Irura account and data deletion requests
The First Ride Team accepts requests to delete Irura accounts and data at irura250405@gmail.com. You can submit a request by email without installing the app or signing in. Choose the request you need below.
Delete your account and associated data
Use this process to request deletion of your Irura account and the personal data associated with it.
- Open an email using the button below, or email irura250405@gmail.com with the subject Irura account deletion request.
- Include your registered email address (if available), sign-in method (email, Kakao, or Apple), nickname, and an email address for our reply. You may still request deletion if you do not know or cannot access your registered email. We will explain the necessary identity verification steps in our reply.
- After verifying your identity, we process deletion of the account and associated data and email you the result. Deleted accounts and records cannot be restored.
Email an account and associated data deletion request
Data covered: account identifiers and profile information; associated routines, goals, completion records, friend relationships and requests, quest participation and progress, statistics and rewards, submitted images, authentication tokens, push tokens, and related personal information. See “Processing and retained information” below for legally required retention and analytics information held by external services.
If you can use the app, you can also delete your account through 회원 탈퇴 (Delete account) at the bottom of the Settings screen.
Delete data while keeping your account
You may request deletion of specific personal information or service records while keeping your account.
- Open an email using the button below, or email irura250405@gmail.com with the subject Irura data deletion request.
- Include information to identify your account and an email address for our reply. State Keep my account, and specify the data and date range to delete, such as specific routines, goals, completion records, submitted images, or analytics information.
- After verifying your identity, we explain the available scope and effects on service use and process your request. Deleting authentication or account information required to maintain your account may require account deletion; we explain this before processing.
Email a data deletion request while keeping your account
Processing and retained information
- Identity verification: After receiving your request, we explain the minimum information needed to verify your account. Do not send passwords, authentication tokens, or a complete resident registration number.
- Processing time: After identity verification, we delete unnecessary personal information without delay and process requests within the periods required by applicable laws. Our email reply explains the verification steps and expected completion date. If additional verification or retention obligations delay or limit processing, we explain the reason and the available scope.
- Support and deletion request records: These are retained until the purpose of processing the request and communicating the result is fulfilled. If further retention is legally required, our reply explains the information, reason, and period.
- Legally retained information: Only when relevant e-commerce records actually exist and applicable laws require retention, contract and cancellation records and payment and supply records are kept for five years, consumer complaint and dispute records for three years, and labeling and advertising records for six months. Legally retained information is separated from service information and destroyed when its retention period ends.
- Analytics information held by external services: Clarity and Firebase Analytics may process information under identifiers separate from your account. For deletion requests, we check the identifiable scope and the provider's deletion procedures and explain the result. Clarity's published retention policy specifies 30 days for session recordings and nine months for favorited or labeled sessions and click data. Google Analytics user and event retention settings offer two or 14 months. We check the actual project retention settings when handling your request and explain the applicable periods.
See Section 6 of the Privacy Policy below for retention and destruction, and Sections 7 and 10 for exercising your rights and contacting us.
01 General Provisions
The First Ride Team, which operates the Irura mobile application (the "Operator"), processes personal information necessary to provide the service in accordance with the Personal Information Protection Act of the Republic of Korea. We publish this policy so that users can understand how their information is handled and exercise their rights.
This policy applies to account registration, routine and goal management, friends and quests, support inquiries, push notifications, and app usage analytics. If the purposes of processing change or we process new information, we will provide the required notices and follow the applicable consent procedures.
02 Personal Information We Collect and How We Collect It
2-1. Account Registration and Authentication
- Information required for standard registration: email address (user ID), password, nickname, character class, and gender selection used to choose a character.
- Information required for social registration: the selected login provider (Kakao or Apple), user identifiers and authentication information issued by that provider, nickname, character class, and gender selection.
- Character information associated with the selected class is used to display profiles and service screens.
- Passwords are transmitted for server authentication. Social login access tokens are used to process login and registration and are not sent as analytics data.
2-2. Service Use and Optional Features
- Automatically generated or processed information: installation device ID, device type and operating system, account authentication tokens, and service usage records.
- Information processed when users enter information or use features: routines, goals, completion records, friend relationships and requests, quest participation and progress, statistics, and reward information.
- Optional submissions: profile messages, user images, and routine verification images. We process image files that users select or share.
- For devices with notification permission: push tokens, settings for each notification type, and notification times.
- Optional consent: whether the user has agreed to receive marketing messages. Users can register and use the basic service without agreeing to promotional push notifications.
- When using the support inquiry feature: the reply email address, inquiry subject, and inquiry content.
- When a legal representative makes an inquiry or exercises rights: the request details, reply contact information, and the minimum information needed to verify identity and authority to act. Please do not send documents containing a complete resident registration number.
2-3. Usage Analytics
- Microsoft Clarity: screen navigation and session replay records, taps and scrolling, sessions, approximate location inferred from IP addresses, and technical and performance information about the device and app.
- Firebase Analytics: app instance ID, automatically collected events concerning app launches, screen views, and sessions, approximate location inferred from IP addresses, technical information about the device and app, and notification processing failure events.
- In supported mobile environments, both analytics tools are enabled by default when the app starts. We currently do not provide a separate analytics consent option or an analytics settings toggle.
- The service does not set email addresses, service account IDs, nicknames, passwords, or authentication tokens as custom user identifiers in these analytics tools. This does not mean that all content in session replay records is anonymous.
2-4. Collection Methods and Permissions
- Information entered directly on registration, login, feature, and support inquiry screens.
- Processing associated with selecting or sharing photos and allowing push notifications.
- Information automatically generated during app launches and API requests, and automatic collection by analytics SDKs.
- Photo access and notification permissions can be changed in device settings. Denying a permission may limit the corresponding feature. Notification permission and consent to receive marketing messages are managed separately.
03 Purposes and Legal Bases for Processing
| Category | Purpose | Legal basis |
|---|---|---|
| Registration, authentication, and account information | Identifying users, login, account management, and preventing misuse | Processing necessary to enter into or perform a contract under Article 15(1)(4) of the Personal Information Protection Act |
| Routines, goals, friends, quests, statistics, rewards, and optional submissions | Providing features requested by users and displaying profiles and characters | Processing within the scope necessary to enter into or perform the service agreement |
| Push tokens and notification settings | Delivering service notifications configured by users | Processing necessary to provide the requested notification feature |
| Support inquiry information | Receiving and answering inquiries and checking request details | Processing necessary to handle inquiries and perform the service agreement |
| Marketing consent and push tokens | Sending promotional push notifications about events and offers to users who have agreed to receive them | Separately chosen consent to receive promotional information and processing under applicable laws |
App usage analytics are used to understand usage flows, errors, and performance and to improve the service. The specific legal bases for analytics collection and international transfers are assessed separately from processing necessary to provide features. Publishing this policy or obtaining agreement to the Terms of Service does not replace separate consent where it is required.
04 Disclosure of Personal Information to Third Parties
The Operator does not sell personal information or provide it to advertising companies for their independent advertising purposes. Information is disclosed to third parties only where permitted by law or covered by valid user consent.
We distinguish outsourced processing, where an external provider processes information on the Operator's behalf, from third-party disclosure, where a provider uses information for its own independent purposes. Social login information is processed during authentication through the provider selected by the user. Transfers to external services are described in the following section.
If additional independent third-party disclosures are introduced, we will provide information about the recipient, purposes, data categories, retention periods, and any required consent and refusal options.
05 External Services and Outsourced Processing
| Provider | Purpose | Information processed |
|---|---|---|
| Cloudtype | Server hosting and service data processing | Account and authentication information, service usage records, and support inquiry information |
| Microsoft Clarity | Analysis of app usage flows, errors, and performance | Session replay records, taps and scrolling, sessions, IP-based approximate location, and device and app technical information |
| Google Firebase Analytics | App usage analysis and improvement | App instance ID, app launches, screen views, sessions, notification processing failure events, IP-based approximate location, and device and app technical information |
| Kakao | Kakao login selected by the user | Kakao user identifiers and authentication information |
| Apple | Apple login selected by the user and delivery of iOS push notifications | Apple user identifiers and authentication information, push tokens, and notification content |
| Expo Push Service | Routing push notifications to devices | Push tokens, device type, and notification content |
| Google Firebase Cloud Messaging | Delivery of Android push notifications | Push tokens and notification content |
When outsourcing processing, we manage restrictions on processing outside the specified purposes, necessary safeguards, further outsourcing and supervision, and responsibilities in accordance with applicable laws. Information processed by login providers for their own services is also subject to their privacy policies.
06 Retention and Deletion of Personal Information
6-1. Retention Criteria
| Information | Retention criteria |
|---|---|
| Account, profile, routine, friend, quest, and completion information | Until the processing purpose ends through account deletion or completion of a request to delete the relevant information |
| Service access tokens and refresh tokens | Until logout or account deletion is processed, or the tokens expire |
| Push tokens | A deletion request is sent to the server when notifications are disabled, the user logs out, or the account is deleted. Providers' deletion procedures also apply to information they process |
| Support inquiries and privacy rights requests | Until the purpose of answering the inquiry or handling the request is fulfilled. If further retention is required by law, we explain the reason and period |
| Information used to send marketing messages | Until consent is withdrawn or the account is deleted. Consent status is managed within the scope needed to honor opt-out requests |
| Clarity analytics information | According to Microsoft's published retention policies for each data type and the actual project settings |
| Firebase Analytics information | According to Google Analytics user and event data retention settings. Actual project settings must be checked and explained |
Microsoft's published retention policy specifies 30 days for session replay data and nine months for favorited or labeled sessions and click data. Standard Google Analytics properties connected to Firebase Analytics offer user and event data retention periods of two or 14 months. These are descriptions of provider policies, not confirmation of the actual settings in the Irura project.
Analytics data may be processed using identifiers separate from service accounts. Deleting an account therefore does not immediately delete all analytics records stored by providers. When a deletion request is received, we will check whether the relevant data can be identified and follow the provider's procedures before responding.
6-2. Statutory Retention and Deletion Procedures
- When a processing purpose is fulfilled, a retention period ends, or a valid deletion request is received, we check for any statutory retention grounds and delete unnecessary personal information without delay.
- Information that must be retained by law is separated from ordinary service information, used only for the required purpose, and deleted when the statutory retention period ends.
- Electronic files are deleted so that they cannot be recovered or reproduced. Paper records, if any, are shredded or incinerated.
- Only when relevant e-commerce records actually arise and the applicable laws require retention, contract and withdrawal records and payment and supply records are retained for five years, consumer complaint and dispute records for three years, and labeling and advertising records for six months. These periods do not apply collectively to all member information.
Retention policies: Clarity, Google Analytics.
07 Rights of Users and Legal Representatives
Users may request access to, correction or deletion of, or suspension of processing of their personal information, and may withdraw consent. Use the features available on the app's account and profile screens, or submit a request through the support inquiry screen or irura250405@gmail.com.
- Use 'Personal Information Rights Request' as the subject and provide the request type, the information concerned, and a contact address for our reply. Do not send passwords, authentication tokens, or complete resident registration numbers.
- The Operator verifies the requester's identity and, where a representative acts on the user's behalf, verifies their authority to the extent necessary. Legal representatives may also make requests on behalf of children.
- Verified requests are handled within the periods specified by applicable laws, and we provide the result. If a request is deferred or restricted, we explain the reasons and how to raise an objection.
Deletion or suspension of processing may be restricted where statutory retention obligations apply or where fulfilling the request would infringe another person's rights. We apply necessary safeguards to information subject to correction or deletion requests until processing is completed. Requesting the suspension of processing essential to the service may prevent use of the relevant features.
08 Automatic Collection, Usage Analytics, and Marketing Opt-Out
- Clarity and Firebase Analytics are enabled by default when the app starts. The app currently does not provide user settings to disable either tool individually.
- Requests to stop collection, suspend processing, or delete analytics information may be submitted through the support inquiry screen or irura250405@gmail.com. We explain the scope of processing available and its results.
- Limiting advertising tracking or deleting a device advertising identifier does not stop all analytics based on app instance IDs and session replay records.
- The service currently does not implement advertising tracking or disclosure to data brokers. If analytics data is to be used for personalized advertising, we will provide a separate notice and obtain any required consent.
- Consent to receive marketing messages may be withdrawn in the app's notification settings. Disabling notification permission in device settings and withdrawing marketing consent are separate actions.
- Disabling notification permission may prevent receipt of device push notifications, including routine and friend notifications.
09 Safeguards for Personal Information
- App authentication tokens are stored in the device's secure storage.
- We protect data during transmission and limit access to personal information to the scope necessary to provide the service.
- Access to personal information and external services is limited to personnel who need it, and access permissions and processing procedures are reviewed.
- Passwords and authentication tokens are not used as user identifiers in analytics events.
- Session replay records and user-submitted images may contain personal information, so we review safeguards appropriate to their processing purposes. Please avoid unnecessarily including other people's personal information or sensitive materials in images or support inquiries.
10 Privacy Contact and Complaint Handling
- Team responsible for service operations, privacy, and complaints: First Ride Team.
- Contact point for receiving and handling requests for access, correction, deletion, and suspension of processing: First Ride Team Privacy Contact.
- Email: irura250405@gmail.com.
- In-app contact: support inquiry screen.
You may use these contact points for questions about personal information processing, requests concerning children or legal representatives, suspension of analytics processing, and international transfers. The person responsible for operations oversees the management measures necessary for secure processing and protection of user rights.
11 Changes to This Policy and Notices
When this policy changes, we provide the reasons, main changes, and effective date through app notices or another appropriate method. Changes requiring separate consent are applied within the scope of the consent obtained.
This Privacy Policy takes effect on 2026-10-05. You may request access to previous versions through our privacy contact point.
| Version | Effective date | Main changes |
|---|---|---|
| 2026-10-04 | 2026-10-05 | Expanded information on data categories, privacy rights, children, international transfers, remedies, and revision history |
| 2026-10-03 | 2026-10-03 | Privacy policy in place before version management was introduced |
12 Personal Information of Children Under 14
The service allows users under the age of 14 to register. Where consent is required to process a child's personal information, the legal representative's consent and verification of that consent are required. A child's own acknowledgment of the terms cannot replace this requirement.
Legal representatives may contact our privacy contact point for information about processing a child's information and exercising rights. Only the legal representative's name, contact information, and the minimum information necessary to verify consent are used for verification. The Operator must not process personal information on the basis of consent that has not been verified.
A child's legal representative may request access, correction, deletion, suspension of processing, or withdrawal of consent. Children are informed of the purposes of processing and their rights in language they can understand.
13 Requests to Transfer Personal Information
Requests to transfer personal information under Article 35-2 of the Personal Information Protection Act apply to the businesses and information specified by law. We check whether the service is subject to this obligation and the scope of the requested information, and handle requests in accordance with applicable laws.
The app does not provide a separate screen for data transfer or transfer history. Please submit requests for transfers or for their processing status and history through our privacy contact point. We explain the available information, transfer methods, identity verification, and processing results.
14 Inquiries About Automated Processing
Routine progress, statistics, experience points, and reward screens may include calculations based on usage records. This notice does not mean that every such calculation constitutes an automated decision as defined by law.
If you would like an explanation or review of a result produced by automated processing of personal information, please contact our privacy contact point. Where the processing constitutes an automated decision under applicable laws, we explain the relevant criteria, procedures, methods, and rights to explanation, refusal, and reprocessing in accordance with those laws.
15 Processing and Transfer of Personal Information Outside Korea
The following information may be processed outside Korea through analytics, authentication, and notification services provided by overseas providers. Information about domestic server hosting is checked separately from information about international transfers.
| Recipient service | Purposes and data categories | Timing and method | Countries and retention information |
|---|---|---|---|
| Microsoft Clarity | Usage analytics: session replay records, taps and scrolling, sessions, IP-based approximate location, and device and app technical information | Network transmission through the SDK during app use while analytics are enabled | US data centers according to Microsoft's published information. See Section 6 for retention policies by data type |
| Google Firebase Analytics | Usage analytics: app instance ID, automatically collected events, notification error events, approximate location, and technical information | Network transmission through the SDK during app use while analytics are enabled | Actual processing countries and project retention settings remain to be confirmed; provider policies described in Section 6 apply |
| Apple | Apple authentication and iOS push notifications: user identifiers, authentication information, push tokens, and notification content | Network transmission when a user selects Apple login or uses push notifications | Actual processing countries and retention periods must be checked against the service's processing arrangements |
| Expo Push Service | Push notification routing: push tokens, device type, and notification content | Network transmission from the server when configured push notifications are sent | Actual processing countries and retention periods must be checked against the service's processing arrangements |
| Google Firebase Cloud Messaging | Android push notifications: push tokens and notification content | Network transmission when configured Android push notifications are sent | Actual processing countries and provider procedures for deleting identifiers must be confirmed |
International transfers must be supported by a basis permitted under Article 28-8 of the Personal Information Protection Act. We distinguish outsourced processing and storage necessary to perform the service agreement from supplementary usage analytics, and confirm and explain transfer countries, recipients' legal names and contact details, data categories, purposes, timing, methods, retention periods, and legal bases. Mentioning a transfer in this policy does not by itself authorize every international transfer.
To request that an international transfer or related processing be stopped, please email irura250405@gmail.com. Depending on the scope of your request, social login or push notification features may become unavailable. We explain the specific effects and processing results. The scope of requests concerning usage analytics is explained separately.
16 Remedies for Privacy Violations
You may also contact the following organizations for consultation, dispute mediation, or reporting privacy issues.
- Personal Information Dispute Mediation Committee: 1833-6972, Dispute mediation application information.
- Korea Internet & Security Agency (KISA) Privacy Infringement Report Center: 118, Privacy Infringement Report Center.
17 Response to Personal Information Incidents
If we become aware of an incident involving personal information leakage or unauthorized access, we take steps to limit further harm and notify affected users and report to relevant authorities in accordance with the requirements and procedures specified by applicable laws.
To the extent required by law, notices include the information concerned, the timing and circumstances of the incident, steps to prevent harm, response and remedy procedures, and the responsible contact details. Incident-related inquiries may be submitted through our privacy contact point.