Draft · under review This draft hasn't finished legal and operator review yet. We'll remove the draft label once the 41 marked items are settled.

Project RAG Privacy Policy

Effective date: Effective date — Month D, YYYY

WOO KWANG WAN (우광완, the "Operator") runs Project RAG (https://rag.proj.run, the "Service"). This Privacy Policy explains how the Operator handles and protects users' personal information, as required by Article 30 of the Korean Personal Information Protection Act ("PIPA"). It is published in English and Korean; see section 16 for which version prevails.

At a glance

• You sign in only with a Google account. We never ask for a password.
• We mainly handle the Google account identifier needed for sign-in and, for notices, the email address Google has verified (stored encrypted).
• We use no advertising or analytics cookies and no tracking tools. We do not sell personal information or give it to other companies for their own use.
• The Service runs on Cloudflare's global network, so your information is processed outside Korea, including in the United States.
• YouTube and Vimeo receive data from your browser only after you press play on a video link.
• When you leave, account information is deleted at once and file originals are erased after the recovery retention period (about 36 to 45 days).

1. Why we process personal information

We process personal information only for the purposes below. If a purpose changes, we tell you in advance and ask for any consent needed.

1. Member identification and sign-in: confirming who you are, keeping you signed in, confirming your age (14 or older), and preventing account takeover.
2. Providing the file service: storing files and versions, managing storage quotas and upload limits, checking sharing rights, serving public files and downloads, keeping fork and evaluation records, calculating levels, registering and checking external links and video links, and managing agent (MCP) connections.
3. Service notices: sending email you need to use the Service, such as quota warnings, security notices about new agent connections, moderation notices, report status updates and digests of files you follow.
4. Reports and protection of rights: receiving and handling rights and illegal-content reports, notifying affected owners, handling contests, and keeping records of decisions.
5. Stable operation: counting usage to prevent excessive use and abuse, blocking bots on anonymous forms, responding to failures, and making and restoring backups.
6. Answering questions: replying to messages sent to contact@proj.run.

2. What we process and how long we keep it

• We do not collect national ID numbers, sensitive information (such as health or political views) or payment information.
• The automatic check of content for public workspaces (phone numbers, national ID numbers, card numbers, email addresses, access tokens, private keys, signed addresses) happens only while your request is being processed. Found values are never stored or logged.
• If you put other people's personal information inside a file, it is stored with the file. The member who uploads a file is responsible for checking the personal information in it.
• If the law requires us to keep something for a set period, we keep it separately for that period.

2-1. Notice emails

• What we receive: only one email address that Google marks as verified when you sign in with Google. We do not ask for extra permissions and do not take addresses through any other route, such as a form. We do not store addresses Google has not verified. A saved address changes only when Google sends a verified address at sign-in.
• What we use it for: only for Service notices: storage quota warnings (80 %, 95 %, 100 %) and storage moved to you from a deleted original; a security notice each time a new agent connection is approved; moderation notices about your content and the result of contests; status changes of reports you made; a digest of files you follow; and, for the administrator, new reports. We send no advertising or marketing email.
• How we protect it: the address is stored encrypted and shown only partly hidden in account settings. Emails contain no file titles or contents, no report text or reasons for decisions beyond the fixed ground and effect, and no information about other members. They carry only a link to the page to check.
• Turning notices off and deleting the address: you can turn notices off or on at any time in account settings. When notices are off, no email is sent, and the saved address is kept for when you turn them back on. "Delete address" deletes the saved address and any of your unsent notices at once, and turns notices off. After that, the address is not saved again at sign-in until you turn notices back on.
• How long we keep it: until you delete it yourself or leave. Delivery records contain no address and are deleted 30 days after delivery ends. Deletion is done by a recurring job, so it may take a few minutes.
• Notices are sent from noreply@proj.run, in the language you chose. The contact address is contact@proj.run.

3. How and when we destroy personal information

1. Procedure: information whose retention period has ended, or whose purpose is fulfilled, is deleted in bounded batches by automatic clean-up jobs. If there is a lot of data, full deletion can take longer.
2. Method: electronic records in databases and storage are deleted so that they cannot be recovered. We do not make paper records.
3. When file originals are erased: when you delete a version or file, it stops being viewable at once and its size is returned to your storage quota at once. The original bytes are physically erased about 36 days later (the 35-day storage protection lock plus one day), and the whole process can take about 36 to 45 days. This delay makes sure that a database restore never points to missing originals. During that time no one can view or download the file. If a fork still refers to the same bytes, the bytes are kept for that fork. LEGAL REVIEW
4. Backups: database recovery points keep the state before deletion for up to 30 days, and encrypted backup copies keep it for up to 90 days (locked for the first 30 days). These are used only to recover from failures and disappear automatically. If we restore from a backup, deletions and departures made in the meantime are applied again. For this, we keep only the random member ID and the time of departure of members who left.
5. Urgent erasure: if a file must be erased sooner (for example, personal information uploaded by mistake), delete it and also write to contact@proj.run. LEGAL REVIEW
6. Making content private or removing access: when you remove someone's access or withdraw a public workspace, copies that others have already downloaded or forked cannot be recalled.

4. Giving personal information to third parties

We do not give personal information to other people or companies, except in these cases:

1. when a law specifically requires it, or an investigative agency asks for it following the procedure and method set by law;
2. when you choose to make it public: files in public workspaces with their titles and file names, your public contributor ID and the public contributions linked to it can be seen by anyone;
3. when you allow it: an agent you connect receives the content within the scope you allowed, and its later handling follows the agent provider's terms;
4. when you press play on a video link: your browser then connects directly to YouTube or Vimeo (see section 8-1). We do not send them your account information.

5. Processors

We entrust the following processing to these companies to run the Service. We check that our contracts with them require safe handling of personal information. LEGAL REVIEW

• With Google sign-in you sign in to Google directly and the Service receives the result. Whether Google is our processor or an independent provider needs legal review. LEGAL REVIEW
• YouTube (Google LLC) and Vimeo, Inc. are not our processors. They receive data from your browser only after you press play, under their own policies (section 8-1).

6. Transfers outside Korea

The Service runs on the facilities of overseas companies, so using it transfers personal information outside Korea. These transfers are necessary to perform our contract with you. We give the following notice under Article 28-8 of PIPA. LEGAL REVIEW

How to refuse, and what happens: if you do not want your information transferred abroad, you can stop using the Service and leave. Without these transfers we cannot sign you in or store anything, so you cannot use the Service. Viewing public files without signing in also passes through Cloudflare's facilities.

7. How we keep personal information safe

We take the following measures under Article 29 of PIPA. LEGAL REVIEW

1. Administrative: only the Operator can handle personal information. We set and follow an internal management plan. Confirm that the internal management plan is written
2. Encryption: all connections use HTTPS. Notification email addresses and non-member reporter contacts are stored encrypted. Session values and agent tokens are stored only as irreversible hashes, and your Google account ID only as a one-way hash. Backups are encrypted.
3. Access control: each time a file is read or changed, the server checks the current member, workspace and file permissions in the same step as the change. Agents work only where the access you allowed overlaps with your own current access. Permission to see reports does not give permission to see private files.
4. Sign-in protection: sign-in cookies are set to work only on this site and only over encrypted connections. You must sign in again after 30 minutes without activity or after 12 hours. We email you whenever a new agent connection is approved.
5. Separate download address: files are delivered from https://files.proj.run, which never receives your sign-in cookies. Private downloads use links that expire within 5 minutes.
6. Minimum collection: usage without signing in is counted only by a group number made from the IP address with a secret key, without storing the IP address. Our logs contain no IP address, email address or file contents.
7. Records of handling: decisions on reports are recorded so that who did what and when cannot be changed.
8. Physical: servers and storage run in Cloudflare's data centers and follow Cloudflare's physical security measures.

8. Cookies and similar technologies

1. The Service uses only the cookies below. We use no advertising, analytics or tracking cookies.

1. We also keep the following briefly in your browser's storage. It contains nothing that identifies you.
2. the upload ID and SHA-256 of an upload in progress, so that you can resume it (removed when the upload finishes or is cancelled);
3. a signal that signs you out in all tabs at once.
4. How to refuse: you can block cookies in your browser settings. If you do, features that need sign-in will not work, but you can still find and download public files without signing in.

8-1. Video playback

• Video link files show a placeholder. Until you press play, your browser sends no request to YouTube or Vimeo.
• When you press play, the page loads YouTube's privacy-enhanced player (www.youtube-nocookie.com) or Vimeo's player with "do not track" (player.vimeo.com, dnt=1). From then on, your browser sends data such as your IP address, browser information and the video you watch directly to YouTube (Google LLC) or Vimeo, Inc., and they may set their own cookies or similar storage. Their privacy policies apply: YouTube/Google privacy policy URL VERIFY and Vimeo privacy policy URL VERIFY.
• Our page allows video frames only from these two player addresses.
• If you do not want this, do not press play. You can open the video on the provider's own site instead, which is also governed by their policies.

8-2. External links and link checks

• Links to other websites open only after a confirmation page that shows the full address. The page asks your browser not to send the address of our page (no referrer) to the other site.
• To show whether a link still works, our server sends a limited number of status requests to the linked address (for videos, to the provider's public oEmbed address). These requests come from our server, not your browser, carry no information about you, and never read the content.
• If you ask us to fetch a video's title and channel, our server asks the provider's oEmbed address once and stores only the title and channel name.

9. Your rights and how to use them

1. You can ask at any time to:
2. see your personal information;
3. correct or delete it;
4. stop its processing;
5. withdraw consent;
6. have it transmitted under Article 35-2 of PIPA (where it applies). LEGAL REVIEW
7. What you can do yourself:
8. turn notices on or off and delete your email address: account settings;
9. check and disconnect agent connections: Account → Agent connections;
10. get a list of your files and their originals: Account → Download my data;
11. remove access you gave, delete files and versions, withdraw a public workspace, transfer a workspace: workspace settings;
12. turn search-engine visibility on or off per public file: the file's settings;
13. leave the Service: Account → Leave Project RAG.
14. Asking the Operator: write to contact@proj.run in English or Korean. After confirming who you are, we act within 10 days and tell you the result. If the law requires us to refuse or delay, we tell you why and how to object. LEGAL REVIEW
15. Representatives: a legal representative or someone you authorise can also ask. Please include a letter of authority.
16. To confirm who you are, we never ask for passwords, codes or sign-in details. Do not send them.
17. If another person's file contains your personal information, you can ask for deletion or a temporary measure on the Rights and Reporting page.

9-1. Download my data

Account → Download my data gives you a ZIP file containing a manifest.json file (with a published schema version) and the originals of files in workspaces you own. The manifest lists your workspaces, files, versions (number, name, SHA-256, size, time, visibility), references, aliases, links between files, access you gave, the evaluations and correction notes you made, and the reports you filed. External links and video links are listed as records (address, declared fingerprint, start and end) without content. Your email address and Google account information are not included. You can make one export per day, and each export can be downloaded for 7 days.

10. Children

The Service does not accept children under 14 as members and does not knowingly collect their personal information. When you first sign in, you confirm that you are 14 or older. If we learn that a member is under 14, we stop that account and delete the related information. Parents or guardians can tell us at contact@proj.run. LEGAL REVIEW

11. Leaving the Service and what remains

1. Deleted at once: when you confirm leaving, the following are deleted in the same step: your Google account link, your saved notification email address and settings, your unsent notices and delivery records, all sign-in sessions and re-confirmation records, agent connections and tokens, access rights you received or gave, follows, and the link between your account and your contributor IDs. Your display name changes to "Former member".
2. Cleaned up automatically: workspaces you own, with all their files, versions, links and evaluation records, stop being viewable and drop out of public search and the sitemap at once, and are removed from the search index by follow-up jobs. Related database records are deleted in bounded batches. Original file bytes are physically erased after the 35-day storage protection lock plus one day, which takes about 36 to 45 days after you leave in total. This delay makes sure that a database restore never points to missing originals. During that time no one can view or download them. LEGAL REVIEW
3. What remains: forks other members made remain as their content. Evaluations, correction notes, links and posts you left on other members' files or in public spaces remain, shown as by "Former member". Reports being handled or archived remain with their statements so they can be handled and the record kept, but the reporter is not shown and information that connects them to you is deleted. Text you wrote in a report statement is not erased, so do not put personal information in report statements.
4. Internal IDs: internal records used to check the integrity of storage and report handling and to prevent double processing keep only random member IDs and random contributor IDs. These are not linked to a name, email address or Google account and are never reassigned to another member.
5. No recovery: leaving cannot be cancelled or undone, and deleted accounts and files cannot be restored. Download what you need with Download my data before you leave. Public content that was already copied elsewhere cannot be recalled.
6. Backups and recovery records: database recovery points (up to 30 days) and encrypted backup copies (up to 90 days) may still contain your state before you left, including your encrypted email address and the hash of your Google account ID. These are used only to recover from failures. If we restore, your departure is applied again. For this, we keep only your random member ID and the time you left.
7. Signing up again: if you register again with the same Google account, you start as a new member. Files, access rights, evaluations, levels and contribution records from the earlier account do not carry over. If sign-up is closed at that time, ask contact@proj.run for an invitation.

12. Automated processing

The following happen automatically, without a person deciding each case. We believe these are not "automated decisions" under Article 37-2 of PIPA, but you can ask for an explanation or object to any of them. LEGAL REVIEW

• Check for public workspaces: if content for a public workspace contains a personal or secret information format, saving is refused and you are told which field and which type were found. You can still save it in a private workspace.
• Illegal-content hold: when a version in a public workspace is reported as illegal content, it is put on hold until the Operator reviews it. The owner is told that the hold was automatic and how to contest it.
• Blocklist: files whose SHA-256 fingerprint matches confirmed illegal material are refused in public workspaces.
• Link checks: links whose address answers "not found" or "gone" are marked "Link broken", and videos that the provider reports as deleted or private are marked "Unplayable". The link itself is kept.
• Levels: your level is calculated automatically from how other members use and evaluate your public contributions. It changes only your badge and your storage and upload amounts. It never gives access to private content.
• Usage limits: requests above a limit are refused until the stated time.

13. Privacy officer

Please contact us for questions, complaints or remedies about personal information. We answer and act without delay.

• Privacy officer: WOO KWANG WAN (우광완, the Operator)
• Email: contact@proj.run (English or Korean)

14. Users outside Korea

1. The Service is offered worldwide in English and Korean. This Policy is based on Korean law, which governs the Service.
2. At launch, the Service is not directed at users in the European Union, and we have not appointed an EU representative. LEGAL REVIEW
3. Wherever you live, you can use the rights in section 9 (see, correct, delete, export, object), and we answer in English or Korean.
4. If you believe we have not handled your request properly, you can also contact the data protection authority where you live.

15. Remedies

For dispute resolution or advice about a privacy infringement, you can contact the following Korean bodies.

[VERIFY: check each contact again just before publication.]

16. Language of this Policy

1. This Policy is written in English and Korean, with equal care and the same structure.
2. Prevailing version — counsel to choose, same rule as Terms Article 3 LEGAL REVIEW

17. Changes to this Policy

When we change this Policy, we announce it on the Service at least 7 days before it takes effect. For important changes, such as the items collected, the purposes of use or giving information to third parties, we announce it at least 30 days before. LEGAL REVIEW