Privacy policy

1. Operator and scope

Movdrawing (UMJIKGEURIM) is a free animation criticism webzine operated by Lee Jongseok (also known as yohan). Official website: https://umjikgeurim.com. Privacy and service contact: umjikgeurim@gmail.com. Public articles can be read without registration.

Optional Google or email accounts synchronize personal reading records. Contributor biographies and editorial accounts may involve additional processing in the course of publication.

2. Personal information processed

Email registration involves your email address, Supabase Auth user identifier and authentication data, plus information needed to send confirmation and password-reset emails. Password authentication is handled by Supabase Auth; the service does not provide the operator a plaintext-password viewing feature. Google login may provide your email, provider identifier and available basic profile information. We do not access Gmail messages or Google Drive files.

Optional reader features store a chosen display name, saved articles, bookmarks, reading progress, highlight positions and colors, personal notes, resource URLs and folders, and timestamps. Notes may contain personal information you choose to enter.

We record the acknowledged terms and privacy-notice versions, language, acknowledgment time and self-declaration of being at least 14 years old. We do not routinely collect dates of birth or identity documents; self-declaration is not independent age verification. Authentication cookies, IP addresses, request/error logs and device information may be processed by infrastructure providers. Some guest records remain in browser storage.

3. Purposes and legal grounds

We process information as necessary to authenticate accounts, deliver requested cloud storage and synchronization, send confirmation and reset emails, secure the service, and respond to support or rights requests. Applicable legal grounds vary by activity and may include performance of a requested service, legal obligations or separate consent where required.

We do not currently offer marketing email subscriptions, behavioral advertising or first-party profiling trackers. Acknowledging this notice is not consent to marketing.

4. Retention and deletion

Current account and cloud library records are retained while the account remains active and are deleted from the active database when account deletion successfully completes. Data subject to applicable legal retention duties or legitimate dispute handling may be kept separately only for the necessary purposes and period.

Supabase Free does not include daily automated backup restoration offered on paid plans; this does not mean no operational logs or internal copies exist. Vercel Hobby runtime logs are available in its dashboard for one hour, which is not necessarily the retention period for every vendor security record. Operational data may be retained separately under provider policies and applicable law.

Resend Free retains email contents and delivery logs for 30 days. Messages sent to our Gmail contact address are used for responding to inquiries and unnecessary content is deleted once it is no longer needed. Browser-only guest records can be removed by clearing local site data; account deletion does not automatically clear them.

5. Providers and processing activities

Supabase provides authentication and storage of private reading records; Vercel hosts and serves the site; Resend (Plus Five Five, Inc.) delivers transactional account-confirmation and password-reset emails; Google provides optional account authentication; and Sanity manages published articles and contributor/editorial materials. Google separately governs its own account services.

Private reader notes are not designed to be published into Sanity. Subprocessors, contracts and processing locations depend on each provider and require ongoing review.

6. International transfers and processing

International processing occurs where necessary for optional account services, website delivery and security/technical operations. We describe these vendor arrangements with reference to Article 28-8(1)(3)(a) of the Korean Personal Information Protection Act, concerning disclosure of cross-border outsourcing or storage necessary to perform the service contract. We distinguish vendor-published information from the project configuration currently known to the operator.

Supabase Pte. Ltd. (Singapore; privacy@supabase.io): Account email, identifiers, authentication status, library records and acknowledgment records are transmitted via HTTPS while the service is used and stored by the primary Auth/database services in Seoul, South Korea (ap-northeast-2), generally for the account lifetime. Operational telemetry, IP/request/error logs may be processed in EU data centers, and required support/security access may be carried out by relevant entities in Singapore, the United States and elsewhere. Logs and support materials follow provider operational retention terms.

Vercel Inc. (United States; privacy@vercel.com): On website visits and server requests, IP addresses, requested URLs/times, browser technical details and minimal authentication details needed to serve requests may be processed through encrypted connections in the U.S. Virginia function region (iad1) and globally distributed delivery locations. Purposes include hosting, content delivery, troubleshooting and security. Runtime logs are viewable for one hour on Hobby; other operational records may follow separate provider and legal retention requirements.

Resend (Plus Five Five, Inc., United States; privacy@resend.com): During email registration or password-reset requests, recipient addresses, email content and confirmation links, and delivery metadata are transmitted securely to the United States for sending and delivery verification. A Tokyo sending region does not change the U.S. storage location. Email contents and delivery logs are retained for 30 days on the Free plan.

Sanity (contracting entity Sanity AS or Sanity US Inc.; dpo@sanity.io): Published editorial records, such as articles, contributor names, biographies and portraits, may be stored and distributed through Sanity. Primary content storage is in Belgium; infrastructure and support processing may also occur in the United States. Published materials are managed until removed by the operator or the service ends; revision history and CDN caches have separate retention rules. Private reader notes and library records are not submitted as Sanity publications.

Google sign-in is optional and subject to Google’s own privacy policy. During OAuth authentication, the email address, provider ID and available basic profile may be exchanged to sign you in. You may choose email/password registration instead.

You can request account deletion, restriction of processing or information about international processing at umjikgeurim@gmail.com. If you decline cross-border processing essential to email delivery or account authentication, those account features may not be available; public articles do not require registration. Website visits themselves may involve necessary processing through overseas hosting providers.

7. Security, cookies and local storage

The deployed service uses HTTPS, session cookies, member-specific row-level database access controls (RLS) and separate server-only administration keys. We test permissions and account erasure in the production environment. Essential cookies and browser storage support authentication and reading functions. We currently do not operate proprietary behavioral advertising trackers.

8. Your rights and requests

From your account you can edit your display name, download cloud reading records in JSON and request account deletion. For access, correction, deletion, restriction or suspension of processing, withdrawal of consent and international-transfer questions, write to umjikgeurim@gmail.com. Requests are handled subject to applicable legal requirements.

Tell us your account email and request type. Please do not send a password or identity-document scan in your first email. Any necessary verification will be explained separately. Contact us if self-service account deletion is unavailable.

9. Changes and responsible person

Privacy contact and responsible person: Lee Jongseok (yohan). Email: umjikgeurim@gmail.com. Material changes and effective dates are published on the site, with renewed acknowledgment or consent where required by law.

This policy is effective October 16, 2026. We will revise it if relevant vendor locations, service plans, retention policies or our actual processing practices change.