Privacy policy

MarketSurfer (the "operator") establishes and publishes this policy under Article 30 of the Personal Information Protection Act to protect members' personal data. The personal data processed by the service and the retention period for each item are as follows.

The Toss mini app (Apps in Toss) is not currently operated, so its items are not included in this section. If we start operating it, we will add its processing items to this policy and notify you before they take effect.

• Sign-up and sign-in — Email address, account identifier for each sign-in method (Google, Kakao, email link), name or nickname, profile picture URL (where Google or Kakao provides it) · Collected: When you sign up or sign in · Stored: Database (Supabase, Seoul region, Republic of Korea) · Retention: Kept until you withdraw your membership and destroyed immediately upon withdrawal
• Keeping you signed in — Sign-in session records (connecting IP address, browser information (User-Agent), sign-in and refresh times) · Collected: When you sign in and when your sign-in is refreshed · Stored: Member authentication service (Supabase Auth, Seoul region, Republic of Korea) · Retention: When you sign out, that session ends, and session records are deleted when you withdraw. Records of sessions you have not signed out of are currently not automatically deleted after a set period
• Telegram linking — Telegram user ID (chat_id), Telegram username · Collected: Only when you request linking · Stored: Database (Supabase, Seoul region, Republic of Korea) · Retention: Kept until you unlink or withdraw your membership
• Subscription management — Subscription tier, whether and for how long you are a paid member, time and route of your first payment, referral code · Collected: When your subscription, payment, or Telegram link status changes · Stored: Database (Supabase, Seoul region, Republic of Korea) and the service server · Retention: Kept until you withdraw your membership (transaction records are retained as described under payments)
• Telegram bot and alert service — Telegram user identifier and display name, watchlist, registered holdings, alert prices and conditions you set, alert delivery settings, referral codes and registration history, subscription expiry notice records · Collected: When you register or change settings via bot commands or web screens · Stored: Service server (Railway) and its backup (GitHub); items registered on the web are kept in the database (Supabase, Seoul region, Republic of Korea) · Retention: Kept until you remove them or withdraw your membership
• Payment (bank transfer) — Depositor name, deposit amount, order code, original text of the banking-app deposit record · Collected: When a deposit is confirmed · Stored: Service server (Railway) and its backup (GitHub) · Retention: Deposit matching records are destroyed after 90 days (unmatched items when processing is complete), and transaction records (subscription product, amount, payment date) are retained for 5 years under the Electronic Commerce Act
• Customer inquiries — Inquiry content, Telegram user identifier, display name and username · Collected: When you send an inquiry through the bot · Stored: Forwarded to the operator’s Telegram conversation and not separately stored in the service database · Retention: Remains in the operator’s Telegram conversation and is currently not automatically deleted after a set period
• Community and reviews — Content of posts, comments and chats you write with attached images, display name at the time of writing, likes, review content and rating, automated moderation warning history · Collected: When you use the community and reviews · Stored: Database (Supabase, Seoul region, Republic of Korea) · Retention: Deleted together when you withdraw your membership. Posts you delete are taken off the screen, and their records remain until you withdraw
• Sending feedback — Feedback content, feedback category, address of the screen you sent it from · Collected: When you send feedback on the web · Stored: Database (Supabase, Seoul region, Republic of Korea) · Retention: When you withdraw, the link to your membership is removed and the content remains; it is currently not automatically deleted after a set period
• Learning and usage records (logged-in members) — Course quiz results (including first-attempt results and per-question correctness) and progress, whether a lesson video was played, recently viewed symbols · Collected: When you use the service while signed in · Stored: Database (Supabase, Seoul region, Republic of Korea) · Retention: Deleted together when you withdraw your membership
• Telegram conversations — Message content and display names, only in chat rooms designated by the operator · Collected: When you chat in a designated room · Stored: Service server (Railway) · Retention: Automatically deleted after 30 days
• AI features — Content you enter in the AI question, trading journal and portfolio features, Telegram display name, notes the AI summarized from conversations · Collected: When you use those features · Stored: Service server (Railway); sent to the AI provider to generate answers (Section 5) · Retention: Kept until you request deletion or withdraw your membership
• Visit statistics — Screens visited, referral source category, time the screen was visible, anonymous identifiers created by the browser (a tab-lifetime session identifier and a return-visit identifier that expires after 30 days), whether you are signed in or subscribed, and, if you are signed in, a linking key that pseudonymizes your member identifier (raw IP addresses and browser information are not stored) · Collected: When you view web screens · Stored: Database (Supabase, Seoul region, Republic of Korea) · Retention: Destroyed after 3 months. The return-visit identifier expires automatically in your browser after 30 days and is not extended when you return
• Outbound link click measurement — Name of the link you clicked, click time, link variant tag, raw browser information (User-Agent) (IP addresses are not stored) · Collected: When you click an outbound link provided by the service (an address starting with /go/) · Stored: Database (Supabase, Seoul region, Republic of Korea) · Retention: Currently not automatically deleted after a set period
• Server access records — Connecting IP address, browser information (User-Agent), requested address and time · Collected: Automatically, every time you access the web screens or the service server · Stored: Access records of the server operator (Railway) · Retention: Deleted after the retention period set by the server operator

The retention period for each item is stated in Section 1. When a retention period ends or the purpose of processing has been achieved, the data is destroyed without delay, and information that must be preserved by law is destroyed after the period set by that law. For items stated as not automatically deleted after a set period, we will delete them after confirmation if you request it.

We do not provide personal data to third parties except with the member's explicit consent or where the law requires it.

We entrust the following processing tasks to keep the service running smoothly. The processing location is where personal information is actually processed and stored, not where the provider is headquartered.

• Supabase Pte. Ltd. — Database and member authentication hosting (processing location: Seoul region, Republic of Korea · contact: privacy@supabase.com)
• Railway Corporation — Service server operation (processing location: Singapore · contact: privacy@railway.com)
• GitHub, Inc. — Operational data backup (private repository) (processing location: The United States and other countries where GitHub stores and processes data · contact: privacy@github.com)
• Anthropic PBC — Generating AI answers and summaries (processing location: United States · contact: privacy@anthropic.com)
• [Only when enabled] Functional Software, Inc. (Sentry) — Service error diagnosis (processing location: United States · contact: compliance@sentry.io)
• [Only when enabled] Microsoft Corporation (Clarity) — Screen-usage analysis (pricing and account screens) (processing location: United States or other countries where Microsoft processes data · contact: Microsoft Privacy, One Microsoft Way, Redmond, WA 98052, USA)
• [Only when enabled] Google LLC (Gemini API) — Fact-check search for AI questions (processing location: The United States and other countries where Google processes data · contact: 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA)

To perform the service contract, we entrust and store personal information as described below, and in the process personal information is transferred overseas. The countries listed are where personal information is actually processed and stored, not where the provider is headquartered.

The database that stores member accounts and community data (Supabase Pte. Ltd.) processes and stores data in the Seoul region of the Republic of Korea, so it is not listed below. Items marked “Only when enabled” are transferred only while that feature is turned on.

If you do not want your information transferred overseas, tell the Privacy Officer by email (ehdehddnehd@naver.com) or Telegram (@hoban_honey) that you refuse and which provider it concerns. After confirming, we stop your use of the features that transfer data to that provider and no longer transfer the related information. Features that cannot be provided without the transfer will become unavailable to you; the effect for each provider is described under “If you refuse” in each item.

• Recipient: Railway Corporation (contact: privacy@railway.com) · Destination country: Singapore · Items transferred: Telegram user identifier and display name, alert settings, watchlist, registered holdings, alert prices and conditions, bank transfer orders and deposit matching records, Telegram conversation records, AI feature usage records, server access records (connecting IP address and browser information), member information transmitted while using the service · Timing and method: Whenever you use the service, over encrypted network connections · Purpose: Service server operation · Retention and use period: Same as the per-item retention periods in Section 1 · If you refuse: The service runs on this server, so you will not be able to use the service at all
• Recipient: GitHub, Inc. (contact: privacy@github.com) · Destination country: The United States and other countries where GitHub stores and processes data · Items transferred: Telegram user identifier and display name, alert settings, watchlist, registered holdings, alert prices and conditions, referral codes and registration history, subscription expiry notice records, bank transfer orders and deposit matching records · Timing and method: Automatically every 15 minutes, over encrypted network connections · Purpose: Restoring operational data after an outage or restart · Retention and use period: The latest backup is kept for the same period as the original. However, past backup copies remaining in the repository change history are currently not deleted automatically on a set schedule · If you refuse: You will not be able to use the alert, watchlist, holdings registration, or bank transfer payment features, which cannot operate without backup
• Recipient: Anthropic PBC (contact: privacy@anthropic.com) · Destination country: United States · Items transferred: Questions you enter in the AI question feature and your Telegram display name, content you enter in the trading journal and portfolio features, messages and display names in chat rooms designated by the operator (when summarizing conversations) · Timing and method: Each time you use the relevant feature, over encrypted network connections · Purpose: Generating AI answers and summaries · Retention and use period: Kept for the period set by the provider’s terms after the response is generated, then deleted · If you refuse: You will not be able to use the AI question, trading journal, and portfolio features, or the designated chat rooms where conversations are summarized
• [Only when enabled] Recipient: Functional Software, Inc. (Sentry) (contact: compliance@sentry.io) · Destination country: United States · Items transferred: Address of the page where the error occurred, error details, stack information (configured not to include user identifiers or IP addresses) · Timing and method: Only when error diagnosis is enabled, each time an error occurs, over encrypted network connections · Purpose: Service error diagnosis · Retention and use period: Deleted after the retention period set by the provider · If you refuse: No member-identifying information is included, so refusing does not restrict your use of the service
• [Only when enabled] Recipient: Microsoft Corporation (Clarity) (contact: Microsoft Privacy, One Microsoft Way, Redmond, WA 98052, USA) · Destination country: United States or other countries where Microsoft processes data · Items transferred: page address, clicks, scrolling and mouse movement, browser information, IP address (text typed into input fields is set to be masked) · When and how: only when the screen analysis feature is on, each time you use the pricing or account screens, over an encrypted connection · Purpose: finding where visitors leave and improving screens · Retention: deleted after the retention period set by the provider · If you refuse: turning on your browser's Do Not Track setting stops transmission, and refusing does not limit your use of the service
• [Only when enabled] Recipient: Google LLC (Gemini API) (contact: 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) · Destination country: The United States and other countries where Google processes data · Items transferred: The text of AI questions that require fact-checking · Timing and method: Only when fact-checking is enabled, each time such a question arrives, over encrypted network connections · Purpose: Fact-checking for AI answers · Retention and use period: Kept for the period set by the provider’s terms, then deleted · If you refuse: You will not be able to use the AI question feature

We use a session cookie to keep you signed in. We do not use cookies for advertising or behavioural tracking.

You can refuse cookies in your browser settings, but features that require sign-in will then be unavailable.

Display settings such as theme are kept only in browser local storage and are never sent to the server.

For statistics on which screens are visited and for how long, we use a random session identifier that lasts only while the browser tab is open. It is deleted when the tab closes, is never used to track across other sites, and is not used for advertising. These statistics store no IP or browser information and are deleted after 3 months.

The statement that IP addresses and browser information are not stored applies only to visit statistics. When you click an outbound link provided by the service (an address starting with /go/), the raw browser information (User-Agent) is stored to measure clicks (IP addresses are not stored), and the connecting IP address and browser information remain in sign-in session records and in the server operator’s access records (Section 1).

Below are the cookies and storage this website actually places in your browser (based on a code review dated 2026-10-28). There are no advertising cookies and no tracking that follows you to other sites.

We do not provide a window for choosing consent cookie by cookie. You can block or delete cookies and site data in your browser settings; if you block the login cookie, you cannot use features that require login. The browser’s Do Not Track setting applies only to the screen analysis in Section 5 and does not apply to visit statistics.

The last three lines of the list are cases where your browser requests data directly from an outside provider’s servers. Whether those providers use their own cookies or storage, and what they contain, is decided by each provider and is not controlled by the operator. The providers marked “Only when enabled” in Section 5 (error diagnosis, screen analysis) run only when that feature is configured and the visitor has turned on “Analytics tools setting” at the bottom of the screen, and screen analysis runs only on the pricing and account screens.

• Login cookie (name starts with sb-) — keeps you signed in · essential · an HttpOnly, Secure cookie that is deleted when you log out; if you do not log out it is set to expire after at most 400 days · sent to the server with every request
• Language cookie (ms_lang) — remembers the display language you chose (Korean or English) · functional · 1 year · sent to the server with requests and used to decide the display language
• Login redirect cookies (ms_login_next, ms_login_provider) — carry the screen to return to and the login method after a social login · essential · deleted when the login process ends and expire after 10 minutes at the latest · sent to the server with the login return request
• App mode cookie (ms_app) — tells whether the page was opened inside the web view of an app · functional · a session cookie (HttpOnly) deleted when you close the browser, set only when the app start address carries the marker · sent to the server
• Referral link record (ms_ref) — if you arrive through a referral link (the ref= value in the address), remembers the referral code and attaches it when you link Telegram · functional · a cookie of 30 days; the same value is also kept in tab session storage, and it is deleted when linking ends · being a cookie, it is sent to the server with requests; when you link, it travels in the Telegram connection link to the bot and is recorded as “referral code and registration history” in Section 1
• Partner link cookies (ms_partner, ms_pvid, ms_ptouch) — set only if you arrive through a partner link with partner= in the address; they remember which partner code you came with so that attribution can be confirmed at sign-up · functional · ms_partner and ms_pvid last 90 days (HttpOnly), ms_ptouch lasts 1 hour · when you arrive through the link, the partner code, a random visitor number and the time are recorded on the service server (Railway) and its backup (GitHub); if you sign up afterwards, the attribution result (partner, click and sign-up times) is recorded against your account · not deleted automatically after a set period; deletion requests are handled under Section 2
• View-count cookie (name starts with cv_) — stops the view count of a community post from rising repeatedly when you refresh · functional · 24 hours (HttpOnly) · sent to the server only with the view request for that post
• Tab session storage (values such as ms_sid and those starting with ms_seen:) — a session identifier for visit statistics, and a marker that avoids counting the same screen again within 5 seconds · statistics · deleted when you close the tab · the session identifier is sent to the server and recorded as “visit statistics” in Section 1; the other markers are not sent to the server
• Returning-visitor identifier (ms_vid, browser local storage) — return-visit statistics · statistics · expires after 30 days and is not extended when you come back · sent to the server and kept for 3 months as “visit statistics” in Section 1
• Wording-comparison number (ms_cvid, browser local storage) — a random number that decides which of two wordings of the same screen to show you · statistics · stays until you clear it · this number is not sent to the server; only the experiment name and the assigned side are sent as an event label (English screens are not part of experiments)
• Analytics tools setting (ms_analytics_consent, browser local storage) — remembers whether you turned on the error-diagnosis and screen-analysis tools at the bottom of the screen · functional · stays until you clear it and is deleted when you turn it off · this value is not sent to the server
• Display settings (theme, values starting with ms_chart_, values starting with ms_lv_ or ms_ind_, and similar) — remember the theme, chart display options, sorting and filters, and notices you closed · functional · stays until you clear it · not sent to the server
• Inputs kept only on this device (drafts of posts and comments you are writing, record card entries, wallet stars and aliases saved on this device, practice scores and similar) — functional · stays until you clear it · values in this storage are not sent to the server. Features you save to your account while logged in are recorded separately on the account side as described in Section 1
• Service worker cache — keeps image and font files in the browser cache storage to speed up screens · functional · images and fonts for at most 30 days (configured limit) · stays inside the browser on this device and is not sent to the server
• jsDelivr (cdn.jsdelivr.net) and Google Fonts (fonts.googleapis.com, fonts.gstatic.com) — requests that download the body and numeral fonts · all screens · because your browser requests them directly from these providers’ servers, your IP address and browser information are passed to them
• TradingView (s3.tradingview.com, www.tradingview.com and others) — chart widget · only on screens that contain the widget · as above, your IP address and browser information are passed to the provider
• YouTube (youtube-nocookie.com) — playback of how-to videos · only on screens where a video is played · as above, your IP address and browser information are passed to the provider

Under Articles 35-37 of the Personal Information Protection Act, members may request access, correction, deletion, suspension of processing, or withdrawal of consent, through the contacts in Section 9. We handle requests according to the procedures and periods set by law, and where the law requires notice, such as when access is postponed or refused, we inform you of the reason and how to object within that deadline.

Separately, as our own operating commitment, we aim to tell you the outcome or progress of your request within 10 days of receiving it. This commitment is not a statutory deadline and is counted in calendar days.

Members who live abroad, such as in the EU, the UK or California, can make the requests described in Section 7 in the same way, using the contacts in Section 9 (email or Telegram).

Where the law of your place of residence applies (for example the GDPR in the EU and UK, or the CCPA and CPRA in California), you may, within the scope that law sets, request access, correction, deletion, restriction of processing, objection to processing based on legitimate interests, data portability (receiving a copy of the information you provided), and withdrawal of consent. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal. You also have the right to lodge a complaint with the data protection authority where you live.

The legal bases (for the EU and UK) are as follows. Processing to provide the services you asked for, such as accounts, subscriptions and alerts, rests on performance of a contract; keeping transaction records rests on a legal obligation; visit statistics, service error diagnosis and confirming partner referrals rest on the operator’s legitimate interests. Processing for which we have obtained consent rests on that consent. The purpose of each item is given in Section 1.

Deletion requests are handled within the scope described in Sections 2 and 5. Transaction records that must be kept for 5 years under the Electronic Commerce Act remain for that period, and past backup copies remaining in the GitHub change history are currently not deleted automatically on a set schedule. If any part cannot be deleted right away, our reply tells you so and why. Replies follow our own operating commitment in Section 7 (we aim to tell you the outcome or progress within 10 days of receiving the request); these 10 days are not a statutory deadline.

Notice for members who live in California: the operator does not sell personal information to third parties in exchange for payment (Section 3) and does not track you across other sites for advertising (Section 6). We do not change fees or terms of use solely because you exercised a right.

Personal data whose retention period has passed, or whose purpose is fulfilled, is destroyed without delay in an unrecoverable manner.

Personal data is stored in an access-controlled database, and transport is encrypted with TLS.

We take overall responsibility for personal data processing and have designated the data protection officer below to handle enquiries, complaints and remedies from data subjects.

• Data protection officer — Name: 임태욱 · Title: Representative
• Contact — email ehdehddnehd@naver.com · Telegram @hoban_honey
• Business — Surf’strategy · Business registration no. 714-14-02860
• Address — 충청북도 청주시 흥덕구 가경로 8-1, 5층 5669호(가경동, 태경빌딩)

To report or seek advice about a privacy infringement, you can contact the bodies below.

• Privacy Infringement Report Centre — privacy.kisa.or.kr · 118 (no area code)
• Personal Information Dispute Mediation Committee — kopico.go.kr · 1833-6972
• Supreme Prosecutors' Office Cyber Investigation Division — spo.go.kr · 1301
• National Police Agency Cyber Bureau — ecrm.police.go.kr · 182

If this policy changes, we post notice in the service 7 days before it takes effect.