appropriate transfer mechanisms and vendor safeguards available under applicable law (such as contractual clauses or vendor certifications). By using the Service, you understand that your information may be transferred internationally as described in this Policy.

We retain information only as long as reasonably necessary for the purposes described in this Policy, unless a longer period is required or permitted by law.

Eligible Archive items stored on our servers (typically premium creations) are generally kept without a fixed calendar expiry until you delete them, make them unavailable through product controls, or your account ends. Share links for public creations are generally intended to work while the creation remains Public; turning a creation Private invalidates the link, and making it Public again may create a new one. Soft-deleted content may remain inaccessible to you while residual copies exist in backups, logs, or operational systems for a limited period.

Reports, contact messages, moderation records, and payment-related records may be retained longer for safety, dispute, accounting, or legal reasons. Browser localStorage data remains until you clear it or the Site removes/migrates it.

We may still retain, limit, or delete data as needed for security, legal, or operational reasons, and deletion across backups or subprocessors may not be instantaneous or complete in every environment.

Depending on your location, you may have rights to access, correct, delete, restrict, or object to certain processing of your personal information, to withdraw consent where processing is consent-based, and to data portability, in each case to the extent provided by applicable law (including GDPR/UK GDPR and Korean privacy law where they apply).

You can review certain account information in the product (for example the email associated with your signed-in session), manage Archive items (including soft-delete and visibility where offered) in the product, and clear browser localStorage through your browser settings.

To exercise privacy rights or make a request, contact support@getoutofmind.com. We may need to verify your identity and may deny or limit requests where allowed by law (for example, where information is needed for legal claims, security, or the rights of others). Not all rights apply in every jurisdiction or to every category of data.

You may request account deletion by contacting support@getoutofmind.com.

When an account is deleted, we will remove or anonymize associated Service data that we control, subject to legal and operational retention (which may include reports, security logs, and billing records). Deletion across all subprocessors may not be instantaneous. Content you made public may already have been copied by others outside our control.

We do not promise immediate, complete erasure from every backup, cache, or third-party system at the moment you click delete.

We and our providers use cookies, local storage, and similar technologies:

• Supabase Auth may set cookies or similar technologies for authentication and session security;

• Locale routing may rely on URL path and related preferences;

• localStorage may hold guest fingerprint, UX state, composer drafts (which can include text you typed), daily free-use markers, and locally remembered reaction IDs.

You can clear site data in your browser. Doing so may reset guest limits, drafts, and local reaction memory, and may require you to sign in again. Essential technologies required to operate the Service may continue to function where permitted by law. If we introduce non-essential tracking that requires consent in your region, we will update this Policy and our controls accordingly.

The Service is intended for users who are at least 16 years old (or older if required where you live). We do not knowingly collect personal information from anyone under 16.

If you believe we have collected information from a child under 16, contact support@getoutofmind.com and we will take appropriate steps to delete it.

We implement reasonable administrative, technical, and organizational measures designed to protect personal information. No method of transmission or storage is completely secure. We cannot guarantee absolute security.

The Site may link to or integrate third-party services (including auth, payments, AI, and hosting). Their privacy practices are governed by their own policies. We are not responsible for their content or practices.

We may update this Privacy Policy from time to time. The “Last updated” date will change when we do. Continued use of the Service after an update constitutes acknowledgment of the revised Policy, except where applicable law requires additional notice or consent.

For privacy questions, requests, or complaints regarding OutOfMind (getoutofmind.com), contact:

support@getoutofmind.com

Controller / Provider: RemoteSpace (리모트스페이스), Republic of Korea, Business Registration No. 136-36-00841.

Service: OutOfMind — https://getoutofmind.com

This Policy is provided in English. The English version is the governing version. Translations, if any, are for convenience only.