fopic Privacy Notice

The Tens ("we", "us") provides the fopic photo booth app. This notice explains what personal data we process, why, who we share it with, and what rights you have.

Effective 21 August 2026 · Last updated 21 August 2026

View Terms of Service → · 한국어

Where fopic is available — fopic is not offered in the European Economic Area, the United Kingdom, or Switzerland. If you are in one of those regions, the app is not available to you and this notice does not apply.

A Korean-language version of this notice is published for users in the Republic of Korea. The facts about what we process are the same in both; each states the disclosures required by the law applicable to its readers.

1. Who we are

• Business name: The Tens
• Representative: Seo Jisoo
• Business registration number: 663-18-02712
• Email: contact@thetens.app

We are established in the Republic of Korea. Send all privacy enquiries, including requests to exercise your rights, to the email address above. Seo Jisoo is our privacy officer and handles these personally.

2. What this notice covers

fopic lets you take four-cut photos, edit them, and optionally share them by QR code.

Taking photos, editing them, separating subject from background, and saving to your device all happen on your device. Your photos are not sent to us unless you choose to share them by QR code.

This notice covers the app and the QR sharing web pages.

3. What personal data we process

3.1 When you open the app (whether or not you are signed in)

Opening the app sends the following to third parties, even without an account:

This does not include your name or email address. You can reset or delete the advertising identifier in your device settings at any time — see section 6.

About approximate location — The approximate location above (country and city level) is estimated by the advertising provider from your IP address and device signals. The app does not request location permission and does not collect GPS or other precise location data. We do not collect or store this ourselves.

3.2 Photos and videos, and QR sharing

If you choose to share by QR code, the finished photo strip (which may contain faces) and the video are uploaded to a sharing server. This feature works without an account.

Frames and stickers can also be passed to other users by QR code, in which case the file is uploaded to the same sharing server. Sending and receiving frames and stickers requires an account.

Anyone holding the QR code can open the file. Please consider carefully who you share it with and what it contains.

3.3 When you sign in

Email and name come from Apple, Google, or Kakao during sign-in. If you choose "Hide My Email" with Apple, we never learn your real address.

3.4 When you create frames or stickers

This requires an account, and the images you create are saved to your account automatically. There is no separate save step. If you do not want them kept in your account, do not use the feature, or delete the items you created.

3.5 When you contact us

Using the contact form in Settings sends your message and the following to our email address — the minimum needed to reproduce and answer your question.

4. Why we process your data

We use your data only for the purposes below. If we ever want to use it for something else, we will ask you first.

We do not sell your personal data, and we do not use your photos to train machine learning models.

5. Faces in photos

We know the photos you take or import may contain faces.

We do not use these photos to identify or authenticate anyone, and we do not generate biometric templates from faces. Separating subject from background runs on your device and produces an image, not a biometric identifier. If we ever introduce a feature that identifies or authenticates people by face, we will ask for your consent beforehand and update this notice.

We do not collect government identifiers (resident registration, passport, driving licence, or foreign resident numbers), health data, or other sensitive categories of data.

Device biometric unlock (Face ID and similar) is performed by your operating system; we receive only whether it succeeded.

6. Advertising identifiers, and how to opt out

We show ads to users on the free plan. Ads are served by Google AdMob using the advertising identifier stored on your device.

We do not collect or store this behavioural data ourselves. The advertising providers collect it from your device. If you reset or delete the advertising identifier in your device settings, data collected after that point is not linked to earlier data.

Google's privacy policy: https://policies.google.com/privacy

How to opt out

• On iOS, fopic asks for tracking permission the first time you open it. If you decline, you get non-personalised ads instead, and every feature of the app still works. You can change this later in Settings → Privacy & Security → Tracking.
• iOS — Settings → Privacy & Security → Apple Advertising → turn off Personalised Ads
• Android — Settings → Privacy → Ads → delete advertising ID or opt out of personalised ads
• Subscribe — paid plans remove ads entirely

Where the law of your region requires us to obtain consent before ads may be served, the app asks for that consent when you first open it, and you can change your answer at any time in Settings → Ad privacy settings. That screen appears only where such a requirement applies to you.

7. Who we share your data with

We do not sell your data, and we do not provide your account information, photos, videos, frames, or stickers to third parties.

Service providers acting on our instructions

These providers handle your data only within the scope we instruct and do not use it for their own purposes. Our contracts with them cover confidentiality, security measures, limits on sub-contracting, and their obligation to help us answer your requests, as required by Article 26 of the Korean Personal Information Protection Act.

About Supabase — Account data and the frames and stickers you create are stored on servers in Seoul, Republic of Korea. However, we contract with Supabase Pte. Ltd, a Singapore company, and its group company Supabase Inc is a US company, so access from outside Korea and transfers within the group may occur in the course of operations and technical support. Section 8 covers this.

Google is not one of these providers. Google LLC (Google AdMob) collects and uses the advertising identifier, device information, IP address, and approximate location for its own advertising purposes as well, and may pass this to other advertising providers through mediation. Google therefore decides how it uses that data independently of us, rather than acting on our instructions. Section 6 sets out what it collects and how to opt out.

8. Where your data goes

We are established in the Republic of Korea, and some of our service providers are in the United States and Singapore.

Account data and the frames and stickers you create are stored in Seoul. However, because the provider's operating entities are outside Korea, access from abroad and transfers within its group may occur during operations and technical support. We treat that as a transfer abroad and list it above.

You can refuse these transfers. Some of them happen the moment the app starts, so if you want to refuse, please stop using the app or contact us at the address in section 1. Transfers for QR sharing do not happen unless you use that feature, and ad tracking can be refused separately as described in section 6.

9. How long we keep your data

Why these periods — These are the shortest periods we need to achieve the purposes above, not statutory retention periods. We currently hold no personal data that we are legally required to retain. When paid subscriptions launch we will review whether record-keeping duties under consumer protection law apply to us, and update this notice.

Subscription entitlement information — The processing below happens only if you use a paid subscription. If you do not, no purchase history is created.

We do not collect or hold payment details (card or account numbers). Payment happens through Apple's App Store, and we only check whether a subscription is valid. RevenueCat, which we use for that check, records the account identifier and purchase history. Deleting your account does not currently delete that record automatically. Once your account data is deleted the record can no longer be linked to you, but the record itself remains.

If you want it deleted, please email us before closing your account and we will verify and delete it. After closure we cannot tell whose record it is, so individual deletion is no longer possible. We will update this notice once automatic deletion is built.

10. Your rights

You may ask us at any time to:

• Access the personal data we hold about you, and receive a copy
• Correct data that is inaccurate or incomplete
• Delete your data
• Stop processing your data

How to exercise them

• In the app — Settings has an account deletion function that deletes your account and personal data immediately, with no grace period. Note that this does not cover the subscription entitlement record described in section 9.
• By email — contact@thetens.app

We act without undue delay, and within any time limit applicable law sets — for access requests under the Korean Personal Information Protection Act, within 10 days. We do not charge for this. We may need to confirm your identity first, so that we do not disclose your data to someone else.

Depending on where you live, your local law may give you further rights, such as receiving your data in a portable form or objecting to particular processing. Contact us at the address above and we will honour any right that applies to you.

Requests are received and handled by Seo Jisoo (Representative) · contact@thetens.app. We are a sole proprietorship, so the same person handles privacy matters and access requests.

11. Is providing your data required?

You are not legally required to give us any personal data.

• You can use fopic's core features — taking, editing, and saving photos — without an account, and photos stay on your device.
• An account is required only to store frames and stickers in your account and to send or receive them by QR code. Without one, those specific features are unavailable.
• If you decline tracking permission, every feature still works — you simply see non-personalised ads.

12. Children

fopic is not directed at children.

We do not allow account creation by anyone under 14, and we ask you to confirm you are 14 or older when you sign in. We do not collect dates of birth, so we cannot verify age ourselves. If we learn — from a parent or guardian, from you, or from an authority — that we hold data of a child under that age, we delete it without delay.

Where the law of your country sets a higher age at which a child can agree to this kind of service on their own, a parent or guardian must agree on the child's behalf.

For parents and guardians — Some features work without an account, and data is still processed:

• Simply opening the app collects device information, app usage records, and the advertising identifier (section 3.1).
• QR sharing works without an account, and in that case a photo containing faces is stored on a server outside Korea for 24 hours (section 3.2).

If you do not want a child using QR sharing, use device restrictions such as Screen Time, or contact us at contact@thetens.app to review or delete a child's data. We will act without delay and confirm the outcome.

13. Automated decisions

We do not make decisions about you by automated means that affect your rights or obligations.

Automatic processing inside the app — separating subject from background, applying photo filters — is an editing function you run yourself and does not decide anything about you.

If we ever introduce automated decision-making, we will publish how it works here, together with how to request an explanation, contest the decision, or ask for human review.

14. Security

• Access control — Row-level access control on the database and file storage restricts you to your own data.
• Encryption in transit — All communication between the app and our servers uses HTTPS.
• Secure credential storage — Sign-in tokens are stored in your device's secure storage (iOS Keychain, Android Keystore).
• Minimised access — The number of people who can handle personal data is kept to a minimum.
• Automatic deletion of shared files — QR sharing files are deleted automatically after 24 hours so nothing is kept longer than needed.

No system is perfectly secure. If a breach occurs that is likely to put you at risk, we will notify the competent authority and, where required, you, within the time limits applicable law sets.

15. Pseudonymised data

We do not process pseudonymised data for statistical, research, or archiving purposes.

16. Complaints

If you are unhappy with how we handle your data, please contact us first at contact@thetens.app so we can try to resolve it.

You can also complain to a data protection authority. As we are established in the Republic of Korea, the competent authority is the Personal Information Protection Commission (https://www.pipc.go.kr). For dispute resolution or advice:

• Personal Information Dispute Mediation Committee — 1833-6972 (www.kopico.go.kr)
• Personal Information Infringement Report Centre — 118 (privacy.kisa.or.kr)

If your country has its own data protection authority, you may complain to it as well. You may also seek a remedy in the courts.

17. Changes to this notice

We apply this notice from its effective date. Where we add to, remove, or correct it, we give notice in the app or on this page at least 7 days before the change takes effect, and at least 30 days beforehand for changes that disadvantage you.

Revision history

• 20 July 2026 — First version
• 5 August 2026 — Purposes and collected data made specific; overseas transfer disclosure added; processing of facial images and data of children under 14 added
• 6 August 2026 — Processing of approximate location for advertising added; Datadog and Google AdMob tasks made specific; QR sharing items and anonymisation of some records clarified; basis for retention periods and automated decisions added; postal address and phone number removed from contact details (enquiries by email and the in-app contact form)
• 21 August 2026 — Rewritten as a standalone notice for users outside the Republic of Korea rather than a translation of the Korean text. Added where fopic is available, how to opt out of ad tracking, a full transfer table, rights and response times, whether providing data is required, and complaint routes. Google LLC (Google AdMob) described as deciding its own use of ad data rather than acting on our instructions. Wording about paid subscriptions no longer assumes a particular launch date: it now states that the processing applies if you use a paid subscription. The data collected and the purposes are unchanged. Our contact address changed to a business email (contact@thetens.app), and our business address and phone number are shown again — they were removed on 6 August 2026 because they were a home address and a personal number, and are now those of our registered business premises.