There is no sign-up. We never ask for your name, phone number,
or email.
What you write down — amounts, memos, categories, dates — stays on
your phone.We do not run a server for it, and we cannot see
it.
If you turn on sync, the backup goes to your own Google Drive
or iCloud. It never passes through us. On Google Drive we use
the app-private folder only, so the app cannot see any of your
other files.
We collect usage statistics. Which screens you open and which
features you use go to Google Analytics. Amounts are sent as a
range (for example "under 10,000"), never the exact figure,
and memo text is never sent anywhere.
The app shows ads. A banner at the bottom of the screen, a
full-screen ad between entries when you record several in a
row, and a video before you export a backup file. The full-screen
ad appears without asking you first — a close button follows a few
seconds later. Exporting a file goes ahead after the ad, though
if no ad can be loaded we export anyway. Nothing else in the app
depends on watching an ad. Ads use an advertising identifier (Android
Advertising ID / Apple IDFA) and device details; your entries and
memo text are never sent to advertising. On iOS we ask for
tracking permission (ATT) first, and if you decline you get
non-personalised ads only. Buying Pro removes ads.
Purchases are handled entirely by the App Store and Google Play.
The app never sees your card or payment details.
Reminders are local notifications your phone raises by itself.
There is no push server and no push token.
We use no location, contacts, photo, camera, or microphone
permission.
1. Who we are
MODUMWORKS ("we", "us") provides the mobile application
SsumSsum (Korean name 씀씀이, the "app"). We handle your information
under the Republic of Korea's Personal Information Protection Act and the
related laws that apply to us.
You can reach this policy at any time from Settings → About in the
app, and from each store listing.
2. What we collect
There is no account. We do not collect your name, date of birth,
phone number, or email address. We process only what the app needs to work.
Category
Data
When
Required?
Where it is stored
Expense entries
Amount, category, memo, date and time
When you type them in
Required (this is what the app does)
On your device only. Never sent to us
App settings
Theme, text size, language, currency, budget, categories,
reminder times
When you change a setting
Required
On your device only
Cloud account
Google account email and account identifier
When you turn on Google Drive sync
Optional (nothing is collected if it stays off)
On your device, to show you which account is connected.
Google performs the sign-in itself
Usage statistics
App instance ID, device and OS details, app version, event records
(screens viewed; entries added, edited, deleted; backups run)
Generated automatically while you use the app
Required
Google Analytics servers
Advertising
Advertising identifier (Android Advertising ID / Apple IDFA),
device and OS details, coarse location (country/region), ad
interactions
When an ad is shown
Required on the free app (nothing is collected once you own
Pro; on iOS, use of the identifier follows your tracking choice)
Google AdMob servers. The app keeps no copy
Purchase information
Product ID purchased, whether it succeeded, the store's receipt
When you buy or restore a purchase
Optional
App Store / Google Play. The app receives only the outcome and
records it on the device
Memo text never leaves. What you write in a memo ("lunch", "the
cafe on 5th") is never sent to analytics, to advertising, or to us. If —
and only if — you turn on sync, it travels inside the backup file to
your own cloud storage.
3. Why we process it
To run the app — showing what you entered on the calendar,
comparison, and statistics screens.
To back up and sync — only when you explicitly turn it on, and
only to storage you own.
To improve the app — understanding which features are actually
used.
To unlock paid features — checking whether you own a Pro
product.
To remind you — raising a briefing notification at the time you
chose, entirely on the device.
We do not use your information for any other purpose. If that ever needs
to change, we will ask you first.
4. Data that stays on your device
The app's core data lives entirely on your device. We do not operate
a server that stores expense entries.
Entries, categories, settings, and your frequent-memo list are written
to the sandboxed storage the operating system isolates per app.
The summary shown on the home-screen widget travels through a
shared container on the same device. It does not leave.
The one-time import from our older (web-view based) app runs against a
127.0.0.1 local address inside the device. Nothing leaves the
device during that either.
Deleting the app deletes this data with it. Backups you have already
sent to your own cloud storage remain (see §5 and §13).
5. Cloud sync (your own storage)
This runs only when you turn on Backup & restore → Automatic
sync yourself. The default is off.
Platform
Where the backup goes
Can we reach it?
Android
Your own Google Drive app-private folder
(drive.appdata)
No. We have no way to reach your cloud storage,
and the backup never passes through a server of ours.
iOS · iPadOS
Your own iCloud Drive app container
We ask Google for the narrowest scope there is. The app requests
drive.appdata only. That grants access to a hidden folder
this app created — your other documents, photos, and files are
not visible to the app.
The backup file contains all of your entries (amount, memo,
category, date) together with your categories and settings.
We keep the latest copy plus seven dated generations. Older ones
are pruned automatically.
Turning sync off, or deleting the app, does not delete the cloud
copy. That is deliberate — it stops the only remaining copy from
disappearing by accident. §13 explains how to delete it.
6. Usage statistics (Google Analytics)
We use Google Analytics for Firebase, operated by Google LLC, to
understand which features people actually use.
What we send
What we never send
App instance ID (a random value created per install)
Device model, OS version, app version, country, language
Screens viewed
That an entry was added, edited, or deleted
On a new entry: the category and a bucketed amount
(six bands, e.g. "under 10,000")
Onboarding completion; that a backup was exported or restored,
and how many records
That a Pro product was purchased
Memo text — never, by any path.
Exact amounts — bucketed before sending.
Name, email, phone — never collected in the first place.
Location — we use no location permission.
Advertising identifiers — never used for analytics.
Their use in advertising is set out in §8.
Statistics are aggregated so that individuals cannot be identified, are
used only for analysis, and are deleted after at most 14 months under
Google's policy.
The app offers two paid products. Payment is handled entirely by the
App Store and Google Play.
Product
Product ID
Type
SsumSsum Pro · pay once
ssumssum.pro.lifetime
Non-consumable (one-time, permanent)
SsumSsum Pro · monthly
ssumssum.pro.monthly
Auto-renewable subscription (1 month)
The app never sees your payment details. Card numbers, bank details,
and billing addresses are handled by Apple or Google and are not passed to
the app. All the app learns is whether the purchase succeeded and
which product it was.
The result is stored on the device and used only to unlock Pro
features.
Restore purchases simply asks the store again what your store
account owns. We keep no purchase database of our own.
Renewal, cancellation, and refunds are set out in the
Terms of Use.
8. Advertising (Google AdMob)
We show ads through Google AdMob, operated by Google LLC, so that
the app can stay free. There are only three of them.
A banner — shown above the tab bar at the bottom of the
app. If you own Pro, no ad is even requested.
A full-screen ad — shown between entries when you open the entry
screen repeatedly (currently every third time). It appears
without asking you first, and a close button follows a few
seconds later. Close it and the entry screen you asked for opens as
normal.
A rewarded video — offered when you tap Export to file on
the backup screen. The prompt carries a single button, "Watch ad and
export".
Exporting a file goes ahead after the ad. If you close the prompt
instead (tap outside it, or go back), the export is simply cancelled
and nothing else happens.
If no ad can be loaded, we export anyway. A backup is what keeps your
records safe, so we never let a missing ad stand in its way.
Nothing else in the app depends on an ad. Recording, the calendar,
comparisons, statistics, sync, and reminders all work exactly the same
whether you watch one or not.
iOS — we request Apple's App Tracking Transparency
consent before any use of the IDFA. If you decline, we use no
identifier and serve non-personalised ads only; the app never
stores the IDFA itself.
Android — your advertising ID is handled by Google Play
services, and you can delete it or opt out of personalised ads under
Settings → Google → Ads.
We never store advertising identifiers ourselves, and never combine
them with other data to identify you.
Your entries, amounts, and memo text are never sent to
advertising. What goes out for an ad is the advertising identifier,
device and OS details, coarse location (country/region), and your
interactions with the ad.
Every feature of the app keeps working whether or not you accept
personalised ads.
Buying Pro removes the banner, the full-screen ad, and the
rewarded-ad prompt alike.
Settings → Delete everything, or uninstalling the app
Cloud backup
Until you delete it
By you, using the steps in §13
Deletion markers (for sync)
90 days
Removed automatically after that
Usage statistics
Up to 14 months
Deleted automatically under Google's policy
Purchase records
Per store policy
Held by Apple / Google
Records of payment and supply that Korean e-commerce law requires
to be kept for five years are held by the App Store and Google Play,
which processed the payment. We do not keep a separate copy.
10. Sharing with third parties
We do not sell or share your personal information with third
parties. We may cooperate with a lawful request from an authority where the
law requires it.
Because we run no server that stores expense entries, we hold no such
records to hand over.
How to refuse an international transfer.Turn automatic sync
off and backup transfers stop; limit ad tracking in your operating
system settings; delete the app and every transfer stops. Some features
will be unavailable if you do. To stop analytics transfers, write to
contact@modumworks.com and we
will action it.
12. Permissions
Permission
Required?
Why
Internet
Required
Cloud sync, analytics, verifying purchases
Notifications
Optional
Raising the briefing reminder at the time you chose. Everything
else works if you decline
Receive boot completed (Android)
Required
So scheduled reminders survive a restart
App tracking (ATT, iOS)
Optional
Using the advertising identifier (IDFA) for personalised ads.
Everything still works if you decline — you simply get
non-personalised ads
We do not request or use location, contacts, photos, camera,
microphone, call logs, or your address book.
You can withdraw a permission at any time —
Android: Settings → Apps → SsumSsum → Permissions;
iOS: Settings → SsumSsum.
13. Your rights
You may access, correct, delete, or restrict processing of your
information at any time, and withdraw consent. Most of it you can do
inside the app.
Access and correction — every entry is on screen; tap it to
change it.
Deletion — delete entries one by one, or use
Settings → Delete everything.
Portability — Backup & restore → Export to file gives
you everything as a JSON file.
Deleting the cloud backup —
Android: drive.google.com → Settings → Manage apps → SsumSsum →
Delete hidden app data;
iOS: Settings → Apple Account → iCloud → Manage Storage →
SsumSsum. The Backup & restore screen also offers
deletion.
Withdrawing consent — turning automatic sync off stops cloud
transfers immediately. Reminders can be turned off in settings.
Resetting the app does not wipe your cloud copy. "Delete everything"
and restoring from a file mean empty this device — not "erase it
everywhere". That protects you from losing your only copy while tidying up
a phone. To remove the cloud copy, use the steps above, or choose
"Replace with this device" yourself on the sync conflict screen.
This service is not directed at children under 14. We do not
knowingly collect information from them, and we delete it without delay if we
learn we have.
Where a minor has made a purchase without consent, a legal guardian may
cancel it through the store that processed the payment.
15. Security
Collect as little as possible — no sign-up, no identifiers, and
no server storing your entries at all.
Generalise before sending — amounts become bands; memo text is
not sent.
Least privilege — cloud access is scoped to an app-private
folder, so your other files are out of reach.
Encryption in transit — all outside traffic is HTTPS (TLS).
OS isolation — entries and settings live only in per-app
sandboxed storage.
Generational backups — seven dated copies alongside the latest,
so a bad overwrite does not cost you your records.
Personal Information Infringement Report Centre — 118 ·
privacy.kisa.or.kr
Personal Information Dispute Mediation Committee — 1833-6972 ·
kopico.go.kr
If you are elsewhere, you may contact your local data protection
authority. Wherever you are, writing to us first is usually faster.
18. Open source and third-party notices
The list below is the whole of the third-party material in the app and on
this page. We use no third-party emoji, illustration, photograph, or icon
artwork. The category icons you see in the app are glyphs from the icon
typeface below; the app ships no image files for them.
Flutter, Dart, and the open-source packages we depend on
Implementation
Google LLC and others
BSD 3-Clause and each package's own licence
The complete list with full licence texts is available in the app under
Settings → About → Licences.
The app icon, screen design, and wording are original works of
MODUMWORKS.
19. Changes to this policy
We will announce any change on this page at least 7 days before it
takes effect — 30 days where the change is to your disadvantage.
v1.0 — August 29, 2026. First issue.
v1.1 — August 30, 2026. §2, §6, §8, §11, and §12 updated for the
introduction of banner and rewarded ads.
v1.2 — August 30, 2026. The short version, §2, and §8
updated for the change in ad format: a full-screen ad now appears
without asking first, and exporting a file goes ahead after the ad
(except when no ad can be loaded).