Privacy

Your email address, and nothing else. No name, phone number, birth date or gender.

The IP address used at sign-up is kept for 30 days, only to prevent abuse.

Opens and clicks are not tracked. There is no tracking pixel in the letters.

Separately, visit statistics are collected by Google Analytics while you browse the site. What is collected is listed under 'Visit statistics' below.

If ads are placed on the site, ad providers may collect browsing records separately. See 'Ads' below.

• To send the items you picked at the time you picked.
• To send the confirmation and the management links.
• Nothing else. Your email address is never used for advertising and never sold. The parties involved in sending the letters and serving the site are listed below.

Sending the letters is entrusted to Google LLC. The moment a letter goes out, your email address is sent to Gmail servers in the United States, which is a transfer of personal data abroad. What is transferred is your email address, the purpose is delivering the letter you picked, and it happens at the moment the letter is sent. Nothing is handed over for storage.

Visit statistics are handled by Google LLC on our behalf. Each time you view the site, the items listed under 'Visit statistics' below are sent to Google servers in the United States, which is a transfer of personal information abroad. The purpose is visit statistics, and they are kept for up to 14 months.

Access to the site is relayed by Cloudflare, Inc. (United States), and page speed and visit counts also go to Cloudflare. Both are described in the next two sections.

If ads are placed on the site's web pages, ad providers such as Google collect browsing records directly while showing the ads. Your email address is not passed to them. Details are under 'Ads' below.

The parties in this section and the next two are the only ones. Your email address is not passed to anyone else.

No personal data — your email address included — is ever put into the language model that drafts the letters. The writing is done once a day per item, with no reference to any subscriber.

Every request to this site passes through the network of Cloudflare, Inc. (United States), which we entrust with delivering it. Your IP address and request details are processed at the moment of relay, only to deliver the site and block attacks. This counts as a transfer of personal information abroad.

We use Cloudflare Web Analytics to see whether the site loads well and which pages are slow. When a page opens, your browser sends Cloudflare, Inc. (United States): the page address (path), the address of the page you came from (referrer), the browser, operating system and device type, and performance figures such as how long the page took to load. The country is estimated from your IP address, and Cloudflare states that it does not store the IP address. This counts as a transfer of personal information abroad.

Not used: cookies, browser storage (such as localStorage), identifiers that tell visitors apart, or device fingerprinting. The operator sees only aggregate numbers that cannot identify anyone (visits per page, visits per country, load speed) and uses them only to improve the service and look into outages. Retention follows Cloudflare's policy.

How to refuse: your browser's tracking protection or an ad or tracker blocker may stop it from being sent. Blocking it makes no difference to using the site.

Unsubscribe on the My subscription page and the address is deleted on the spot, with no confirmation step. Tick Delete my delivery history too and the history goes as well.

The unsubscribe link at the bottom of any letter does the same.

Neither can be undone. To start again you would sign up from scratch.

If neither is possible for you, write to the address below and it gets deleted by hand.

We back up the database in case of failure, and keep backup copies for up to 14 days. Information you delete stays in those copies for that period and disappears as newer copies replace them. Copies are used only for recovery and are not opened for any other purpose.

Addresses that bounce or are reported as spam are kept indefinitely — not the address itself, but a hash of it that cannot be reversed.

Deleting the hash too would mean writing to the same address again a year later and collecting the same complaint. The hash cannot be turned back into an address; it is only compared against new sign-ups.

A cookie keeps you signed in. Scripts cannot read it and it expires after 7 days.

When you sign up, the address you typed is kept in a browser cookie for one hour so the confirmation can be sent again. Scripts cannot read it, and it is not stored on the server for this purpose.

Visit statistics use cookies named _ga and _ga_…. They hold only a random number that tells visits apart, and expire after at most two years.

How to opt out of visit statistics is in 'Visit statistics' right below.

If ads are placed on the site, cookies from ad providers may be added. What they collect and how to refuse is under 'Ads' below.

Google Analytics 4 is used to see which pages get read, so the site can be improved. Visit statistics are not used for advertising.

It collects the address and title of the pages you view, where you came from, time spent, browser and device type, language, screen size and an approximate location (city level).

Only five actions are counted: pressing a subscribe button, scrolling today's letter to the end, finishing the subscription confirmation, the item you open from a letter or the item list, and the address of a source link in a letter (everything after the question mark is removed).

Finishing the confirmation is recorded without your email address. To count it only once, a 'sent' marker is kept in this tab's storage (sessionStorage), which is cleared when the tab closes.

Your email address is never sent. Codes in the address bar, such as the one in a confirmation link, are removed before anything is sent. Google uses the IP address only to estimate location and does not store it.

Individual records are deleted automatically after at most 14 months. After that only totals remain, which cannot identify anyone.

If you would rather not, switch it off below. Nothing will be sent from this browser. Subscribing and using the site work exactly the same.

You can also block or clear cookies in your browser settings, or install the opt-out add-on from Google.

Google Analytics opt-out add-on

How Google uses information it receives from sites that use Google Analytics is explained in How Google uses information from sites or apps that use our services.

Ads may appear on this site's web pages. The letters sent by email never carry ads.

If ads are placed, they are shown by ad providers such as Google (AdSense). Ad providers use cookies and similar technologies to collect records of visits to this site and other sites. These records are known as behavioural information.

What is collected includes the pages you view, the time of the visit, browser and device information and an approximate location. It is collected automatically when a page opens.

Ad providers use it to choose which ads to show and to measure how the ads perform.

Your email address and subscription details are never passed to ad providers.

How long it is kept follows each ad provider's own policy. Google's practices are described in How Google uses cookies in advertising.

If you would rather not see personalised ads, turn them off in Google My Ad Center. You can also block third-party cookies in your browser settings.

Subscribing and using the site work exactly the same either way. Ads that are not personalised may still appear.

Visitors from the European Economic Area, the United Kingdom and Switzerland start with Google Analytics cookies turned off. In that case only cookieless aggregate signals are sent to Google Analytics.

To keep the service running safely, the server automatically records each request (IP address, requested address, time and response result). These records are used only to look into outages and attacks, and are deleted automatically after 14 days.

Server logs never contain email addresses. Where a reference is needed, only the first 8 characters of a hash are written.

People under 14 cannot subscribe. The sign-up screen asks you to confirm that you are 14 or older, and your age is not stored.

Only the operator can access personal information, every connection is encrypted (HTTPS), and secrets such as passwords are stored encrypted. Personal information is deleted automatically once its retention period ends.

You can ask at any time to see, correct or delete your personal information, or to stop its processing. Send the request to the privacy officer's email and we will reply within 10 days after checking it. A legal guardian of a child under 14 can make the same requests.

The privacy officer is the daily operator, reachable at mail@hyunsu.co.kr.

Deleting your data yourself from the My subscription page is the fastest route.

If you need advice or a remedy for a privacy violation, you can also contact the following Korean agencies.

• 개인정보분쟁조정위원회 (Personal Information Dispute Mediation Committee, Korea) 1833-6972 (www.kopico.go.kr)
• 개인정보침해신고센터 (Personal Information Infringement Report Center, Korea) 118 (privacy.kisa.or.kr)
• 대검찰청 (Supreme Prosecutors' Office, Korea) 1301 (www.spo.go.kr)
• 경찰청 (Korean National Police Agency) 182 (ecrm.police.go.kr)

When this policy changes, we update this page and its effective date. Changes that collect more information are posted here 7 days before they apply.