Privacy notice

Scope

This notice covers Nangman Note at note.nangman.co, the existing note.낭만.kr service and the Android app kr.nangman.note. Other Nangman services have their own notices and data. Browser-local notes belong to each site address; use a backup to move them between addresses.

Information handled

When you sign in, Google or Naver supplies a provider identifier, account identifier, and available profile information such as email, name or nickname, and profile image URL. User IDs and session creation and expiry information are used with an HttpOnly session cookie. Nangman Note does not receive or store your Google or Naver password. Guest use does not send these account details to Nangman Note.

Note data includes PDF bytes, original filename, size and page count; pen, highlight, drawing and text annotations; page order; document names and timestamps; sync versions and file keys; settings and pending deletion information. Guest PDFs and annotations remain in local device storage. Using account sync sends saved PDFs and annotation state to Cloudflare storage.

Hosting infrastructure such as Cloudflare may process IP addresses, User-Agent, request time and path for security, traffic handling, and troubleshooting. Nangman Note requests are not recorded in the operator's shared visitor-statistics database. Cloudflare log retention follows its settings and policies. Worker error messages and processing status may be logged; the app is not implemented to log PDF bodies or annotation contents.

The current app does not include advertising SDKs, advertising identifiers, Google Analytics, Firebase Crashlytics, Sentry, or session recording SDKs. The bundled PDF.js and pdf-lib libraries do not send your PDFs to their providers.

Why information is used

Information supports sign-in and sessions, optional cross-device document sync, PDF display and annotation, automatic saving, page operations, exporting and sharing, security, troubleshooting, and responses to support requests.

Storage and retention

Local PDFs and editable notes are in IndexedDB; settings and the pending sync-deletion queue are in localStorage. They remain until you delete notes or clear site storage. Cache Storage contains app files and PDF libraries, not original user PDFs. Browser storage can also be removed by the browser or device.

Synced document metadata is in Nangman Note's Cloudflare D1 tables; PDF originals and annotation state are in its Cloudflare R2 object paths. These remain until document deletion or Nangman Note data deletion. Shared account links use common Cloudflare D1 and, where required by the existing sign-in flow, common Supabase profiles. These shared profiles are retained when only Nangman Note data is deleted.

The current login session is kept in common D1 session records and an HttpOnly cookie until logout, session deletion, or expiry, with a maximum duration of 30 days. Infrastructure logs have no retention duration fixed by the app code; Cloudflare's settings and policies apply.

Downloaded PDFs, exported backups, and copies shared to another app are managed by the location, device, or app receiving them. Nangman Note cannot remove those copies.

External services

Google OAuth and Naver OAuth handle sign-in when you initiate it. Cloudflare Workers, Assets, D1, and R2 deliver the service and process sessions, metadata, and synced documents. Nangman Note R2 objects use a separate note/ path and are accessed behind authenticated APIs rather than public file URLs.

Supabase is used by the existing common sign-in flow for shared profiles; Nangman Note PDFs and annotations are not stored there. Android Browser Helper opens the Android app as a Trusted Web Activity and is not used as an advertising or analytics feature.

In guest mode, local PDFs and annotations are not sent to these providers. Signed-in users can choose whether to sync existing local documents; newly saved or modified documents while signed in become background sync candidates. Sharing passes a PDF to the destination app you select.

Security

App-to-server communication uses HTTPS. Document APIs use the authenticated session's user ID, and R2 files are served behind authenticated Worker APIs with file size and PDF format checks. The service uses a content security policy and same-origin request checks.

Local IndexedDB and localStorage contents are not separately encrypted by Nangman Note. Device locks and browser or Android site-storage protection are your responsibility. These measures are not a claim of end-to-end encryption.

Deleting notes and account data

Deleting a document from the recent note list removes its local copy. While signed in, it also queues deletion of the corresponding D1 metadata and R2 PDF and annotation state; offline server deletions are retried when the connection returns.

Settings → cross-device sync → Nangman Note account and data deletion removes your Nangman Note document metadata, PDF and annotation objects, note-to-user links, and current login session. You can choose to retain or remove local notes. Google and Naver accounts, shared Nangman profiles, other Nangman service data, downloaded copies, and applicable infrastructure logs are outside this deletion scope. See the account and data deletion page for the full steps and support route.

Children's information

The service is not directed primarily at children. The operator does not intentionally collect personal information of children under 14 without guardian consent. If you believe a child's information was provided, contact the support channel so the operator can review it and take necessary deletion action. The service does not have a separate age-verification screen.

Changes and questions

This notice may change when service features, sign-in and sync, providers, or applicable requirements change. The existing notice states that a new effective date and changes will be shown on the notice page and significant changes announced in the service.

For privacy, note deletion, account deletion, or children's information questions, contact Nangman Storage through the available KakaoTalk channel. No separate email support address is currently published here.

The current support channel is a KakaoTalk open chat. A KakaoTalk account may be required; English support availability is not guaranteed.