NEWSORI Privacy Policy
Eazler Inc. (주식회사 이즐러, "we") runs NEWSORI (the "Service"). We have this policy to protect users' personal information under Korea's Personal Information Protection Act (PIPA) and to handle related complaints quickly and smoothly.
- Effective date: 9 November 2026
- Amended: effective 10 November 2026 (the name and retention period of invitations); effective 11 November 2026 (cookieless visit statistics)
- This English version is a translation; the Korean version governs.
- Previous versions: the version effective 9 November 2026 (before the invitation amendment: section 2 "Closed-beta invitations: the e-mail addresses we invited and when each invitation was sent, accepted or cancelled", section 3 "Invitations never accepted are deleted when the closed beta ends"); the version effective 10 November 2026 (before visit statistics: the overview said "We use no advertising or third-party analytics tools", and sections 1, 2, 3, 6, 7, 9 and 10 had nothing on visit statistics).
At a glance
| Topic | Summary |
|---|---|
| What we collect | Your Google account's name and e-mail, sign-in security data (session, IP address, browser details), the content you upload or write and your activity, cookieless visit statistics |
| What we do not collect | Unique identifiers such as national ID numbers, payment details, precise location, advertising identifiers. We use no advertising tools and no analytics that use cookies; we use only cookieless visit statistics (Cloudflare Web Analytics) |
| Sharing with third parties | None (except as the law provides or where you have agreed, section 5) |
| Processors and overseas transfer | Cloudflare (United States and elsewhere), Databricks (Neon, servers in Singapore), Google (our e-mail) — sections 6 and 7 |
| Retention | Destroyed within 5 days of an account deletion request as a rule; some records kept for the periods below |
| Your rights | Access and export, correction, deletion, suspension of processing, pausing and clearing listening history, closing your account |
| Under 14 | Cannot create an account |
1. Purposes and legal bases
We process personal information only for these purposes, and take the steps PIPA (e.g. Art. 18) requires if a purpose changes.
| Purpose | What it covers | Basis |
|---|---|---|
| Sign-up and account management | Identifying you, sign-in, account security, preventing misuse, notices | Concluding and performing the contract (PIPA Art. 15(1)(4)) |
| Listening | Playback, likes, follows, playlists, listening history and personal stats, recommendations, notifications | Performing the contract (Art. 15(1)(4)) |
| Creator features | Artist profiles, uploads and processing, recording AI and rights declarations, review and publication | Performing the contract (Art. 15(1)(4)) |
| Safety and rights | Handling reports, moderation, handling copyright notices, restrictions, disputes | Legal obligations (Art. 15(1)(2)), our legitimate interests (Art. 15(1)(6)) |
| Public aggregates | Play counts, charts and other statistics that do not identify anyone | Performing the contract, our legitimate interests |
| AI assistant connections | Managing the access you grant to AI apps and logging their calls | Performing the contract |
| Answering enquiries | Replying to enquiries, rights requests and reports received by e-mail | Performing the contract, legal obligations |
| Visit statistics | Seeing which pages are viewed, how often and where visitors come from, to improve the Service and measure promotion | Our legitimate interest (Art. 15(1)(6)) |
We do not use your personal information for advertising, sale or third-party marketing, and we do not use it to train AI models without your separate consent.
2. What we process
a. Sign-up and sign-in (required)
- Google sign-in: Google account identifier, name (your Google display name), e-mail address, whether it is verified, profile picture address, and sign-in tokens issued by Google
- Passkeys (optional): public key, credential ID, authenticator model identifier (AAGUID), device type, backup state, passkey name. Biometric data stays on your device and is never sent to us
- Account details: role (user, moderator, administrator), account status, language, sign-up and change times
- Invitations: the e-mail addresses we invited (creator invitations) and when each invitation was sent, accepted or cancelled
b. Created or collected automatically
- Sign-in sessions: session identifier (cookie), IP address, browser and device details (User-Agent), sign-in method, expiry time
- Abuse prevention: IP address and path of sign-in and authentication requests (for rate limiting)
- Service logs: request information recorded by the Cloudflare platform (request time, address, response status, error details, and request metadata added by Cloudflare). These may include the IP address and browser details carried in request headers
- Visit statistics: the page visited, the previous page (referrer), browser and device type, country and page-load performance. Collected by Cloudflare Web Analytics without cookies or browser storage; Cloudflare states that it does not identify individuals by IP address or browser details
c. What you write or choose in the Service
- Listener activity: likes, follows of artists and people, blocks, reposts, playlists (including collaborative ones), comments and your comment name, public profile (handle and bio; you choose whether it is public), taste genres, "not interested" choices, notifications, listening settings
- Listening history: tracks you played while signed in and when (visible only to you; you can pause or clear it)
- Creator information: artist profiles, one or several per account (handle, display name, bio, picture, external links), uploaded audio originals and covers with file details (size, format, hash), track details (title, description, genre, language, lyrics and translations, prompt and style tags, remix sources), albums, AI and rights declarations (AI involvement and components, tool and version, plan, human contribution, licence, use of voices, confirmation of being 19 or older, time of attestation and policy version), voice authorisation evidence (PDF)
- Reports: target, reason, details, and the reporter's account when signed in
- Copyright notices and restoration requests: name of the notifier or their agent, affiliation (optional), rights holder, postal address, phone number, e-mail, details of the work, the track concerned, description of the infringement, how the rights are evidenced and an explanation, statements and signature. Contact details (address, phone number, e-mail) are stored encrypted
- AI assistant connections: the connected app's name and identifying address, the permissions granted, when it was connected and changed, when it last obtained a token, a log of what the app did (feature name, target IDs, success, time), the record of letting apps act in the member's name (when it was turned on and off, the version of the statement agreed to), and the identifier of the app that filed a declaration. Tokens are never stored in full, only as hashes
- E-mail enquiries: the sender's e-mail address and name, the content of the enquiry and any attachments
d. Visitors who are not signed in
- Counting plays: a non-identifying key derived from your connection that changes every hour (the IP address itself is not stored)
- Anonymous reports and copyright notices filed without signing in: the report, the Cloudflare Turnstile check result, and an hourly key derived from your connection (for abuse prevention, deleted after 48 hours). Neither the IP address itself nor browser details are stored with the report
e. Third parties' information in evidence
Voice authorisation evidence may contain information about third parties, such as the name of the person whose voice was used. The uploader must have that person's agreement to submit it to us; we use it only for review and for dealing with disputes.
3. Retention
We destroy personal information without delay once its purpose is fulfilled, except that we keep the following for the periods in the table.
| Information | Kept for |
|---|---|
| Invitations | Once the invited person signs up, managed with the account and deleted when the account is deleted. Invitations never accepted are deleted one year after they are cancelled |
| Account and related information | Sign-in and public pages stop at once on a deletion request; erasure starts 24 hours later and completes within 5 days of the request. A deletion cannot be cancelled |
| Sign-in sessions (with IP address and browser details) | Deleted on sign-out; expired sessions by the regular clean-up job (every 6 hours) |
| Rate-limit records (IP addresses) | One day after the last request |
| Service logs | Deleted automatically after up to 7 days |
| Visit statistics | We see only aggregates that identify no one; Cloudflare keeps the raw data under its own policy |
| Listening history | Exact time for 90 days, then the date only; deleted one year after the play. You can clear it at any time |
| Play de-duplication records | One day |
| Hourly play totals | 72 hours (numbers per track only, no personal information) |
| Daily play totals and charts | No limit (numbers per track only, no individual can be identified) |
| Raw playback events | Not stored |
| Notifications | Shown for 90 days; deleted with the account |
| Files whose upload was not completed | Deleted automatically after 7 days |
| Originals rejected in processing, and all files of a deleted track (original, cover, playback copies, evidence) | Deleted after 30 days. Tracks removed for legal reasons such as copyright, and tracks named in a copyright notice under review or acted on, are kept with their files to deal with disputes |
| Public media files (playback copies) | Deleted at once when unpublished, hidden or removed, with a cache purge requested (target: within 15 minutes). Copies already downloaded or stored in browsers cannot be recalled |
| Reports and moderation records (including the content of comments that were reported or acted on) | 3 years after resolution. They are kept for this period even after account deletion to deal with disputes or legal claims; after account deletion they are not linked to a name or e-mail address and are used for nothing else |
| Copyright notice and restoration request records | 3 years after resolution |
| A track's AI and rights declaration | While the track exists. After account deletion or deletion of the track it is kept for 3 years to deal with disputes; after account deletion it is not linked to a name or e-mail address |
| AI app call logs | 365 days; deleted with the account |
| Delegation records for apps | While the account exists; deleted with the account. The app identifier on a track's AI and rights declaration is kept as long as that declaration |
| E-mail enquiries | 3 years after resolution |
| Database recovery records | Remain in recovery records for up to 7 days, then deleted automatically |
Where another law requires retention we keep the data separately for that period. We take no payments and sell nothing, so no transaction records arise under the Act on the Consumer Protection in Electronic Commerce.
4. How we destroy information
- Procedure: data whose period has ended or whose purpose is fulfilled is destroyed by automated jobs or by an administrator. Data kept under the law is stored separately from other data.
- Method: electronic data in databases and storage is deleted so that it cannot be restored. Data left in recovery records is deleted when their retention period ends. We do not process paper records.
- We do not move accounts that have not been used for a long time into a separate dormant state.
5. Sharing with third parties
We do not provide your personal information to third parties, except:
- where a law-based request (for example from an investigative authority) requires it or you have separately agreed;
- in the copyright notice procedure (Article 103 of the Copyright Act and its Enforcement Decree): we send the user who uploaded the track a copy of the notice, which contains the notifier's name, affiliation, rights holder and e-mail (the notifier's address and phone number are not sent). If the uploader asks for copying and transmission to be restored, we send the notifier a copy of that request, which contains the name and contact details the uploader gave in it.
Please note what is public: artist profiles you make public, uploaded tracks and their details (including AI declarations), comments and comment names, and playlists and listener profiles you make public can be seen by anyone and can be embedded on other sites. Your sign-in name and e-mail are never shown.
We do not show publicly that several artist profiles belong to one account, or to you. This does not make the link impossible to work out: the times profiles were created can be read from their identifiers, profiles of one account are suspended together, and what you do yourself (the same comment name, bio or links) can connect them. Operators (moderators and administrators) can see the link.
6. Processors
We entrust processing to the following providers to run the Service. Their own sub-processors are listed in each provider's published list.
| Processor | Work entrusted |
|---|---|
| Cloudflare, Inc. | Running the website and API (Workers, Pages), content delivery (CDN), file storage (R2), job queues (Queues), database connections (Hyperdrive), bot checks (Turnstile), service logs, visit statistics (Web Analytics), forwarding mail sent to our e-mail addresses (Email Routing) |
| Databricks, Inc. (Neon service) | Running the database (PostgreSQL). Neon runs on Amazon Web Services |
| Google LLC | Our e-mail (Gmail): keeping enquiries and reports sent to our e-mail addresses, and sending the individual notice e-mails we send to members |
We use no bulk e-mail delivery provider. If we introduce one, we will add it to this table and announce it.
Sign-in with Google. If you choose Google sign-in, Google LLC authenticates you and passes your name, e-mail and profile picture to us. This authentication is a service between you and Google, and Google's processing follows Google's privacy policy.
Media processing on our own equipment. Converting uploaded audio and processing cover images is not outsourced: it runs on a computer in Korea that we manage ourselves. Files being processed are handled only in an isolated workspace with no internet access and are removed when the job ends.
7. Overseas transfer
To perform our service contract with you, we entrust processing and storage abroad as follows (PIPA Art. 28-8(1)(3)).
| Item | Cloudflare | Databricks (Neon) | |
|---|---|---|---|
| Recipient | Cloudflare, Inc. | Databricks, Inc. | Google LLC |
| Contact | privacyquestions@cloudflare.com | privacy@databricks.com | Google's privacy contact form (policies.google.com/privacy) |
| Countries | United States and the countries of the Cloudflare data centres that handle your requests. File storage: Asia-Pacific region | Singapore (AWS ap-southeast-1 region) | United States and other countries where Google has data centres |
| When and how | Whenever you use the Service, over encrypted connections (TLS) | Whenever you use the Service, over encrypted connections (TLS) | When you send mail to our e-mail addresses, and when we send e-mail to members |
| Items | Information in your requests, uploaded files, service logs, visit statistics and e-mail sent to us (from section 2) | Everything stored in the database (from section 2) | E-mail enquiries (the last item of section 2(c)); the e-mail address of a member receiving an individual notice and the content of the notice |
| Purpose | The work in section 6 | Running the database | Our e-mail |
| Retention | The periods in section 3, or until the contract with the processor ends | The periods in section 3, or until the contract with the processor ends | The periods in section 3, or until the contract with the processor ends |
Refusing and its effect. These transfers are necessary to provide the Service, so refusing means not signing up or closing your account, after which features that need an account are unavailable. You can also use the report feature in the Service instead of e-mail. You can close your account in Settings or ask our privacy officer below.
8. Rights of users and legal representatives, and how to exercise them
You may at any time:
- Access and export: use "Download my data" in Settings to get your account information and activity as a JSON file (your uploaded audio files are not included).
- Correct: edit your profile, track details and so on in the Service (when a declaration of a track under review can be changed is set by the review rules).
- Delete and close your account: delete your account in Settings → Delete account. You can clear or pause your listening history in Settings.
- Suspend processing and withdraw consent: disconnect AI apps in Settings → Connected AI apps at any time.
- Automated decisions: we make no automated decisions within PIPA Art. 37-2. Recommendations are suggestions you choose to look at, and publication and restrictions are decided by people after review. Where an upload is refused automatically (such as format, length or duplicate checks) the reason is shown on screen and you can ask us about it.
Requests you cannot complete in the Service can be sent to our privacy officer by e-mail; after confirming your identity we tell you the outcome within 10 days. Requests through an agent need a power of attorney. A request may be limited where others' rights or a legal retention duty are involved, and we tell you why.
9. Children under 14
The Service does not accept accounts of children under 14 and does not run a parental-consent process. Users confirm on the sign-in screen that they are 14 or older. If we learn that we have collected a child under 14's information we delete the account and the information without delay. Listening to public music without signing in is open to all ages and creates only the non-identifying data in section 2(d) and cookieless visit statistics.
10. Automatic collection (cookies and browser storage)
We use no advertising or analytics cookies and do not collect behavioural data that tracks you beyond this site.
| Name | Kind | Purpose | Kept |
|---|---|---|---|
| __Secure-newsori.session_token | Cookie (essential) | Keeping you signed in | Until you sign out, or 7 days (extended while you use the Service) |
| __Secure-newsori.state | Cookie (essential) | Security check during Google sign-in | 5 minutes |
| __Secure-newsori.better-auth-passkey | Cookie (essential) | Security check during passkey sign-in and registration | For the duration of sign-in or registration |
| __Secure-newsori.oauth_state and other cookies whose name contains newsori | Cookie (essential) | Security checks while connecting an AI app | 10 minutes or less |
| newsori.playback.v1 | Browser storage (localStorage) | Autoplay, volume levelling and the setting for hiding tracks labelled harmful to minors | Until you clear it (on your device only) |
| newsori.queue.v1 | localStorage | Restoring your queue (track IDs and position) | Until you clear it (on your device only) |
| newsori.lyrics.translation | localStorage | Your lyrics translation language | Until you clear it (on your device only) |
| newsori.install.v1 | localStorage | Whether the install suggestion was shown | Until you clear it (on your device only) |
| newsori.studio.artist.(account ID) | localStorage | Which of your artists the studio opens on | Until you clear it (on your device only) |
| newsori:playlist-invite:… | sessionStorage | Moving a collaboration invite token out of the address bar and keeping it | Deleted when the tab closes |
| Offline page cache | Service worker cache | Showing a notice when you are offline | Replaced when a new version installs |
| Cloudflare Web Analytics script | Visit-statistics script (uses no cookies or browser storage) | Visit statistics | Nothing stored on the device |
Browser storage is not sent to us (restoring a queue sends only track IDs to reload the tracks). You can delete or block cookies and site data in your browser settings; blocking essential cookies prevents sign-in, and blocking browser storage means settings and the queue are not remembered. When you report without signing in, Cloudflare Turnstile may process browser information to check for bots. You can block the visit-statistics script with your browser's tracking protection or a content blocker; the Service works the same without it.
NEWSORI players embedded on other sites use no sign-in cookies; their plays count as plays by someone not signed in.
11. Pseudonymised and sensitive information
We do not process pseudonymised information. We do not collect sensitive information. Public content you write yourself (lyrics, comments, bios and so on) could reveal sensitive details, so please take care before publishing.
12. Security measures
- Administrative: minimal access to personal information, logging when moderators or administrators open another account's material (audit log), logging access to copyright notice contact details
- Technical: encryption in transit everywhere (HTTPS/TLS), passkey authentication for moderators and administrators, hashing of sign-in and AI app tokens, encryption of copyright notice contact details, separate private and public storage, processing uploads in isolated environments, rate limits, security headers
- Physical: data-centre security follows our processors' measures (Cloudflare, Databricks/AWS, Google), and the media processing computer is kept in a place we manage
13. Privacy officer and complaints
| Item | Details |
|---|---|
| Privacy officer | 이대성 (CEO) |
| privacy@newsori.com | |
| Phone | 010-5139-5098 |
| Address | 202-1702, 36 Jugyul-ro, Siheung-si, Gyeonggi-do, Republic of Korea (경기도 시흥시 죽율로 36 202동 1702호) |
14. Remedies
For advice or dispute resolution about a privacy infringement you can contact the following (Korean authorities):
- Personal Information Dispute Mediation Committee: 1833-6972, www.kopico.go.kr
- Personal Information Infringement Report Center (KISA): 118, privacy.kisa.or.kr
- Supreme Prosecutors' Office: 1301, www.spo.go.kr
- Korean National Police Agency: 182, ecrm.police.go.kr
15. Users in the European Union and elsewhere
To the extent the EU General Data Protection Regulation applies to our users in the European Union, we process for the purposes in section 1 on the bases of performing the contract (Art. 6(1)(b)), legal obligations (c) and legitimate interests (f). EU users have the rights of access, rectification, erasure, restriction, portability and objection, and may complain to the supervisory authority where they live; they can exercise their rights through the contacts in section 13. The Republic of Korea has an EU adequacy decision.
16. Changes to this policy
We announce changes in the Service 7 days before they take effect (30 days for changes important to users' rights) and also tell members individually about important changes through in-Service notifications. Minor changes such as the processor list may be announced together periodically. Earlier versions remain available on this page.