InfoTravelog Location Information Policy (v0.2 draft)

Revision History

• v0.2 (2026-05-09): English version reflecting v2.29 data strategy — EXIF GPS preserved (download stripped), no inference of home/work, KISA filing decision deferred to 1,000+ Members
• v0.1 (2026-04-29): Internal Korean draft

Effective Date: To be announced Last Updated: 2026-05-09 Scope: Members residing outside the Republic of Korea Review Status: ⚠ Self-drafted from public templates — qualified legal counsel review recommended once 1,000+ users reached Language Precedence: For non-Korean residents, this English version prevails over the Korean version in case of conflict.

This Location Information Policy explains how InfoTravelog ("Company", "we") processes location data under the Korean Act on the Protection and Use of Location Information ("Location Information Act"), with additional GDPR considerations for EEA Members.

Article 1 (Purpose)

This policy sets out the conditions of our location-based service (LBS) and the rights and obligations of the Company and Members regarding processing of personal location data.

Article 2 (Effect and Amendment)

1. This policy becomes effective when the Member applies for the location-based service and consents per the Company's procedure.
2. The Company may amend this policy within the limits of the Location Information Act and related laws, with at least 7 days' advance notice via in-Service announcement, email, or app notification.

Article 3 (Service Content)

The Company provides the following location-based services:

1. Recommendations for nearby Places (map "My Location" feature)
2. Distance and travel-time calculations
3. Automatic Place matching based on photo EXIF GPS (50m radius + name similarity)
4. Per-photo sun, moon, and star position calculation (capture time + GPS)
5. Time-of-day and seasonal photography recommendations
6. Location-based push notifications (planned for Stage 6+)
7. Aggregated Anonymous Statistics (regional photo upload trends, new hotspot discovery, etc. — non-identifying form)

Article 4 (Collection and Use of Personal Location Information)

4.1 Collection Methods

1. Browser Geolocation API — Used only when the Member explicitly grants permission, processed in memory and immediately discarded
2. Photo EXIF GPS — Automatically extracted at upload
3. Member-entered coordinates — When the Member directly enters coordinates (e.g., via "+ New Place")

4.2 Photo EXIF GPS Policy (★ v0.2 change)

1. The Company preserves the EXIF GPS coordinates of uploaded photos for the following purposes:
   • Automatic Place matching and pin display
   • Per-photo sun/moon/star position calculation
   • Aggregated Anonymous Statistics
2. Storage: photos.photoMeta JSONB column (see Privacy Policy §3.1).
3. Images served for download or external sharing have GPS automatically stripped via the sharp library to prevent external exposure.
4. Members may request unpublishing or deletion of their own photo EXIF GPS via the photo detail page or by emailing the Company; processed immediately.

Policy change (v0.1 → v0.2): The v0.1 policy stripped GPS in published images and did not store it in any column. Per the v2.28 Place model and v2.29 data strategy, v0.2 stores GPS in the photoMeta JSONB column. Download/sharing protection remains in place, and Member rights for unpublishing/deletion are strengthened.

4.3 Consent Methods

1. Explicit consent (checkbox) at registration
2. At photo upload: notice that "GPS information from this photo will be automatically extracted and preserved"
3. Browser Geolocation use: OS/browser permission dialog (Member may decline)

4.4 Effect of Declining

1. Declined location permission — "Nearby" features unavailable (general map use is unaffected)
2. EXIF GPS unpublishing request — degraded automatic matching and time-of-day recommendation quality for that photo

Article 5 (Location Information Service Provider Filing)

1. The Company currently operates as a "location-based service provider" (Location Information Act Art. 9) limited to its own Members and does not process or provide third-party location information.
2. The Company is not a "location information service provider" (Art. 5, which targets businesses that collect/provide third-party location data), but the Company will, upon reaching 1,000 Members or beginning B2B anonymous statistics provision, consult with legal counsel to determine whether filing becomes necessary.
3. If filing becomes necessary, the Company will promptly file with the Korea Communications Commission and disclose the filing number in this policy.

Article 6 (Disclosure to Third Parties)

1. The Company does not provide personal location information to third parties.
2. Exceptions:
   1. With prior explicit Member consent
   2. Per law or upon a lawful request from a law enforcement authority (with after-the-fact notice to the Member where permitted)
3. Aggregated Anonymous Statistics (Terms §10) are processed so as not to constitute personal location information and may be provided externally. The Company will publicly announce the timing, recipients, and items via the Service.

Article 7 (Retention Periods)

Article 8 (Member Rights)

1. Members may exercise the following rights:
   1. Right of access — confirm processing status of their location information
   2. Right to be informed — request access to or notification of location collection/use/disclosure confirmation records
   3. Right to withdraw consent — withdraw all or part of location collection/use/disclosure consent (Location Information Act Art. 24)
   4. Right to deletion — delete the EXIF GPS of their photos or the location of their registered Places
2. How to exercise:
   1. Settings page (/profile/preferences)
   2. Email (infotravelog@naver.com)
3. The Company will respond to rights requests within 10 days.

For EEA Members, the location-related rights overlap with Privacy Policy §7 (GDPR). Where they conflict, the more protective provision applies.

Article 9 (Children Under 14)

1. The Company does not accept registrations from persons under the age of 14 (Terms Art. 4(2)). For EEA Members, GDPR Art. 8 applies (minimum age 13–16 by Member State).
2. Should under-age registration become available in the future, verifiable parental consent will be required, and the legal guardian may exercise the same rights as the Member under §8.

Article 10 (Location Information Manager)

Article 11 (Restriction on Location Use — No Inference of Home/Work)

1. The Company does not engage in the following activities through clustering of EXIF GPS time patterns or geographic analysis of behavioral logs:
   1. Inferring a Member's home or workplace location
   2. Tracking a Member's daily movement patterns
   3. Externally exposing a Member's frequently visited Places or activity patterns (except where the Member has intentionally made them public)
2. Data used for personalized recommendations such as "Frequently Visited" or "Recently Viewed" is shown only to the Member themself and is not externally provided or disclosed.

Article 12 (Liability)

1. If a Member suffers damages due to the Company's violation of Articles 15 through 26 of the Location Information Act, the Member may seek compensation from the Company.
2. Unless the Company can prove otherwise, the Company's intentional misconduct or negligence is presumed (Location Information Act Art. 27).

Article 13 (Jurisdiction)

The court of jurisdiction for disputes under this policy shall be the court of the Member's domicile (consistent with Terms Art. 14).

Related Documents:

• Terms of Service: /legal/en/terms (master: SitePlanning/07_legal/terms-v2.en.md)
• Privacy Policy: /legal/en/privacy (master: SitePlanning/07_legal/privacy-v2.en.md)
• Korean version: /legal/location (master: SitePlanning/07_legal/location-info-v1.md)

Location Information Policy v0.2 — End.