Privacy policy
Effective October 1, 2026
Whalegun (the "operator") sets out, for the Whalegun service, and publishes this privacy policy under Article 30 of the Korean Personal Information Protection Act to protect personal information and handle related concerns promptly. The personal information the operator handles is that of members, of email subscribers, of people who write to us, and usage records tied to a random visitor identifier. Published information can be read without an account, and member information is collected only from those who sign up.
1. Purposes
The operator processes personal information only for the purposes below and takes the steps Article 18 of the Act requires, such as asking for fresh consent, if a purpose changes.
Membership: confirming the wish to sign up and the email address, signing in, managing the account, processing deletion, preventing abuse.
Member features: saving stocks and people to watch, notifications, AI chat answers.
Weekly report: sending the confirmation mail, sending the weekly report every Saturday, and processing unsubscribes.
Email updates: news about new features to members who agreed to it.
Enquiries: reading and answering contact emails.
Operations: checking access logs to handle outages and prevent abuse.
Improvement: reading usage records and usage statistics to learn which pages and features are used.
2. What is collected
Signing up: email address (required); name, last and first (required); date of birth (required); gender (required); the Google account identifier when you sign up with Google (required); email language; consent records (terms, collection and use of personal information, news mail; when each was given and the effective date of the document). The name, date of birth and gender are used to sign you up and manage your account, to confirm you are 14 or older, to identify and contact you, and for usage statistics.
Using membership: display name (optional), the stocks and people you watch, notifications, AI chat content (questions and answers), sign-in records (method, time, IP address, browser information).
Weekly report subscription: your email address (required), and the language, page you subscribed from and subscribe, confirmation and unsubscribe times recorded with it.
Enquiries: the sender address and content of a contact email.
Generated automatically while you use the service: access logs holding your IP address, the address requested, the time and browser information.
Usage records: random visitor and visit identifiers (cookies), the pages viewed, the features pressed (share, subscribe, lobbying tabs and the like), search terms, the previous page's address, language, country and browser information.
The operator does not accept sign-ups or subscriptions from children under 14.
3. Retention
Member information, watch lists and notifications are kept until you delete your account and destroyed without delay afterwards.
AI chat content is kept for 90 days from the day of the chat and then destroyed, and at once when you delete your account.
Sign-in records are kept until you delete your account. After deletion, the sign-in records of your last 3 months are kept apart for 3 months from the deletion under the Protection of Communications Secrets Act, then destroyed.
Consent records are kept until you delete your account.
Weekly report subscription data (email address, language, page subscribed from, the visitor and visit identifiers of the subscribing visit, subscribe, confirmation and unsubscribe times) and its sending records are kept until you unsubscribe and destroyed without delay afterwards.
Contact emails are kept until the enquiry is closed.
Server access logs are kept for 14 days. Logs kept by the web host are kept for the period that host sets.
Usage records are kept until the service ends; a member's records are deleted as soon as the account is deleted. What Google Analytics collects is kept in Google Analytics (reports for at most 14 months) and in the operator's Google BigQuery project (until the service ends).
Where an investigation under the law is under way, data is kept until it ends.
4. Disclosure to third parties
Personal information is processed only within the purposes in section 1 and is not given to third parties except as Articles 17 and 18 of the Act allow, such as with your consent or where a law requires it.
5. Processors
The operator entrusts processing to the following companies to run the service.
Cloud service providers: running the website, servers and database, storing member and subscription data, domain management and delivery, sending sign-in code, confirmation and weekly report emails, forwarding contact emails.
Google LLC: Google account sign-in, the inbox for contact emails, and website usage statistics (Google Analytics 4 and its Google BigQuery copy).
OpenAI, L.L.C.: generating AI chat answers.
The operator's contracts with processors set out what keeps personal information safe, and the operator checks that they are followed.
6. Transfers abroad
The operator transfers personal information abroad as follows to provide the service.
You can refuse the transfer of member data by not signing up or by deleting your account, and of subscription data by not subscribing or by unsubscribing; without them you cannot use member features or email updates. Access logs must be transferred for the website to work, so refusing means you cannot use the website. Send a refusal to [email protected].
| Recipient | Data | When and how | Purpose | Retention |
|---|---|---|---|---|
| Cloud service providers | Email address, Google account identifier, display name, email language, consent records, watch lists, notifications, AI chat content, sign-in records, subscription data (language, page the subscription came from, subscribe, confirmation and unsubscribe times), weekly report sending records, server access logs, usage records, IP address, request logs, contact emails | Over the network when you sign up, subscribe and use the service | Running the website, servers and database, storing member and subscription data, domain management and delivery, sending sign-in code, confirmation and weekly report emails, forwarding contact emails | Until you delete your account or unsubscribe (AI chat content 90 days, server access logs 14 days, usage records until the service ends (a deleted account's records at once), sign-in records of deleted accounts 3 months) |
| Google LLC | Sender address and content of contact emails | Over the network when a contact email arrives | Receiving and answering contact emails | Until the enquiry is closed |
| Google LLC (Google Analytics) | Pages viewed, the Google Analytics cookie identifier, a signed-in member's random account identifier, browser and device information, approximate location | Over the network when you use the website | Website usage statistics | Google Analytics reports at most 14 months; the Google BigQuery copy until the service ends |
| Google LLC (Google sign-in) | The Google sign-in request and the email address and account identifier it returns | Over the network when you sign in with Google | Google account sign-in and email confirmation | Until the sign-in completes |
| OpenAI, L.L.C. | AI chat questions and the published information needed to answer them | Over the network when you ask a question in AI chat | Generating AI chat answers | The API data retention OpenAI sets (at most 30 days) |
7. Destruction
Personal information whose retention period has passed or whose purpose is achieved is destroyed without delay.
Where another law requires it to be kept, it is stored apart from other information.
Electronic files are deleted so that they cannot be recovered.
8. Your rights
You may at any time ask to see, correct, delete or stop the processing of your personal information, or withdraw consent.
A member can change their display name, email language and news-mail choice on the settings page at once, and delete the account and its data at once with Delete account.
Every update carries an unsubscribe link that works at once; send any other request to [email protected] and it is handled without delay.
You may exercise your rights through a legal representative or an agent, who must submit a power of attorney in the form the Korean notice on personal information processing prescribes.
Requests to see or stop processing may be limited under Articles 35(4) and 37(2) of the Act.
The operator checks that a request comes from you or your lawful representative.
9. Security
Administrative: as few people as possible handle personal information.
Technical: the database sits in a private network that cannot be reached from the internet, traffic is encrypted (HTTPS), and access rights are managed and access is logged.
10. Cookies
The operator uses no advertising cookies.
The operator uses two cookies to tell visits apart. wg_vid is a randomly generated visitor identifier kept for a year; wg_sid ties one visit together and expires 30 minutes after the last request. Neither holds anything that identifies a person, such as a name or an email address, and they group usage records such as page views and the features pressed. When you subscribe to the weekly report, both identifiers are stored with the subscription so it can be told which visit it came from.
When a member signs in, the operator sets wg_session, which keeps them signed in. It is encrypted so the browser cannot read it, lasts 30 days from last use, and is removed on sign-out or account deletion. While signing in, wg_signup (carrying the sign-up step) and wg_oauth (checking a Google sign-in) are set for 10 minutes. These cookies are used only for signing in.
The operator uses Google Analytics 4 from Google LLC for website usage statistics. Google Analytics collects, with its own cookies, the pages visited, browser and device, and approximate location, and for a signed-in member a random account identifier (never the email address), which Google processes under its privacy policy (https://policies.google.com/privacy).
You can refuse or delete cookies in your browser's settings, and refuse Google Analytics with its opt-out add-on (https://tools.google.com/dlpage/gaoptout). Everything published on the website works with cookies refused, but signing in does not.
Settings such as the colour theme stay in your browser's storage and are never sent to the operator. You can clear them in your browser's settings.
11. Behavioural data
The operator does not collect, use or share behavioural data for targeted advertising.
Usage records and usage statistics are used only to fix and improve the service; they are not used for advertising or given to anyone else.
12. Privacy officer
The operator has a privacy officer who oversees personal information processing and handles complaints and remedies.
Name: Chanwoo Lee · Title: CEO
Contact: [email protected]
You may bring any privacy question, complaint or request for remedy arising from the service to the privacy officer, who answers and acts without delay.
13. Remedies
To seek a remedy for an infringement, you may apply for mediation or advice to the following Korean bodies.
Personal Information Dispute Mediation Committee: 1833-6972, www.kopico.go.kr
Personal Information Infringement Report Center: 118, privacy.kisa.or.kr
Supreme Prosecutors' Office: 1301, www.spo.go.kr
Korean National Police Agency: 182, ecrm.police.go.kr
14. Changes
This policy applies from October 1, 2026. Additions, deletions and changes are announced on the service at least 7 days before they take effect.