Privacy Policy

Last updated: September 24, 2026 Effective date: September 24, 2026

The Batang processes personal information to the extent necessary to provide the service.

### 1) Google Sign-In and Account Information

When you use Google sign-in, Firebase Authentication may process the following basic Google account profile and authentication information:

- Firebase user identifier (UID) - Google account identifier - Email address - Display name - Profile photo URL - Technical information required for sign-in and account security

The Batang does not collect or store your Google account password.

Of this information, The Batang stores UID and email address in its Cloud Firestore service database. Display name and profile photo URL may be processed by Firebase Authentication, but The Batang does not separately copy and store them in its service database.

### 2) Service Use and Synchronization Data

If a signed-in user uses cloud synchronization, The Batang may process service data such as:

- Desktop configuration and settings - Widget position, size, and settings - To-do lists - Text notes and other content entered into widgets - Service preferences and information required for synchronization

The actual data processed depends on the features the user chooses to use.

Certain data, such as personal background images, may be processed only in the browser and may not be uploaded to The Batang's cloud services.

### 3) PRO Purchase and Payment-Related Information

Payments for The Batang PRO Lifetime are processed by Lemon Squeezy as the Merchant of Record.

The Batang may process the following information to provide PRO access, verify purchases, handle refunds, and support purchase restoration:

- The Batang account identifier - Lemon Squeezy order ID - Product and Variant identifiers - Test/Live environment information - Purchase date and order status - Payment and refund status - PRO entitlement status - Internal identifiers required to securely link a purchase to a The Batang account

The Batang does not store direct card payment information such as full card numbers or card security codes (CVC).

### 4) Purchase Restoration Information

If, when deleting an account, a user chooses to allow The Batang to retain information for restoring PRO Lifetime access later, The Batang may process the following minimum purchase-restoration information:

- A purchase-restoration identifier (HMAC) generated server-side from the user's Google account identifier - Lemon Squeezy order ID - Product and Variant identifiers - Test/Live environment information - Purchase date, payment/refund status, and PRO entitlement status - The Firebase UID linked after restoration and the restoration timestamp

The original Google account identifier is not stored directly in the purchase-restoration database.

Name and profile photo are not used for purchase restoration.

Purchase-restoration information is not sent to Google Analytics.

The Batang processes personal information for the following purposes:

- Google sign-in and account identification - User authentication and account security - Cloud storage and synchronization across devices - Maintaining service settings and the user's environment - Verifying PRO Lifetime purchases and providing entitlements - Handling refunds and payment-related inquiries - Restoring existing PRO Lifetime purchase rights where the user has chosen this option - Detecting and responding to abuse, errors, and security issues - Customer support - Service usage analytics and improvement where the user has allowed analytics

Personal information is processed only for the purposes described in this Policy or for purposes reasonably related to them.

Some The Batang features can be used without an account.

Certain desktop settings, widget settings, and content created while signed out may be stored only in the user's browser local storage.

Such data may not be transmitted to the Operator's servers and may be lost if browser data is deleted, the browser is changed, or the device is changed.

The Batang uses Google Analytics 4 (GA4) to understand and improve service usage.

The Batang provides visitor analytics settings that allow users to make choices regarding analytics. If analytics is enabled, the following information may be processed:

- Cookies and Analytics identifiers - Page and service-use events - Session information - Browser and device information - Approximate geographic information - E-commerce events related to the purchase and checkout process

The Batang may also connect the same Google Analytics property to Lemon Squeezy Checkout. In that case, e-commerce events such as checkout views, payment-information entry, and purchase completion may be sent to Google Analytics.

The Batang's current Google Analytics data-retention settings are:

- User data: 14 months - Event data: 2 months - Reset retention period for user identifiers on new activity: Enabled

The retention period for user identifiers may therefore be reset when new activity occurs. These retention settings may not represent the retention period of all aggregated Google Analytics reports.

Users can change their analytics choices through The Batang's visitor analytics settings or relevant browser settings.

The Batang generally deletes personal information when the purpose for processing it has been fulfilled.

However, information may be retained separately where required by law or where necessary for payments, refunds, dispute resolution, or purchase restoration chosen by the user.

General retention periods include:

- Account and cloud synchronization data: until account deletion or termination of service use - Records relating to contracts or withdrawal/cancellation: 5 years where required by applicable law - Records relating to payments and supply of goods/services: 5 years where required by applicable law - Records relating to consumer complaints or dispute handling: 3 years where required by applicable law - Google Analytics data: currently 14 months for user data and 2 months for event data; the retention period for user identifiers may reset when new activity occurs - Purchase-restoration information: where the user chooses retention at account deletion, until the earliest of termination of The Batang service, the user's request to delete purchase-restoration information, or the point at which no valid purchase remains eligible for restoration, such as after a full refund

Transaction records retained because of legal obligations are managed separately from purchase-restoration information.

Users may delete their The Batang account through the account-deletion feature provided by the service.

When an account is deleted, general account information and cloud synchronization data are processed for deletion.

During account deletion, users may choose whether to allow The Batang to retain the minimum purchase-restoration information needed to restore PRO Lifetime access in the future. This option may be presented as unselected by default.

If purchase-restoration retention is selected, The Batang retains a server-generated identifier derived from the Google account identifier and the minimum purchase/refund/entitlement information necessary for restoration.

If the user later signs up again with the same Google account and a valid purchase is confirmed, existing PRO Lifetime access may be linked to the new account.

When purchase restoration is performed, The Batang verifies the signed-in account server-side and may re-check the order and refund status with Lemon Squeezy.

A valid purchase that has received only a partial refund may remain eligible for restoration. Fully refunded or cancelled purchases are not eligible.

If the user does not choose to retain purchase-restoration information, the purchase-restoration identifier is deleted, and automatic purchase restoration may no longer be available.

Purchase restoration applies only to PRO access. Widgets, notes, settings, cloud-synced data, and other service-use data deleted with the account are not restored.

Automatic transfer of purchase rights to another Google account is not supported. Where necessary, users may request a separate review by contacting support@thebatang.com.

The Batang uses the following external services to provide and operate the service.

### Google / Firebase

Provider: Google LLC

Purposes:

- Google sign-in and Firebase Authentication - Storage of account profile and synchronization data through Cloud Firestore - Service infrastructure such as Cloud Functions and Hosting - Service analytics through Google Analytics

Confirmed primary storage/processing locations include:

- Cloud Firestore: Seoul, Republic of Korea (asia-northeast3) - Firebase Authentication: United States

Firebase Authentication may process basic account information supplied by Google, including UID, email address, display name, profile photo URL, and technical authentication information.

### Lemon Squeezy

Provider: Sold through Link, LLC / Lemon Squeezy

Purposes:

- PRO purchase and payment processing - Tax processing - Order and refund management - Receipts and invoices - Payment disputes and chargebacks - Purchase-history verification and PRO purchase-restoration support

Lemon Squeezy processes payments for The Batang PRO as the Merchant of Record.

Because The Batang uses global service providers such as Google, Firebase, and Lemon Squeezy, personal information may be processed or stored in countries other than the user's country or region of residence.

Where personal information is transferred internationally, The Batang seeks to apply safeguards and procedures required by applicable privacy laws.

For users in the Republic of Korea, the primary cross-border processing arrangements currently identified are as follows:

| Recipient / Processor | Primary Processing Location | Information Processed | Purpose | Timing and Method | Retention | |---|---|---|---|---|---| | Google LLC / Firebase Authentication | United States | UID, email address, display name, profile photo URL, and authentication-related technical information | Google sign-in, authentication, and account security | Transmitted over encrypted networks during sign-in and authentication | For the period required for account use and under Firebase policies | | Google LLC / Cloud Firestore | Seoul, Republic of Korea | UID, email address, cloud synchronization data, purchase-restoration identifier, and purchase-entitlement linking information | Account profile, synchronization, entitlement management, and purchase restoration | Transmitted over encrypted networks during service use | In accordance with the retention periods described in this Policy | | Google LLC / Google Analytics | United States and other locations where Google processes the service | Analytics identifiers, usage records, sessions, device/browser information, approximate location, and e-commerce events | Service analytics and improvement | Transmitted during service use after the user allows analytics | Currently 14 months for user data and 2 months for event data; user-identifier retention may reset on new activity | | Sold through Link, LLC / Lemon Squeezy | United States and other locations where the provider operates processing facilities | Purchaser and order information, product/payment/refund status | Payment, taxes, refunds, order management, purchase verification, and purchase-restoration support | Transmitted over encrypted networks during purchase and payment | In accordance with applicable law and Lemon Squeezy policies |

Because the default Cloud Firestore database is located in Seoul, Republic of Korea, storage in that database may not constitute a cross-border transfer for users in Korea. Other services, including Firebase Authentication, Google Analytics, and Lemon Squeezy, may process personal information outside Korea.

The Batang does not disclose users' personal information to third parties outside the original purposes of processing unless required or permitted by applicable law or the user has consented.

Payment information processed directly by Lemon Squeezy as the Merchant of Record is handled according to Lemon Squeezy's own services and privacy practices.

Personal information is deleted without undue delay when the applicable retention period ends or the purpose of processing has been fulfilled, unless separate retention is required by law.

Electronic information is deleted using reasonable technical methods, and information retained because of legal requirements is separated from other uses where appropriate.

Purchase-restoration information is deleted when the user requests deletion, the service is terminated, or the restoration purpose ends because no valid purchase remains eligible for restoration, including after a full refund.

Subject to applicable law, users may exercise rights relating to their personal information, including:

- Confirming whether personal information is being processed - Requesting access - Requesting correction or deletion - Requesting restriction of processing or withdrawing consent - Deleting an account - Requesting deletion of purchase-restoration information - Exercising other privacy rights available under applicable law

Requests may be submitted to support@thebatang.com.

Where identity verification is necessary, The Batang may use an appropriate verification process to protect the user's personal information.

The Batang takes reasonable technical and organizational measures to protect personal information.

These measures may include:

- Encrypted communication over HTTPS - Authentication through Firebase Authentication - Per-user data-access controls - Server-side verification of payments and orders - HMAC processing of the Google account identifier used for purchase restoration - Keeping API keys, webhook secrets, and other credentials out of client-side code - Restricting data access to what is necessary - Security and error monitoring

However, no method of data transmission or storage over the internet can guarantee absolute security.

The Batang does not intend to knowingly collect personal information from children without any consent required by applicable law.

Where the law of the user's country or region requires parental or guardian consent for processing a child's personal information, that law applies.

If you believe that a child's personal information has been processed without required consent, contact support@thebatang.com.

This Policy may be revised when service features, external services, or applicable laws change.

If a change materially affects users' rights, The Batang will provide notice through the service or another appropriate method.

The revised Policy will display the updated last-updated date and effective date.

For questions regarding personal information processing, account deletion, purchase-restoration information, or the exercise of privacy rights, contact:

Operator: RASEYOCA Service: The Batang Email: support@thebatang.com

The YouTube widget uses the YouTube IFrame Player API and Privacy Enhanced Mode (youtube-nocookie.com). Before the first video connection, you must agree to this Privacy Policy. The player and YouTube API are not loaded until you agree and apply a video link.

Loading the player may share your IP address, browser and device information, and requested video or playlist information with Google/YouTube. Playback shares additional playback information, and YouTube may use cookies or similar technology or show advertisements. Privacy Enhanced Mode does not prevent all data transmission. Google's Privacy Policy governs Google/YouTube's processing.

The Batang saves your video or playlist link, playback mode, repeat setting, and widget policy consent version as workspace settings. If you sign in and use cloud sync, these settings are included in the existing workspace sync. The Batang does not collect YouTube login credentials, your YouTube account's watch history, or playback progress. Deleting the widget removes it from that desktop's settings; other account-data deletion and retention provisions of this policy still apply.

With your separate permission for advertising measurement, the Google tag connected to Google Ads may process ad-click identifiers (such as GCLID, GBRAID and WBRAID), advertising measurement cookies, and events for visits, workspace entry, widget additions, PRO information, checkout opening and server-verified purchases. These are used to connect advertising visits with service activity and evaluate advertising effectiveness.

An earlier analytics acceptance does not grant advertising permission. Advertising measurement is optional and can be changed through analytics preferences. Personalized advertising, Google Signals, and transmission of email addresses or phone numbers for enhanced conversions are not enabled.

Verified purchase events include a transaction ID and, where verified, the amount and currency. This site's measurement events do not include widget content, Google/Firebase account IDs, email, purchase-restoration HMACs or payment credentials. Allowlisted advertising and campaign URL parameters may be passed to same-site links to preserve attribution during navigation.

When a free signed-in member enables focus recording, we store timer type, start and end times, session completion, manual edits, recording preferences and the record time zone in Firebase Cloud Firestore linked to that account. These provide your personal daily and weekly statistics and access across devices. They do not verify actual studying or create a public ranking.

Recording starts after activation. Pauses, breaks and unobserved periods while the browser is closed or suspended for a long time are excluded. Unsent records may be temporarily stored in the same browser for retry. Records do not include note, task or widget text, coupon codes or payment details.

Personal recording is separate from optional GA4 analytics and Google Ads measurement consent. Enabling recording does not grant those permissions or send detailed focus records to GA4 or Google Ads. Existing timers remain available without signing in or enabling recording.

Records are retained until you delete them or delete your account. My focus provides recording pause, individual duration edits and deletion, full history deletion and CSV export of currently loaded records. Individual deletion removes timing data and keeps a minimal deletion marker to block stale device replays. Full history or account deletion also removes those markers. The report loads up to 5,000 sessions from the last 366 days.