Privacy Policy

Madang (madang.im, the "Company") complies with Korea's Personal Information Protection Act (PIPA), the Act on Promotion of Information and Communications Network Utilization and Information Protection (the "ICN Act"), and related regulations. This Privacy Policy explains how we process personal information related to our digital Sand Tray Therapy service. The Korean version above is authoritative in case of any conflict.

Article 1 — Purposes of Processing

1. Account registration and management: identification, age verification (14+), abuse prevention, account maintenance, notifications.
2. Service provision: creating, saving, retrieving, and deleting sand tray sessions; autosave; therapist–client session sharing when assigned by an administrator.
3. Customer support: identifying inquirers, investigating issues, communicating results.
4. Service improvement and statistics: feature development, quality improvement, pseudonymized or de-identified analytics.
5. Legal compliance: meeting obligations under applicable law.

Article 2 — Categories of Personal Information

1. Collected at signup

• [Required] From OAuth provider (Google, Naver, etc.): email address, provider-assigned identifier (sub/id), authentication tokens.
• [Required] Provided by user: username (handle).
• [Optional] From OAuth provider: display name (when provided by the provider).

2. Automatically collected during use

• Access IP, timestamps, access logs, browser/OS info, screen resolution.
• Cookies and localStorage (auth tokens, language preference, autosave drafts).
• Usage records, error logs.

3. Generated by the user during use

• Sand tray session content (height field, figure placement, name, timestamps).
• This is treated as sensitive information under Article 10 below.

Article 3 — Retention Period

• Account information: until account deletion.
• Session content: until account deletion or user deletion of the specific session.
• Access logs: up to 3 months (per Korea's Protection of Communications Secrets Act).
• Abuse records: 1 year.

On account deletion, all personal information and user-generated content is permanently erased within 5 business days, subject to legally required retention exceptions.

Article 4 — Third-Party Sharing

We do not share personal information with third parties, except: (a) as required by law, (b) with the user's prior explicit consent, or (c) for assigned therapists viewing their clients' sessions (read-only, only after admin assignment).

Article 5 — Processors

We entrust certain processing operations to Amazon Web Services, Inc. for data storage (DynamoDB), authentication (Cognito), CDN (CloudFront), and server hosting (EC2). Per PIPA Article 26, our agreement with AWS prohibits use beyond the entrusted purpose, requires technical and managerial safeguards, restricts re-delegation, and provides for monitoring.

Article 6 — International Transfer

Primary processing occurs in the Seoul region (ap-northeast-2). Some authentication metadata and CDN edge cache may be replicated globally, including to us-east-1 (United States). You have the right to refuse this transfer; refusal may limit your ability to use the service.

Article 7 — Your Rights

• Right to access, correct, delete, or pause processing of your personal information.
• Right to withdraw consent — Account menu → Delete account.
• Requests via the contact below.

Article 8 — Destruction

Electronic data is destroyed via DeleteItem on DynamoDB and AdminDeleteUser on Cognito; backups expire automatically per their retention cycle.

Article 9 — Security Measures

• TLS 1.2+ for all client–server traffic.
• At-rest encryption via AWS-managed keys (AES-256).
• IAM least-privilege access control.
• No passwords stored locally; delegated to OAuth providers / Cognito.
• JWT verification, token rotation, rate limiting.

Article 10 — Sensitive Information (PIPA Article 23)

Sand tray session content may reflect emotional or psychological state and is therefore treated as sensitive information. We process it only with separate explicit consent at signup, never share it without consent, never use it for marketing, and erase it on account deletion. Therapist access is limited to admin-assigned therapist–client links.

Article 11 — Children Under 14

This service is not intended for children under 14. Registration by minors under 14 is prohibited; on discovery, the account and all associated data is deleted immediately.

Article 12 — Cookies and Local Storage

We use cookies and browser localStorage to maintain login state, language preferences, and autosave drafts. Users may disable storage via browser settings; doing so may impair functionality such as session restoration.

Article 13 — Behavioral Information

We do not currently collect or share behavioral information for advertising. Any future use will be subject to separate consent and a policy update.

Article 14 — Additional Use and Provision

Per PIPA Articles 15-2 and 17-2, we may additionally use or provide personal information without separate consent only where: relevance to the original purpose, predictability, no significant risk to user interests, and adequate safeguards are met.

Article 15 — Pseudonymized Data

We may process pseudonymized data for statistics, scientific research, or public-interest record-keeping under PIPA Articles 28-2 to 28-7, with appropriate safeguards.

Article 16 — Data Protection Officer

Data Protection Officer: [Operator name — to be filled in] · contact@madang.im
Privacy Department: Madang Operations · contact@madang.im

Article 17 — Remedies

You may contact the following authorities in Korea regarding privacy violations:

• Personal Information Dispute Mediation Committee: 1833-6972 · www.kopico.go.kr
• Korea Internet & Security Agency (KISA): 118 · privacy.kisa.or.kr
• Supreme Prosecutors' Office, Cybercrime: 1301 · www.spo.go.kr
• Korean National Police Cyber Bureau: 182 · ecrm.police.go.kr

Article 18 — Changes

Material changes will be announced at least 7 days in advance (30 days for changes affecting fundamental user rights).

Effective: May 11, 2026.
Contact: contact@madang.im · https://madang.im

Terms of Service

These Terms of Service ("Terms") govern the relationship between Madang (madang.im, the "Company") and registered users ("Members") regarding the Company's Sand Tray Therapy-inspired digital service ("Service"). By accepting these Terms, you agree to be bound by them. The Korean version above is authoritative in case of any conflict.

Chapter 1 — General Provisions

Article 1 — Purpose

These Terms govern the conditions and procedures for using the Service, the rights, obligations, and responsibilities between the Company and Members, and other necessary matters.

Article 2 — Definitions

1. "Service" means all digital tools provided by the Company via madang.im and related subdomains, inspired by Sand Tray Therapy.
2. "Member" means a person who agrees to these Terms and registers per the Company's procedures.
3. "Client" means a Member who creates and manages their own sand tray sessions.
4. "Therapist" means a Member granted permission by an administrator to view sessions of assigned Clients. The "therapist" label is an operational role only and does not certify qualifications under Korea's Medical Act or Mental Health Act.
5. "Admin" means a person designated by the Company with operational authority.
6. "Session Content" means the sand tray data (height field, figure placement, metadata) created by a Member.
7. "Third-party Auth" means OAuth/OIDC providers (Google, Naver, etc.) used for sign-in.

Article 3 — Posting and amendments

The Company will post these Terms within the Service. The Company may amend these Terms within the limits of applicable laws including the Act on the Regulation of Terms and Conditions, the ICN Act, and PIPA. Material amendments will be announced at least 7 days in advance (30 days for changes unfavorable to Members). Failure to object within the notice period is deemed consent.

Article 4 — Interpretation

Matters not specified herein are governed by applicable laws, the Company's operational policies, and general business practice.

Chapter 2 — Registration and Account Management

Article 5 — Formation of contract

A use contract is formed when an applicant agrees to these Terms and the Privacy Policy, applies per the Company's procedures, and the Company accepts the application. Registration may be refused or revoked for applicants under 14, those using stolen identities or false information, or those who have engaged in prohibited conduct.

Article 6 — Member information and username (handle)

The handle is selected once at signup and is generally non-changeable. Handles must be 3-30 characters; lowercase letters, digits, hyphen, underscore only; not reserved; not infringing others' rights; not contrary to public order. Members are responsible for the security of their accounts and authentication credentials.

Article 7 — Withdrawal and account loss

Members may withdraw at any time via Account menu → Delete Account. All Session Content, drafts, handles, and account info will be permanently erased per these Terms and the Privacy Policy. The Company may restrict, suspend, or terminate accounts (with prior notice except in urgent cases) for false registration, prohibited conduct, abuse of other Members, or violation of these Terms or applicable laws.

Chapter 3 — Use of the Service

Article 8 — Provision of the Service

The Company provides sand tray session creation/editing/saving, figure placement, autosave/recovery, and therapist-client viewing when admin-assigned. The Service is intended to operate 24/7 but may be temporarily suspended for maintenance, force majeure, third-party outages (AWS, Auth providers), or other reasonable cause. The Service is currently provided free of charge; any future paid features will require separate consent.

Article 9 — Changes and termination

The Company may modify or discontinue the Service. If discontinued, the Company will provide at least 30 days' advance notice via in-app announcement or registered email, and reasonable means to export Session Content.

Article 10 — Notices

The Company may notify Members via in-app announcements, email, or other registered contact. Notice to all Members may be given by posting in the Service for at least 7 days.

Chapter 4 — Medical Disclaimer (Critical)

Article 11 — Nature of the Service

1. The Service is an expressive, educational, and self-exploration digital tool inspired by Sand Tray Therapy. It does not constitute medical practice, clinical diagnosis, psychotherapy, counseling, psychiatric evaluation, or any medical or therapeutic act, and does not substitute for any of them.
2. Session Content is not clinical material and cannot be used as a basis for diagnosis, prognosis, or treatment planning.
3. The "therapist" label within the Service is an operational role only. It does not certify or confer qualifications as a medical practitioner, mental health professional, or any other licensed role under Korean law. No doctor-patient or therapist-client legal relationship is formed between Members and "therapists" within the Service.

Article 12 — Medical disclaimer and use precautions

1. Members acknowledge and agree that the Service does not warrant any medical or therapeutic effect.
2. If you have any mental health concerns, you must consult a qualified medical professional (physician, clinical psychologist, mental health professional, etc.). Use of the Service must not delay or replace such professional help.
3. The Company is not liable for any mental or physical harm arising from or alleged to arise from the use of the Service, except where Company gross negligence or willful misconduct is established under Article 750 of the Korean Civil Act.

Article 13 — Crisis resources

If you are experiencing thoughts of self-harm or suicide, or a psychological emergency, please contact the following resources immediately before using this Service. This Service is not a crisis intervention tool.

• Korea Suicide Prevention Counseling: 1393 (24h)
• Mental Health Crisis Counseling: 1577-0199 (24h)
• Youth Cyber Counseling: 1388
• Women's Emergency Line: 1366
• Emergency: 119

Chapter 5 — Member Obligations

Article 14 — Company obligations

The Company will not engage in prohibited or improper conduct, will provide the Service stably, will maintain security systems for personal information protection, and will respond promptly to legitimate complaints.

Article 15 — Member obligations and prohibited conduct

Members must comply with these Terms, applicable laws, and operational policies, and must not interfere with Company operations. Prohibited acts include: false registration; identity/credential theft; unauthorized modification of Company information; transmission of malicious content; infringing IP rights; defaming the Company or third parties; obscene or violent content; commercial use without consent; reverse engineering, automated scraping, abnormal traffic; any unlawful or immoral act. Violators are liable for resulting damages.

Chapter 6 — Member Content and Intellectual Property

Article 16 — Member-created content

1. Members retain copyright and all IP rights in their Session Content.
2. Members grant the Company a free, non-exclusive, limited license to use Session Content solely as needed to: provide the Service (cloud storage, browser delivery); display content to admin-assigned therapists; use for statistics/research after pseudonymization or anonymization, with the Member's explicit consent only.
3. The Company will not use Session Content for marketing, advertising, public disclosure, or transfer to third parties.
4. On account deletion or session deletion, the Company immediately and permanently erases the Session Content and loses all rights to use it.

Article 17 — Rights to the Service

All software, code, design, text, graphics, logos, trademarks, icons, interfaces, database structures, and other content in the Service ("Service Content") are owned by the Company or its licensors. Members may not copy, modify, redistribute, reverse engineer, or commercially exploit Service Content without the Company's prior written consent.

Chapter 7 — Disclaimer and Limitation of Liability

Article 18 — Disclaimers

The Company is not liable for: force majeure (natural disasters, war, terrorism, power/network outages), failures of external cloud providers (AWS) or Auth providers, Member fault, the accuracy or reliability of Member content, disputes between Members or with third parties, or free-tier usage (except where required by law). Statements or actions of "therapists" within the Service represent that individual's views, not the Company's.

Article 19 — Limitation of liability

Except for damages caused by the Company's gross negligence or willful misconduct, the Company is not liable for special, indirect, consequential, or lost-profit damages. The Service is currently free; Members assume the risk of free use. This limitation does not exclude mandatory provisions of applicable law.

Article 20 — Dispute resolution and governing law

Disputes will first be resolved through good-faith negotiation. Members may request mediation from the Personal Information Dispute Mediation Committee (1833-6972) or the Korea Consumer Agency. These Terms are governed by the laws of the Republic of Korea. Lawsuits between the Company and Members will be filed in the court of competent jurisdiction under Korean Civil Procedure; if the Member's address is unclear or the Member resides abroad, the Seoul Central District Court will have first-instance jurisdiction.

Supplementary Provisions

These Terms take effect on May 11, 2026.

Contact: contact@madang.im
Service Operator: Madang (madang.im)
Data Protection Officer: [Operator name — to be filled in]