Privacy Policy
Imgyeong Lee (the "Operator"), who runs Norabox (the "Service"), values your privacy and processes only the information the Service needs.
1. Information We Collect
When you sign up
- Email address (required): used only to tell accounts apart and to prevent spam and indiscriminate posting. We never send ads or newsletters.
- Username (required): shown to other users.
- Password (required): stored only in a form that can't be turned back into the original (a hash), so even the Operator can't see it.
What members add while using the Service
- Profile image (optional), and content such as playlists, memos and likes
- Songs you add to any playlist, whatever its visibility, may appear on the Explore page. Only the song is shown, never the playlist, its title, author or memos.
When you use a room without logging in
- The display name you use in a room: used only while you're in the room, and not stored.
- A random ID that recognizes who created a room: stored only in your browser.
- Room names and playlists: deleted after 6 hours with nobody in the room.
Created automatically
- Cookies: to keep you logged in, and to remember your language and background animation setting (section 6)
- Server logs (IP address, browser information, etc.): kept for a limited time by our hosting providers, for security and troubleshooting.
- Visit statistics: anonymous statistics without cookies (Vercel Web Analytics) that don't identify you.
2. Retention and Deletion
- Member information (including the email address) and content are deleted one month after the account is deleted.
- Room information is deleted after 6 hours without activity.
- Information that must be kept by law is kept for the period the law requires.
- Deleted information is destroyed so that it can't be recovered.
3. Sharing With Third Parties
The Operator does not sell your personal information or provide it to third parties, except when required by law.
4. Service Providers and Transfers Abroad
The Service runs on the following providers' servers, and information is stored in these countries.
| Provider | What it does | Location |
|---|---|---|
| Vercel Inc. | Website hosting, anonymous visit statistics | United States |
| Render Services, Inc. | Real-time sync server hosting | United States |
| Supabase, Inc. | Database (member information, content, rooms) | United States |
| Amazon Web Services, Inc. | Profile image storage | United States |
| Google LLC (YouTube) | Video playback | United States |
| Cloudflare, Inc. | Bot check on sign-up and log-in (Turnstile): checks your IP address and browser information | United States and elsewhere |
| Upstash, Inc. | Limits on sign-up and log-in attempts: keeps your IP address for up to 1 hour | United States |
When a video plays in a room, YouTube may set its own cookies, which are covered by the Google Privacy Policy.
5. Your Rights
- You can change your username, profile image and password on your profile page.
- You can delete your account at any time on your profile page.
- To access, correct or delete any other personal information, contact us below.
6. Cookies
| Cookie | Purpose | Kept for |
|---|---|---|
| norabox_session | Keeps you logged in | 30 days |
| norabox_locale | Your chosen language | 1 year |
| norabox_motion | Set if you turn off room background animation | 1 year |
You can delete or block cookies in your browser settings. If you block the login cookie, you won't be able to log in.
7. Children Under 14
Children under 14 may not sign up as members.
8. Privacy Contact
- Person in charge: Imgyeong Lee
- Email: imgyeonglee@gmail.com
9. Changes to This Policy
Changes to this policy are announced on the Service at least 7 days before they take effect.
This policy takes effect on October 14, 2026 (KST).