Last updated: September 11, 2026
Hills Inc. (the "Company") complies with applicable laws, including the Personal Information Protection Act, and treats the personal information of users of "Heyday" (the "Service") with care.
This Privacy Policy explains what information the Company collects to provide the Service, how it is used, stored, and destroyed, and what rights users have.
The Company collects the following personal information to provide the Service.
| Category | Required/Optional | Items Collected |
|---|---|---|
| Anonymous sign-in | Required | Device identifier (a per-installation UUID on iOS; the Application ID on Android), country, language setting |
| Apple sign-in | Required | The user identifier (sub) provided by Apple, email (including Apple's relay email if the user has chosen to hide their email) |
| Apple sign-in | Optional | Name (only where provided by the user) |
| Google sign-in | Required | The user identifier (sub) provided by Google, email |
| Google sign-in | Optional | Name, profile image URL (only where set on the user's Google account) |
The Company collects personal information through the following methods.
The Company processes personal information for the following purposes. If the purpose changes, separate consent will be obtained in advance.
In principle, the Company retains and uses the user's personal information until the user closes their account. However, where applicable laws require retention for a certain period, the relevant information is stored separately for such period.
| Basis | Retained Item | Retention Period |
|---|---|---|
| Act on Consumer Protection in Electronic Commerce | Records related to product exchange, refund, and cancellation | 5 years |
| Act on Consumer Protection in Electronic Commerce | Records of consumer complaints and dispute resolution | 3 years |
| Act on Consumer Protection in Electronic Commerce | Records of labeling and advertising | 6 months |
| Protection of Communications Secrets Act | Service access logs | 3 months |
| Framework Act on National Taxes | Transaction evidence, books, and other tax-related materials | 5 years |
Records retained to prevent fraudulent use are stored separately for one year from the time the fraudulent act is confirmed, and then destroyed.
The Company processes the user's personal information only within the scope set forth in this Privacy Policy and does not provide it to external parties, except with the user's separate consent or as required by applicable laws.
Where provision to a third party is required for the fulfillment of product exchange or similar purposes, the Company will obtain the user's consent in advance, clearly identifying the recipient, the purpose of provision, the items provided, and the retention period.
To provide a stable Service, the Company may outsource the processing of personal information to external parties as follows.
| Outsourced Recipient | Outsourced Tasks |
|---|---|
| Google LLC (Firebase) | Push notification (FCM) delivery, serverless infrastructure and analytics |
| Google LLC (Google Mobile Ads / AdMob) | Advertisement delivery and performance measurement |
| Google LLC (Google Sign-In, Google Maps) | Google account authentication, map display |
| Apple Inc. | Apple account authentication, push notifications (APNs) |
| Xoxoday | Reward ordering, fulfillment, and redemption support, including gift cards and rewards delivered through external payment providers. Order reference, requested product and denomination, and delivery details where required are processed for fulfillment. |
| AppsFlyer, Amplitude, Meta, and Sentry | App attribution, usage analytics, advertising measurement, and error diagnostics, subject to the app's configuration and privacy choices. |
| KT alpha Co., Ltd. | Delivery of Giftishow mobile gift vouchers, related customer support, and resending vouchers |
| Cloud Infrastructure Providers | Provision of servers, storage, and other infrastructure required to operate the Service |
When entering into outsourcing agreements, in accordance with applicable laws, the Company specifies in the agreement matters such as prohibition of processing personal information for purposes other than the outsourced work, technical and administrative safeguards, restrictions on sub-outsourcing, and supervision of the outsourced party, and supervises compliance therewith.
As a result of using the services of global providers under Article 6 above, personal information may be stored and processed in Korea, the United States, and countries in which the relevant provider operates. For users outside Korea, operation of this Korean service may involve transmission to Korea. Provider-specific processing locations and applicable safeguards may vary by service; contact us for information about your request.
The Company destroys personal information without delay when the retention period has elapsed or the purpose of processing has been achieved.
The user may exercise the following rights at any time.
The above rights may be exercised through the settings screen within the Service or through the contact information at the end of this Privacy Policy, and the Company will act on such requests without delay in accordance with applicable laws. The Company may request materials necessary to verify that the rights are being exercised by the user or a duly authorized representative.
The user may request account closure directly through the settings screen within the Service. An account-deletion request deactivates the account, ends its sessions, and removes or disconnects certain account identifiers. It does not mean every activity, transaction, or fraud-prevention record is immediately erased. Records are handled under the retention rules in Article 4. Contact support@hey.day to request access to or deletion of remaining personal information; requests are evaluated under applicable law.
The user may at any time withdraw consent to optional items such as location information, advertising identifiers, and push notifications through device settings.
The Company implements the following measures to ensure the security of personal information.
Due to the nature of the mobile app, the Company may automatically collect user environment information through device identifiers, advertising identifiers, and in-app local storage rather than through web cookies.
The user may withdraw personalized advertising consent under Settings → Privacy Policy and reset advertising identifiers, limit tracking, and change location or health permissions through device settings; permissions required by location and health features must remain enabled to use those features. Weekly Visits requires consent to personalized ads and, on iPhone, tracking permission. Turning this off stops Weekly Visits. Other missions and access to points already earned remain available.
The Service is not primarily intended for children under the age of 14. If it is necessary for the Company to collect personal information from a child under the age of 14, such information will be processed with the consent of the legal guardian in accordance with applicable laws.
If the Company becomes aware that personal information of a child under the age of 14 has been collected without the consent of the legal guardian, the Company will destroy such information without delay.
The Company designates a Personal Information Protection Officer responsible for the overall handling of personal information processing and for handling user complaints and providing remedies related to personal information processing as follows.
If you need to report a privacy infringement or seek consultation, you may contact the following institutions.
Depending on your location and the laws that apply to the Company and your data, you may have rights to access, correct, delete, or receive a copy of personal information, withdraw consent, or object to or opt out of certain processing, including targeted advertising. Send requests to support@hey.day. We may need to verify your identity and will explain any applicable exception or refusal. You may also contact the competent privacy authority. This section does not restrict mandatory rights under applicable law.
This Privacy Policy may be amended in line with changes to applicable laws or the Company's policies. Where this Policy is amended, the Company will provide prior notice within the Service, specifying the amended content and the effective date.
If there is a material change affecting the user's rights, the Company will provide notice at least 30 days before the effective date and, where necessary, obtain separate consent.