Privacy Policy

This is a draft pending legal review. It describes what Newma actually does with data today — it was written from the code, not from a template.

The short version

• We do not sell your data. Not to anyone, for any purpose, ever.
• We do not train AI models on your data, and we do not let anyone else do so with it.
• You can delete everything. Email us and it goes, subject only to records the tax law makes us keep.

The rest of this page is the detail behind those three lines.

1. Who is responsible

Newma is operated by Shookin, a sole proprietorship in the Republic of Korea, which is the data controller for the personal data described here.

• Privacy officer: Inkyung Ko — inkyung.ko@shookin.net
• General contact: hello@newma.pro
• Address: 11 Yangjae-daero 2-gil, Seocho-gu, Seoul, Republic of Korea

2. What we collect

Your account. Your email address, and — if you sign in with Google — the name and profile image Google returns. Authentication is handled by Supabase; we never see your password in readable form.

What you connect. The product URL you enter and what our scan of that public page returns. The social handles you give us and the public post data collected for them. Read-only Google Analytics or Search Console data, when you invite our service account as a viewer. Any figures you paste in yourself.

Google account data (optional). If you choose "Connect with Google", we ask Google for read-only access to the Google Analytics properties and Search Console sites you pick. We store the email address of the Google account you connected and a token that lets us read those reports on your behalf; we use it only to show your own numbers on your board and to ground the board's answers in them. We never read, write or share anything else in your Google account, never use this data for advertising, and never let a person look at it except to fix a problem you ask us to fix or where the law requires it. You can disconnect at any time from Settings, which deletes the token, or from your Google account's third-party access page. newma's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

What you do on the board. The questions you ask, the answers the board returns, the decisions you choose to save, and the goal you set.

Billing status. Whether your subscription is active, and the identifiers Dodo Payments sends us to tell us so. We never receive your card number, and it never touches our servers.

Technical and error data. When something breaks we log the error message, stack trace, the page it happened on, and a small amount of context, so we can fix it. These logs may include your user identifier.

How you found us. UTM parameters and the referring domain from your first and most recent visit, stored in your browser's local storage and used to understand which channels work.

3. Why we use it, and on what legal basis

• To run the service you asked for — reading your data, producing answers, saving your decisions, keeping you logged in. Basis: performance of our contract with you.
• To take payment and manage your subscription. Basis: performance of our contract; legal obligation for tax records.
• To keep the service working and secure — error logs, abuse prevention. Basis: our legitimate interest in a service that functions.
• To understand which channels bring people here. Basis: our legitimate interest in knowing that; you can clear it by clearing your browser storage.
• To send you email. Account and service email — receipts, security notices, changes to these terms — is part of the service and we send it without asking. Marketing email and our newsletter are separate and opt-in only: we will not add you to them because you signed up for Newma, and every one of them has an unsubscribe link. Basis: consent.

4. How AI processing works

Producing an answer means sending your question and the relevant connected figures to Anthropic, whose Claude models generate the response. This is the core of how the product works, so it is not optional — but two things are true about it and both matter:

• We do not use your data to train any model, our own or anyone else's.
• Our use of Anthropic is under their commercial API terms, on which content submitted through the API is not used to train their models.

Answers are generated by software. No human at Shookin reads your board in order to answer you. We may look at aggregated or de-identified information about answer quality, and we may look at a specific account's data if you ask us to for support, or if we must to investigate abuse or a security incident.

5. Who else processes your data

A few providers handle personal data on our behalf. Each gets only what it needs to do its job:

• Supabase — database, authentication and hosting for our backend.
• Vercel — hosting and delivery of the website.
• Anthropic — generating answers (see section 4).
• Dodo Payments — payments, as Merchant of Record.
• Google — reading the Analytics and Search Console data you grant read-only access to (section 2).
• Crisp — the support chat. It receives your email address and account id so a conversation stays attached to you.
• PostHog — product analytics for newma.pro itself (section 9). It receives page views, a short list of named product events, and your account's internal id once you are signed in — never your email, name, or anything you typed into the board.

Reading your public product site and the public posts on the social handles you give us is done through third-party crawling and data services. They receive the public URL or handle and nothing about your account.

We do not sell personal data, and we do not share it for anyone else's advertising.

We will disclose data if the law requires it, and we will tell you when we are allowed to.

6. International transfers

Shookin is in Korea and the providers above are largely in the United States and the European Union, so running Newma means your data crosses borders. Where that involves personal data of people in the EEA or the UK, transfers rely on the European Commission's Standard Contractual Clauses or an equivalent safeguard offered by the provider. Where it involves personal data of people in Korea, we rely on your consent to overseas transfer, given when you create an account.

7. How long we keep it

• Your account and board data — while your account exists. If you delete your account, or ask us to delete it, everything is removed within 90 days, including from backups on their normal rotation.
• Error logs — 90 days, then deleted.
• Records the law makes us keep — Korean tax law requires business records supporting income to be kept for 5 years, so payout and transaction records are retained for that period regardless of account deletion. Records of the sale itself are held by Dodo Payments as Merchant of Record under its own retention rules.
• Local storage in your browser — until you clear it.

Where no law requires us to keep something, we destroy it without undue delay once its purpose is done.

8. Your rights

Wherever you live, you can ask us to: see what we hold, correct it, delete it, export it in a portable form, restrict or object to how we use it, and withdraw consent you have given.

Email inkyung.ko@shookin.net and we will answer within 30 days. We will not make you jump through hoops and we will not charge you.

If you are in the EEA or the UK you may complain to your local data protection authority. If you are in Korea you may raise a dispute with the Personal Information Dispute Mediation Committee (kopico.go.kr, +82-1833-6972) or report to the Korea Internet & Security Agency (privacy.kisa.or.kr, +82-118).

9. Cookies and browser storage

Newma does not use advertising or cross-site tracking cookies. We use your browser's local storage for things the product needs — keeping you signed in, remembering your board state, and holding the acquisition parameters described in section 2. Clearing your browser storage clears all of it.

We measure how newma.pro itself is used with Google Analytics 4, which sets first-party cookies (`_ga`) to tell one visit from another. IP addresses are truncated, Google Signals and ads personalisation are switched off, and the data is kept for 14 months. The board's own screens are counted as page views only — never the questions you ask or the numbers on your board.

We also use PostHog to measure our own product — this is separate from any PostHog project you might connect for your own site, which is not yet a feature. It records page views and a short list of named product moments (submitting onboarding, a board answer being shown, a decision being saved), and, once you are signed in, associates them with your account's internal id so we can see one person's path through the product — never your email, name, or anything you typed into the board. Automatic session recording, click tracking and feature-flag/experiment collection are switched off. We do not send auth codes, tokens, or the full address bar (including its query string) to PostHog — only a cleaned page path and, when present, the campaign parameters described above. This runs only on newma.pro itself, never in a development or preview build.

10. Security

Data is encrypted in transit. Access to production data is limited to the people who need it, which today is one person. Passwords are hashed and managed by Supabase; we cannot read them. No system is perfectly secure — if we ever suffer a breach affecting your personal data, we will notify you and the relevant authority as the law requires, and we will tell you what actually happened.

11. Children

Newma is not for anyone under 18. We do not knowingly collect data from children. If you believe a child has given us data, write to us and we will delete it.

12. Changes to this policy

We may update this page. For material changes we will notify you by email or in the product before they take effect. The date at the top always shows the current version.

13. Contact

• Privacy officer: Inkyung Ko — inkyung.ko@shookin.net
• General: hello@newma.pro
• Shookin, business registration number 641-48-00948
• 11 Yangjae-daero 2-gil, Seocho-gu, Seoul, Republic of Korea