Chameleon

Jellypunch Co., Ltd. ('we', 'us', or 'our') is committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Chameleon mobile application. Please read this policy carefully. If you disagree with its terms, please discontinue use of the App.

2.1 Account Information: When you register, we collect your email address, hashed password (never stored in plain text), and a randomly generated User Code. 2.2 Message Data: All messages sent through the Service are end-to-end encrypted. We store the encrypted ciphertext on our servers but do not have access to the plaintext content of your messages. 2.3 Contact Data: If you add contacts using their User Code, we store the mutual association between user IDs. 2.4 Device Information: We may collect device identifiers such as your FCM (Firebase Cloud Messaging) token for push notification delivery. 2.5 Usage Data: We may collect anonymous analytics about App features used (e.g., session frequency), but never the content of communications.

We use the collected information to: • Create and manage your account • Deliver encrypted messages between users • Send push notifications (if enabled) • Maintain and improve the Service • Detect and prevent fraud or abuse • Comply with legal obligations We will never sell your personal data to third parties for advertising purposes.

We retain your account information for as long as your account is active or as needed to provide the Service. Message data may be subject to auto-deletion based on your in-app settings. You may request deletion of your account and all associated data at any time by contacting help@jellypunch.com. We will fulfill such requests within 30 days, subject to legal obligations.

We employ industry-standard technical and organizational measures to protect your personal data, including: • End-to-end encryption of all message content using AES-256 • TLS/SSL encryption for all data in transit • Password hashing using bcrypt with salt • Row-Level Security policies on our Supabase backend database Despite our best efforts, no security measure is perfectly impenetrable. We encourage you to use a strong, unique password for your account.

The App uses the following third-party services, each subject to their own privacy policies: • Supabase (database and authentication) • Google Firebase (push notifications) We encourage you to review the privacy policies of these services.

Your data may be transferred to and processed in countries other than your own. Our infrastructure may be hosted in or routed through the United States or other countries. By using the App, you consent to such transfers in accordance with this Privacy Policy.

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that a child under 18 has provided personal information, we will delete such information promptly.

Depending on your location, you may have rights under applicable law including: • Right to access your personal data • Right to correct inaccurate data • Right to delete your personal data • Right to restrict or object to processing • Right to data portability To exercise these rights, please contact us at help@jellypunch.com.

We may update this Privacy Policy from time to time. The updated version will be indicated by the "Last Updated" date at the top. If we make material changes, we will notify you through the App or by email. We encourage you to review this Policy periodically.

If you have any questions about this Privacy Policy or our data practices, please contact: Jellypunch Co., Ltd. Email: help@jellypunch.com