Privacy Policy
This is an English translation of the Korean Privacy Policy (개인정보처리방침). The Korean version is the legal original; if the two differ, the Korean version prevails.
Dual Media Co., Ltd. (the “Company”) operates the web fiction service storyhana (storyhana.com, including the English edition /en/ and the Japanese edition /ja/; the “Service”) and processes users’ personal information as described below, in accordance with the Personal Information Protection Act of the Republic of Korea.
Effective date: October 21, 2026
1. Why we use personal information
We use personal information only for the purposes below. If a purpose changes, we will tell you in advance and ask for consent again where required.
- Sign-up, sign-in, account management and account deletion
- Library features: recently read, continue reading (last chapter and reading position), follows and likes
- Displaying and managing what users write (comments, reviews, stories)
- Author activity: showing pen names, saving and scheduling stories and chapters, reviewing a new author’s first story
- Counting views (the same person reading the same chapter counts once a day)
- Preventing abuse: blocking mass scraping (limiting the number of requests in a given time) and tracing unauthorized copying of chapter text (see section 5, “Anti-piracy marks”)
- Handling reports of rights infringement, non-consensual intimate imagery and other issues, and telling reporters the outcome
- Sending password-reset emails and essential notices (such as changes to the Terms or this Policy)
2. What we process and on what basis
2-1. Information processed to perform our contract with you
Basis: Article 15(1)4 of the Personal Information Protection Act (performance of a contract with the data subject). We process these items without asking for separate consent.
| Category | Items |
|---|---|
| Sign-up with email | Email address, nickname (pen name), password (stored only as an irreversible hash), confirmation that you are 14 or older, and a record of your agreement to the Terms and this Policy (time and edition) |
| Sign-up with Naver or Google | The account identifier provided by that company, nickname (pen name), age confirmation and agreement record. We do not receive an email address or password (see 2-4). |
| Author activity | Pen name, author bio (optional), story and chapter content, author’s notes |
| Usage records | Chapters read, reading position (scroll ratio) and time, likes and follows, view records (member number or the anonymous value below), comments and reviews with their time |
| Cash, Points and payments | Order number, package and amount, payment method type (card, bank transfer, easy pay, etc.), card issuer code, payment agent transaction ID, approval/cancellation times and amounts, sales slip link, records of Cash and Points earned, used and refunded, chapters bought or rented and rental end times, check-in records. We do not receive card or bank account numbers (handled by the payment agent). |
| Anti-piracy mark records | For each member number, which chapter was sent with which marking pattern, and when |
| Generated automatically | IP address, browser information (User-Agent), time and requested address (server access logs), cookies (section 8) |
- Views by visitors who are not signed in are counted without storing the IP address, using only an irreversible anonymous value (changing daily) made from the IP address, browser information and date.
- Request limits (chapter text, sign-up, sign-in, comments, etc.) use a hashed value made from the IP address, not the IP address itself (or the member number for signed-in members). These values are deleted automatically when the limit window ends.
- We do not store IP addresses or browser information with comments.
2-2. Information kept because the law requires it
Basis: Article 15(1)2 of the Personal Information Protection Act; Article 15-2(2) of the Protection of Communications Secrets Act and Article 41(2)2 of its Enforcement Decree (internet log records and access-point tracking data to be kept for at least 3 months).
- Server access logs (IP address, time of access, requested address, browser information)
2-3. Information processed only when you provide it
| Category | Items |
|---|---|
| Reports | Type and content of the report, target address, contact for the result (optional — you can report without it), member number if signed in, a hashed value made from the reporter’s IP address (to prevent repeated reports) |
| Cash receipt requests | Mobile phone number or cash receipt card number (income deduction), business registration number (expense proof) |
| Inquiries and requests to exercise your rights | Contact details and the content of your request |
2-4. What we receive through Naver or Google sign-in
- Google: we request only the
openidscope. We store only the account identifier Google provides and do not request your name, email address or profile photo. - Naver: of the member information Naver returns, we store only the account identifier; we do not store your name, email address or any other value.
2-5. Information from authors who receive revenue from paid chapters
Basis: Articles 15(1)2 and 4 and 24-2(1)1 of the Personal Information Protection Act; Articles 127 (withholding) and 164 (payment statements) of the Income Tax Act. Collected only when an author who wants revenue enters it in the Author Studio.
- Individual authors: legal name, Korean resident registration number (required by law for withholding and payment statements), bank, account number and account holder
- Business authors: legal name (representative), business registration number, bank, account number and account holder
- Resident registration numbers and account numbers are stored encrypted (Article 24-2(2)) and are visible only to staff handling settlement and tax filings.
- No resident registration number is needed to sign up (Article 24-2(3)).
We do not collect sensitive information. Resident registration numbers are collected only in the case of 2-5 above.
3. How long we keep it
| Item | Retention |
|---|---|
| Member information (email, nickname, hashed password, social sign-in identifier, agreement record) | Until you delete your account; destroyed without delay after deletion |
| Usage records (chapters read, position, likes, follows, member view records) | Until you delete your account |
| Stories and chapters | Until the author deletes them or their account |
| Comments and reviews | Until the writer deletes them or their account (deleted together with the account) |
| Anti-piracy mark records | Until you delete your account |
| Report records | 1 year from the day handling is finished (to deal with repeated reports and disputes) |
| Hashed values for request limits | Deleted automatically when the limit window ends (at most about 1 hour) |
| Anonymous view values of visitors not signed in | Kept as view statistics; they cannot be turned back into an IP address |
| Records of contracts, withdrawals and payments (payments, refunds, Cash use) | 5 years (Article 6, Act on the Consumer Protection in Electronic Commerce; Article 6(1)2–3 of its Enforcement Decree). Kept separately for this period even after you delete your account. |
| Records of consumer complaints and disputes | 3 years (Article 6(1)4 of the same Decree) |
| Author settlement information and payment/withholding records | 5 years from the statutory filing deadline for the tax period of the transaction (Article 85-3(2), Framework Act on National Taxes) |
| Points and check-in records | Until you delete your account (Points expire after the period shown from receipt) |
| Server access logs | 3 months (Article 41(2)2 of the Enforcement Decree of the Protection of Communications Secrets Act), stored separately from other information |
4. How we destroy it
- When the retention period ends or the purpose is achieved, we destroy the information without delay. Information we must keep under other laws (server access logs) is stored separately for that period and then destroyed.
- Electronic files are deleted so that they cannot be restored.
- We do not collect paper documents; if any arise, they are shredded or incinerated.
5. Anti-piracy marks
Signed-in members receive chapter text that differs very slightly from person to person (for example, one comma or one similar word), and we record which marking pattern was sent to which member. These records are used only to confirm that text was copied out without permission, and only authorized Company staff can see them.
6. Provision to third parties
We do not provide your personal information to other people or companies, except where a law specifically requires it or it is unavoidable to meet a legal obligation (for example, a request from a court or investigative agency made under the procedures set by law), and then only to that extent.
The legal name, resident registration number (or business registration number) and payment amounts of authors receiving revenue from paid chapters are submitted to the competent tax office (National Tax Service) as payment statements under Article 164 of the Income Tax Act. This is a provision required by law.
7. Outsourcing and international transfer
7-1. Outsourcing
| Recipient | Work entrusted |
|---|---|
| DigitalOcean, LLC (service name: Cloudways) | Server operation and management, data storage (on Vultr infrastructure in Seoul, Republic of Korea), password-reset emails sent from the server |
| Toss Payments Co., Ltd. | Processing Cash payments (payment window, approval, cancellation) and issuing cash receipts on our behalf |
| Cloudflare, Inc. | Delivering site traffic (CDN) and security (blocking attacks) |
7-2. International transfer (Article 28-8 of the Personal Information Protection Act)
The Service’s servers and data are located in the Republic of Korea (Seoul). However, DigitalOcean, LLC (Cloudways), which operates and manages the servers, and Cloudflare, which carries traffic to and from the site, are U.S. companies, so your personal information may be transferred abroad (processed on our behalf) through remote access for server management and through traffic delivery. This is necessary to conclude and perform our contract with you, and we disclose the following in this Policy under Article 28-8(1)3(a) of the Act.
① Hosting: DigitalOcean, LLC (Cloudways)
| Items transferred | Member information stored in the site database (email, nickname, hashed password, sign-in and social sign-in identifiers), usage records (reading records, etc.), comments and reviews, stories, report records, and server access logs (IP address, etc.) — the items in section 2 |
|---|---|
| Country | United States (company location), via remote access for server operation and management. The data itself is stored in the Republic of Korea (servers in Seoul, Vultr infrastructure). |
| Timing and method | Remote access over an encrypted connection when server operation or management requires it |
| Recipient and contact | DigitalOcean, LLC (Cloudways) / 105 Edgeview Drive, Suite 425, Broomfield, CO 80021, USA |
| Recipient’s purpose and retention | Server operation and data storage / until you delete your account or the service contract ends |
② Traffic delivery and security: Cloudflare, Inc.
| Items transferred | All traffic to and from the site (IP address, browser information, requested address, cookies and the content exchanged) |
|---|---|
| Country | United States (company location). Traffic is delivered through servers Cloudflare operates in many countries. |
| Timing and method | Delivered over an encrypted network (HTTPS) each time you access the site |
| Recipient and contact | Cloudflare, Inc. / 101 Townsend St, San Francisco, CA 94107, USA / [email protected] |
| Recipient’s purpose and retention | Traffic delivery and security / until you delete your account or the service contract ends |
③ Visit statistics: Google LLC (Google Analytics)
From October 21, 2026 we use Google Analytics, provided by Google LLC (USA), to produce visit statistics. We only see aggregated numbers that do not tell us who you are, and we do not send member information such as your email or nickname to Google.
| Items transferred | Analytics cookie identifiers (_ga, _ga_*), IP address (used by Google only to estimate a rough location and not stored), browser and device information, the address of the page viewed and how you arrived, and whether a sign-up was completed |
|---|---|
| Countries | The United States and other countries where Google operates servers |
| When and how | Sent over an encrypted connection (HTTPS) each time you open a page on the Service |
| Recipient and contact | Google LLC / 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA / Google privacy contact |
| Purpose and retention | Visit statistics (how many people viewed which pages, where they came from, how many signed up) / 14 months from collection |
④ How to refuse the transfer, and what happens if you do
If you do not want your information transferred abroad, do not sign up, or ask us to delete your account through the contact point in section 12. Because server management and all traffic pass through the companies above, refusing the transfer means you cannot use member features or access the site. However, you can refuse ③ visit statistics separately using the methods in section 8, and doing so does not affect your use of the Service.
8. Cookies and similar technologies
- We use cookies to keep you signed in: the WordPress sign-in cookies, a cookie showing whether you are signed in (
sh_li), and a short-lived check cookie used only during Naver or Google sign-in (sh_oauth, 30 minutes). - Reader settings such as font size and background color are stored only in your browser (local storage) and are not sent to us.
- Advertising: we show Google AdSense ads on the Service. Google and its advertising partners may use cookies to show ads based on your visits to this site and other sites (personalized ads). We do not receive or keep the information collected through these cookies. See how Google uses information from sites that use its services.
- You can turn off personalized ads in Google Ads Settings, and opt out of other vendors' cookies at aboutads.info.
- Visit statistics: from October 21, 2026 we use Google Analytics to count how many people view which pages, where they come from and how many sign up. For this, analytics cookies (
_ga,_ga_*, up to 2 years) are stored (section 7-2 ③). If you do not want this, block cookies in your browser or install the Google Analytics opt-out browser add-on. Refusing does not affect your use of the Service. - How to refuse: you can block or delete cookies in your browser settings. If you block cookies, features that require sign-in (library, likes, comments, reading from chapter 2 onward, etc.) will not work.
9. External fonts (Google Fonts)
The Service’s pages load font files from the font servers of Google LLC (USA) (fonts.googleapis.com, fonts.gstatic.com). Your browser connects directly to Google’s servers to do this, so your IP address and browser information are sent to Google. The Company does not give member information to Google.
10. Your rights and how to exercise them
- You may at any time ask to access, correct, delete or suspend processing of your personal information, or withdraw consent (delete your account).
- How: write your request and a contact for the reply on the report and inquiry page (storyhana.com/en/report/, type “Other”), or call +82-2-6377-6300. We may ask for account details such as your sign-up email to confirm it is you.
- You may also make a request through a representative (a legal guardian or someone you authorize). We may ask for documents that confirm the authorization.
- We handle requests without delay and tell you the result. If we refuse or limit a request under the law, we tell you why and how to object.
- Objections: if you disagree with the result, you can object through the same contact point, and we will review it again and tell you the result.
- You should keep your personal information accurate and must not post or infringe on other people’s personal information.
11. Children under 14
The Service does not accept members under the age of 14. We confirm that you are 14 or older at sign-up. If we learn that we have collected information from a child under 14, we destroy it without delay. The legal guardian of a child under 14 may ask to access that child’s personal information.
12. Privacy contact
For questions, complaints or remedies concerning personal information, please contact:
- Department: Privacy Protection (개인정보 보호 담당)
- Phone: +82-2-6377-6300
- Online: storyhana.com/en/report/
13. Security measures
- Administrator access is given only to people who need it.
- Passwords are stored only as irreversible hashes, and all traffic is encrypted with HTTPS.
- A security proxy (Cloudflare) and server access controls help block intrusions.
- Request limits block mass scraping and repeated sign-in attempts.
- Security updates are applied promptly.
14. Changes to this Policy
If we change this Policy, we will announce it on the Service at least 7 days before it takes effect, or at least 30 days before for important changes that are unfavorable to users.
- September 29, 2026: established and effective
- September 30, 2026: amended to describe advertising (Google AdSense) cookies
- September 30, 2026: amended the outsourcing and overseas-transfer sections after moving the servers from Tokyo, Japan to Seoul, Republic of Korea
- September 30, 2026: added Cash and Points payments, cash receipts, author revenue settlement (including resident registration numbers), record retention periods and outsourcing to Toss Payments
- October 21, 2026: added visit statistics (Google Analytics) cookies and the related international transfer
Effective date: October 21, 2026