Privacy notice

Bulmeong · Effective November 5, 2026

Bulmeong does not keep the thoughts you write on notes. Information needed for your account, inventory and service statistics is handled as follows.

Accounts and sign-in

Email registration stores your email, nickname, password hash, registration time and internal account ID. The password itself is never stored. Email is used as a login identifier; email verification and password-reset emails are not currently available. Legacy ID accounts can add an email after verifying their password.

Social sign-in stores the unique account ID from your chosen provider. Google sign-in requests basic identity and email permissions, but Bulmeong does not store the supplied email or use it to link accounts. Kakao uses only a unique ID. Accounts from different sign-in methods are not automatically merged even when emails match. Passwords and provider credentials are not shared with other users.

An HttpOnly cookie keeps you signed in for 30 days. Temporary social sign-in state is valid for up to 10 minutes. A separate recent-login cookie keeps only the provider name for up to 180 days, not email, account IDs or credentials; it grants no login access. You can sign out or clear cookies in your browser.

Notes and emotion history

Note text is never saved in Bulmeong’s database, operational logs or analytics. It is sent to the OpenAI API only when automatic emotion classification is used. Other visitors receive only the resulting light and particle information. OpenAI’s security and abuse-prevention retention policies may apply separately. If AI is unavailable, a random emotion is used for the effect.

Notes sent while signed in record only the time and classified emotion in your personal history. Unclassified notes record the time without an emotion. Notes sent before registration are not kept in personal history. You can delete all emotion history in My Bulmeong.

Inventory and live connections

We store note and item quantities, refill times, reward processing history and wardrobe settings. These are linked to a browser session before registration and carried into a new account. Signing in to an existing account uses that account’s inventory. Your character’s location and actions are shared with people in the same channel.

Statistics and retention

Anonymous visitor IDs are used to count visits, connected time, note and item use, error types and emotions cumulatively. Statistics do not contain note text, raw IP addresses, raw error messages or emails. Daily deduplication lists are cleared after 30 days; anonymous IDs for all-time deduplication and cumulative totals are retained. Hashed IP addresses are also used for short-term request limits.

Accounts, inventories and personal emotion history are retained so you can return. Account information is deleted upon a verified deletion request; emotion history can also be deleted directly in the interface. Infrastructure data needed for security and incident response may be processed under providers’ separate policies.

External services

Cloudflare runs the service and stores its data. Your selected provider handles social sign-in. Information may be processed on infrastructure outside your country. Buy Me a Coffee supplies the support checkout and processes payment information; Bulmeong does not collect card numbers. Payment identifiers received through donation webhooks are used to prevent duplicate handling and provide support effects.

Access, correction, deletion and contact

You can change your nickname in My Bulmeong. For account access, deletion or other privacy requests, contact the operator at hodu5501@gmail.com. Only minimal information needed to verify account ownership is requested, never passwords or verification codes.

Friend invitation rewards

To issue rewards once, we store a random invitation ID, the inviting wallet ID, channel, expiry and credit time. Links last 7 days; records older than 30 days after expiry are removed when an invitation is next created. Visitor identity is used only to exclude self-visits and is not retained in invitation records. We do not collect contacts, shared messages or social account details. Visits from the same account or browser are excluded.