The operator (the “Operator”) of StockMentionMap (https://stockmentionmap.com, the “Service”) establishes this Privacy Policy to protect users’ personal information in accordance with the Personal Information Protection Act (PIPA) of the Republic of Korea and other applicable laws, and to handle related complaints promptly and smoothly.
Every screen of the Service, including the map and rankings, can be used without signing in. Signing in is optional and only for users who want to keep their watchlist and settings across devices.
1. Personal information we process
| Category | Items | How it is collected |
|---|---|---|
| Account information (if you sign in) | Email address, name (display name), profile picture address (URL), member identifier assigned by the authentication service | Received through the authentication service (Clerk) when you sign in with your Google account. We do not receive or store passwords. |
| Service usage information (if you sign in) | Watchlist, display settings (language, theme, default period, number of items shown, display mode, selected data sources, etc.), alert settings | Saved by you on screen |
| Alert connection information (only if you connect surge alerts to Telegram) | Telegram chat ID | When you send the connection code to our Telegram bot |
| Visit records (all visitors) | Google Analytics 4: cookie identifier, pages visited and on-screen actions (changing the period, opening a ticker, etc.), browser, device and operating system information, approximate location (estimated from the IP address) | Collected automatically by cookies and scripts (Section 9) |
| Own visit statistics (all visitors) | Daily totals of visitors and page views, country, device type, referring site domain. To exclude repeat visits on the same day, we use an irreversible value (hash) made by mixing the IP address and browser information with a random value used only for that day. The original IP address is not stored. | Processed automatically by the server |
| Security and error records | Connection IP address and browser information processed by the authentication service to keep sessions signed in and secure; error details and browser/device information when a server or browser error occurs | Collected automatically |
Children under the age of 14 may not become members (sign in).
2. Purposes of processing
- Identifying members, keeping them signed in, and preventing misuse
- Providing the feature that keeps your watchlist and display settings the same across devices
- Sending watchlist surge alerts by email or Telegram, only if you turn them on yourself
- Improving service quality through visit statistics, and finding and fixing errors
- Responding to user inquiries
- The email and answers you leave on the Pro waitlist page (/pro) are used only to announce the Pro launch and to gauge demand, and we delete them on request
We do not use personal information for any other purpose. If the purpose changes, we will notify you in advance as required by law and obtain consent where necessary. We do not use it for personalized advertising analysis.
3. Processing and retention periods
| Items | Retention period |
|---|---|
| Account information, watchlist, settings, alert connection information | Until you withdraw (delete your account). When you delete your account, your member row in the Service database is deleted immediately. |
| Backup copies for disaster recovery | To prepare for database incidents, we make a daily backup that includes member information (email, name, tier, settings, watchlist, sign-up date) and keep it on a separate storage device managed by the Operator. Each backup is deleted automatically at the latest 1 year (365 days) after it was made. Backups are not used for any purpose other than recovery, and if we ever restore from a backup, information of members who have already withdrawn is deleted again. |
| Alert delivery records | Only the most recent 200 deliveries are kept; the member identifier is kept only as an irreversible value (hash), and the email address or Telegram ID only in partially masked form. |
| Hashes used to detect repeat visits in our own statistics | Same day only; deleted the next day. Daily aggregate statistics are kept in a form that cannot identify individuals. |
| Google Analytics visit records | Deleted by Google after the data retention period the Operator has set in Google Analytics. |
| Account information at the authentication service (Clerk) | Deleted according to Clerk’s policy when the account is deleted. |
| Server and error records | Deleted automatically after the retention period of the hosting and error-monitoring services. Server records may contain member identifiers, but email addresses are recorded only in masked form. |
The Service currently has no paid payment features, so there are no transaction records that must be kept under the Act on the Consumer Protection in Electronic Commerce. If information that must be kept by law arises in the future, we will keep it separately from other information for the period required by that law, destroy it afterward, and state it in this Policy.
4. Provision of personal information to third parties
The Operator does not provide users’ personal information to third parties, except where the law specifically provides otherwise or where it is unavoidable to comply with legal obligations (for example, a lawful request from an investigative authority).
5. Entrustment of processing
To provide the Service, the Operator entrusts the processing of personal information as follows.
| Processor | Entrusted work |
|---|---|
| Clerk, Inc. | Member authentication (Google sign-in), sign-in sessions, account management, account deletion |
| Render Services, Inc. | Web server hosting (running the Service) |
| Neon (operator of the Neon database service) | Database storage (account information, watchlist, settings) |
| Resend | Email delivery (surge alert emails you turned on) |
| Google LLC | Visit analytics (Google Analytics 4) |
| Functional Software, Inc. (Sentry) | Server and browser error monitoring |
| Telegram | Delivering alert messages if you connected Telegram alerts |
Under the entrustment terms (each company’s terms of service and data processing terms), processors are required not to process personal information beyond the entrusted work. If a processor or the entrusted work changes, we will announce it through this Policy.
6. Overseas transfer of personal information
The processors above are located overseas, so personal information is transferred abroad to the extent necessary to use the Service (PIPA Article 28-8(1)(3): entrustment and storage necessary to perform a contract, disclosed in this Policy). All transfers are made by encrypted transmission over information and communications networks (HTTPS/TLS).
| Recipient (contact) | Country | Items transferred | When | Purpose / retention |
|---|---|---|---|---|
| Clerk, Inc. (clerk.com/legal/privacy) | United States | Email, name, profile picture, member identifier, connection IP and browser information | When you sign in and while you use the Service signed in | Authentication and account management / until the account is deleted |
| Render Services, Inc. (render.com/privacy) | United States (Oregon) | All items processed by the server while you use the Service; server records | Each time you use the Service | Hosting / processed immediately (records deleted after their retention period) |
| Neon (neon.com/privacy-policy) | United States (Oregon, AWS us-west-2) | Account information, watchlist, settings, alert connection information | When you sign in or save | Database storage / until you withdraw |
| Resend (resend.com/legal/privacy-policy) | United States | Email address, alert content | When sending an alert to a user who turned on email alerts | Email delivery / Resend’s delivery log retention period |
| Google LLC (policies.google.com/privacy) | United States and other countries where Google data centers are located | Google Analytics visit records in Section 1 | When you visit the site | Visit analytics / Google Analytics retention setting |
| Functional Software, Inc. (Sentry) (sentry.io/privacy) | United States | Error details, browser/device information (configured not to send personally identifying information such as email) | When an error occurs | Error monitoring / Sentry’s retention period |
| Telegram (telegram.org/privacy) | Countries where Telegram data centers are located | Telegram chat ID, alert content | When sending an alert to a user who connected Telegram alerts | Message delivery / Telegram’s policy |
If you do not want your information transferred abroad: if you do not sign in, no account information is transferred, and every screen of the Service can be used without signing in. If you have already signed up, you can delete your account (Section 7). You can refuse visit analytics in the ways described in Section 9. However, hosting (Render) is essential to open the Service, so if you refuse it you cannot use the Service.
7. Rights and obligations of data subjects and how to exercise them
You may at any time request access to, correction of, deletion of, or suspension of processing of your personal information.
- Access and correction: after signing in, you can view and edit your display name, profile picture, watchlist and settings yourself on the Profile settings page.
- Withdrawal (account deletion): after signing in, click your profile picture at the top right → ‘Manage account’ → ‘Security’ → ‘Delete account’. When you delete it, the authentication service (Clerk) sends a deletion notice to the Service, and the Service immediately deletes your member row in the database (email, name, profile picture, watchlist, settings, alert connection information). Backup copies are deleted after the period stated in Section 3.
- Other requests: send a request to the contact email below; after verifying your identity we will handle it without delay (within the statutory 10 days) and inform you of the result.
- You may also make requests through a legal representative or an authorized person, in which case a power of attorney must be submitted.
- Requests may be limited in cases set out in PIPA, such as where the law specifically provides otherwise or where there is a risk of harm to another person’s life, body or property.
8. Procedure and method of destruction
- Procedure: personal information whose retention period has ended or whose purpose has been achieved is destroyed without delay. If it must be kept by law, it is stored separately from other information.
- Method: electronic files are erased so they cannot be reused, by deleting rows from the database and by deleting entire backup files whose retention period has passed. We do not keep personal information on paper.
9. Installation, operation and refusal of automatic collection tools (cookies, etc.)
- Google Analytics 4 cookies (
_ga, etc.): used for visit statistics, with the IP anonymization option turned on. Visitors from the European Union, the European Economic Area, the United Kingdom and Switzerland first see a consent prompt, and Google Analytics is loaded only if they click ‘Accept’. - Sign-in cookies: if you sign in, the authentication service (Clerk) uses cookies to keep you signed in. If you block these cookies you cannot sign in (screens used without signing in are not affected).
- Browser storage: your language, theme and cookie consent choices are stored only in your own browser (not sent to the server).
- How to refuse: you can block or delete cookies in your browser settings (e.g. Chrome — Settings › Privacy and security › Third-party cookies; Edge — Settings › Cookies and site permissions; Safari — Settings › Privacy). You can also turn off Google Analytics collection on all sites with Google’s Google Analytics Opt-out Browser Add-on. You can keep using the Service even if you refuse.
10. Measures to ensure the safety of personal information
- Administrative measures: access to personal information is limited to the Operator, and admin screens are restricted so only the Operator can open them. Email addresses are partially masked on admin screens and in records.
- Technical measures: all communication is encrypted with HTTPS. We do not receive passwords and use only Google/Clerk authentication; sign-in tokens are accepted only after their signatures are verified. Member change notices (webhooks) sent by the authentication service are also signature-verified. Database connection details and secret keys are not put in the code and are managed only as hosting environment variables. Member data can be read or changed only with the member’s own identifier.
- Physical measures: Service data is stored under the data center security of each cloud provider. Backup copies are kept on a storage device managed by the Operator and are not made public.
11. Chief Privacy Officer
We designate the following Chief Privacy Officer, who is responsible for overall personal information processing and for handling related complaints and remedies.
- Name: 배진혁
- Position: Operator
- Contact (inquiry email): jinh7116@gmail.com
12. Remedies for infringement of rights
To seek a remedy for an infringement of personal information, you may apply to the following organizations for dispute resolution or consultation.
- Personal Information Infringement Report Center (operated by the Korea Internet & Security Agency): privacy.kisa.or.kr / 118 (no area code)
- Personal Information Dispute Mediation Committee: www.kopico.go.kr / 1833-6972
- Supreme Prosecutors’ Office, Cyber Investigation Division: www.spo.go.kr / 1301 (no area code)
- Korean National Police Agency, Cyber Investigation Bureau: ecrm.police.go.kr / 182 (no area code)
13. Changes to this Privacy Policy
If we change this Policy, we will post the changes and the effective date on this page at least 7 days before they take effect (at least 30 days before for changes important to users’ rights).
14. Effective date
This Privacy Policy takes effect on 2026-10-12.