Privacy Policy
Effective: November 8, 2026
RootMi is developed and run by Dae On Kim ("we"). This policy explains what personal information the RootMi app collects, why, how long it is kept, and the choices you have. The Korean version is written to Korea's Personal Information Protection Act; if the two differ, the Korean version prevails for users in Korea.
RootMi works without an account: songs and setlists you create are stored on your device. You only need an account to upload songs or to join groups. RootMi has no advertising, analytics or tracking.
We process account information and the content you upload because we need it to provide the service you sign up for, and error reports because we have a legitimate interest in keeping the app working. We collect only what's listed below.
Information we collect
| What | Details | Kept |
|---|---|---|
| Email sign-up | Your email address, a nickname you choose, and your password, stored only as a one-way hash. | Until you delete your account |
| Sign in with Apple | A unique Apple account identifier, the email address Apple shares (which may be a private relay address), and a token used to disconnect Apple when you delete your account. We don't receive your name; your nickname is generated and you can change it. | |
| Kakao Login | A unique Kakao account identifier, your Kakao nickname, email address and a link to your Kakao profile picture. The picture itself stays on Kakao's servers. | |
| Content you upload | Songs (chords, lyrics, notes) and setlists you upload, who wrote and last edited them, and your group memberships. Nothing is uploaded in the background. | Until you delete it or your account |
| Email verification | Your email address and a hashed code, when you sign up, link accounts or delete your account. | Up to 7 days after the code expires |
| Login sessions | When each session was issued, expired or ended. | Up to 37 days after it expires |
| Group edit history | Changes to group songs and setlists and who made them. | 3 days |
| Server logs | Request time, the address requested and the result. | Rotated out automatically when they reach a size limit |
| Error reports | Device model, OS and app version, error details and technical logs, a screenshot and a short recording of the app leading up to the error, with all text and images masked, and performance measurements from some sessions. Sent by the app with or without an account, and not linked to your account. | 30 days |
Songs kept only on your device never reach our server and are deleted with the app. Your login and profile are kept in your device's secure storage.
How we use it
- To create and manage your account, and to verify your email when you sign up, link accounts or delete your account.
- To store and return the songs and setlists you upload, and to share them in your groups.
- To find and fix crashes and performance problems.
- To answer your requests.
What other users see
We do not sell, rent or give your personal information to third parties. When you use groups or share songs:
- members of your groups see your nickname, your profile picture and whether you're an admin of that group;
- songs and setlists show the nickname of their author and last editor, including copies other users have downloaded.
Your email address is never shown to other users.
We disclose personal information only when the law requires it, for example in response to a valid court order or a request from an authority following a legal procedure.
Service providers
| Provider | What for | Where |
|---|---|---|
| Amazon Web Services | Server and database hosting | South Korea (Seoul) |
| Resend (Plus Five Five, Inc.) | Sending verification-code emails | United States |
| Sentry (Functional Software, Inc.) | Error and performance monitoring | United States |
They process data only to provide these services. Apple and Kakao are the sign-in services you choose; they share the information above with us when you sign in.
Transfers outside your country
Resend and Sentry process data in the United States: Resend receives your email address and the verification email each time you request a code, and Sentry receives the error reports described above. Both keep it for 30 days and process it under their data processing terms, which include the European Commission's Standard Contractual Clauses.
If you'd rather your email address not go to Resend, email us instead of using the steps that need a verification code (email sign-up, linking accounts, confirming account deletion). Error reports can't currently be turned off in the app; to stop them, stop using the app.
Connection checks
While you're logged in and our server can't be reached, the app checks whether your device is online by contacting well-known public services (such as Cloudflare, Google and Apple). These requests carry nothing beyond your device's IP address, and we don't store the results. RootMi uses no cookies.
Deleting your account
In the app, open your account and choose Delete account, then confirm with the code we email you. This permanently deletes your profile, your sign-in connections (Apple is disconnected), your sessions, your personal songs and setlists, and your group memberships.
Songs you contributed to groups, and group setlists you created, stay with those groups and show "deleted user" instead of your name. You can choose to also delete every song you wrote, including copies shared with others; then only each song's ID and deletion time are kept. Songs stored on your device stay there until you delete the app.
Your rights
You can change your nickname, email and password, link accounts and delete your account in the app. For anything else, such as a copy of your data, a correction or a question, email us at the address below; we'll answer within 10 days. We may need to confirm that the request comes from you. We won't treat you differently for using any of these rights.
Security
- All traffic between the app and the server is encrypted (HTTPS).
- Passwords and verification codes are stored only in a form that can't be reversed (one-way hashing).
- Your login is kept in your device's secure storage, and sessions expire.
- Verification codes expire quickly and allow a limited number of attempts.
- Only the developer can access stored data.
No method of storage or transmission over the internet is completely secure.
If your personal information is leaked, we'll tell you without delay what was affected, when and how it happened, what we're doing about it and what you can do to protect yourself, and report it to the authorities where the law requires.
Changes to this policy
We'll post any change on this page, with a new effective date, before it takes effect. Previous version: June 22, 2026.
Contact
Privacy questions and requests: Dae On Kim, daydayonoff@gmail.com