HSKLink Policy

HSKLink Privacy Policy

HSKLink Privacy Policy

Announcement Date: August 25, 2026
Effective Date: August 25, 2026

XFC Inc. (hereinafter referred to as the “Company”) values the privacy and personal information of HSKLink users and complies with the Personal Information Protection Act of the Republic of Korea and other applicable laws and regulations.

Pursuant to Article 30 of the Personal Information Protection Act, the Company hereby discloses matters concerning the purposes of processing personal information, categories of personal information processed, retention periods, outsourcing of personal information processing, international transfers, and the rights of data subjects.

This Privacy Policy applies to the HSKLink service operated by the Company at hsklink.xfc.icu.

HSKLink is currently operated as a free beta service. System configurations and infrastructure regions may change during the process of service stabilization. If there is any material change to the location or method of personal information processing, the Company will amend this Privacy Policy and provide prior notice.

1. Purposes of Processing Personal Information

The Company processes only the minimum amount of personal information necessary for the following purposes.

① Member Authentication and Account Management

  • Identifying and authenticating users through email addresses
  • Login using email OTP (one-time password)
  • Managing membership and service access rights
  • Preventing fraudulent use and abnormal authentication attempts
  • Processing membership withdrawal
  • Responding to customer inquiries and supporting users

② Provision of the HSKLink Service

  • P2P connections between user devices
  • File transfer
  • Text message transmission
  • Voice calls
  • WebRTC connection and signaling
  • TURN relay connections where direct P2P connection is difficult
  • Management of connection and session status
  • Management of file transfer status and service usage status

③ Service Stability and Security

  • Analysis of system failures
  • Error detection and recovery
  • Detection of abnormal access or abuse of the Service
  • System security and network monitoring
  • Service quality management
  • Compliance with obligations under applicable laws

④ Customer Support and Service Improvement

  • Handling customer inquiries and complaints
  • Resolving technical issues
  • Improving service quality and performance
  • Analyzing usage of the beta service

If the Company sends advertising or marketing communications in the future, it will obtain any required consent separately in accordance with applicable laws.

2. Categories of Personal Information Processed

① Registration and Login

HSKLink currently does not provide social login using external accounts such as Google or Apple.

The Company uses its own email OTP authentication method.

Required information

  • Email address

The email address is used for login authentication, user identification, and provision of the Service.

The Company does not request or access a user’s name, phone number, profile photo, or Google account profile information during registration.

② Email OTP Authentication

When logging in, a six-digit one-time authentication code is sent to the email address entered by the user.

The following information may be processed:

  • Email address
  • Verification information for OTP authentication
  • Authentication code creation time and expiration time
  • Authentication success or failure status

The OTP remains valid only for a limited period and is deleted in accordance with the Service’s security policies once authentication is completed or the validity period expires.

If the Company is configured not to store the original OTP in its database and instead stores only a cryptographic verification value, only such verification value is processed.

③ Information Automatically Generated During Use of the Service

As a general principle, HSKLink does not separately and continuously store user IP addresses or detailed access records in member data stored in Firestore.

However, the following information may be automatically generated in system logs while using Google Cloud infrastructure:

  • IP address
  • Request date and time
  • Requested URL or API path
  • Technical information related to HTTP requests
  • HTTP response codes
  • Browser and network-related technical information
  • System error and failure information
  • Request identifiers

Such information may be automatically processed through infrastructure logging systems such as Google Cloud Logging rather than through HSKLink’s ordinary member database.

④ Beacon and Session Information That May Be Processed for Service Operation

For service stability and security monitoring, the following minimum technical information may be processed:

  • Random session identifiers
  • Connection success or failure status
  • Direct P2P or Relay connection type
  • File transfer success or failure status
  • Amount of data transferred
  • Transfer duration
  • File integrity verification success or failure status
  • Voice call connection success or failure status

Even where such operational information is collected, the Company does not store the actual contents of files, messages, or voice communications for operational analytics purposes. Message History described below is processed only when an eligible account user explicitly enables it.

⑤ Pseudonymous Guest Device Identifier

When HSKLink is used without signing in, the browser creates a cryptographically random pseudonymous device identifier and stores it in site storage. This identifier is used to keep Guest connection continuity, apply the monthly Secure Relay allowance consistently, and prevent repeated free Relay issuance.

  • It is not a real name, verified person identity, phone number, hardware fingerprint, or cross-site advertising identifier.
  • The same browser profile normally reuses the identifier after refresh, a new tab, or browser restart.
  • Clearing site data or using private browsing may create a new identifier.
  • For abuse prevention, HSKLink may apply rate limits and a monthly soft limit using non-reversible, server-secret-protected network and Guest identity hashes. Raw address-book data and precise hardware fingerprints are not used.
  • Guest identifiers may be marked as converted when the user later signs in, while the signed-in account entitlement becomes the source of truth.

3. Main Service Infrastructure

The main infrastructure used for the current HSKLink free beta service is as follows.

Firebase / Firestore

  • Service: Member and service operation database
  • Region: asia-northeast3
  • Location: Seoul, Republic of Korea

Google Cloud Run

  • Service: Web/API and WebSocket signaling server
  • Region: asia-northeast1
  • Location: Tokyo, Japan

Because personal information processed through Cloud Run may be processed in Japan, such processing may constitute an international transfer of personal information.

4. Information the Company Does Not Generally Store

HSKLink uses a P2P-oriented communication architecture and does not permanently store the following information from ordinary temporary Rooms on the Company’s servers:

  • Actual contents of files transmitted by users to other users
  • Actual contents of text messages, except when an eligible account user explicitly enables Message History
  • Audio contents of real-time voice calls
  • Original local files stored on user devices
  • Actual content transmitted directly through WebRTC DataChannels

The Company does not provide a conventional cloud file storage service and does not upload and retain user files on the Company’s servers for long-term storage as part of the basic file transfer functionality.

If a Plus or Pro account user explicitly enables Message History, text content and file metadata such as file name, size, media type, and transfer identifier may be stored in Firestore and synchronized across the user’s account devices. File contents are not stored. The retention period is up to 90 days for Plus and 365 days for Pro. Users may disable this feature at any time.

5. Data Processing Through P2P, STUN, and TURN

① Direct P2P

Where possible, HSKLink uses WebRTC to establish a direct connection between a user’s device and another user’s device.

When a Direct P2P connection is established, files, text messages, and voice data are, in principle, transmitted directly between user devices without passing through the Company’s application servers.

② STUN

During the WebRTC connection process, HSKLink may use public STUN servers provided by Google or other providers to identify NAT environments and establish direct connections.

Example:

stun:stun.l.google.com:19302

STUN may process technical information such as IP addresses and port information necessary for establishing network connections, but it is not used to store the contents of user files.

③ TURN Relay

If Direct P2P connection is difficult due to network conditions, CGNAT, Symmetric NAT, firewalls, or other technical reasons, HSKLink may use the Company-operated coturn relay at turn1.hsklink.xfc.icu.

When a TURN connection is used, the following information may temporarily pass through the TURN server:

  • Network address and connection information
  • Encrypted WebRTC traffic

Depending on the user’s network environment, TURN relay servers may use relay nodes located outside the Republic of Korea.

HSKLink is not configured to permanently store user files on TURN servers.

6. Processing and Retention Periods

The Company deletes personal information without undue delay when the purpose of processing has been achieved.

However, where retention is required by applicable law, the Company retains such information for the period required by law.

① Member Information

Category

  • Email address

Retention Period

  • Until membership withdrawal

However, where retention is required by law or where there is a legitimate need to prevent abuse of the Service, the minimum necessary information may be retained separately for the necessary period.

② OTP Authentication Information

Categories

  • OTP authentication verification information
  • Creation and expiration information

Retention Period

  • Deleted without undue delay after authentication is completed or the validity period expires

③ General System Access Logs

The following information may be automatically recorded in Google Cloud Logging during use of services such as Cloud Run:

  • IP address
  • Access date and time
  • Request path
  • HTTP status code
  • System error information

The default retention period for the general _Default log bucket used by HSKLink is 30 days, unless a different retention period has been configured.

However, _Required logs maintained by Google Cloud for security and audit purposes may be retained for 400 days in accordance with Google Cloud policies.

④ Optional Account Message History

Message History is disabled by default. When explicitly enabled by an eligible user, text content and file metadata are retained for up to 90 days for Plus or 365 days for Pro. Disabling the feature stops subsequent server storage and initiates deletion of message records sent by that account. File contents and call media are not included.

7. Outsourcing of Personal Information Processing

The Company may outsource or use external service providers for certain personal information processing activities necessary to provide the Service.

Service ProviderOutsourced or Used Service
Google Cloud-related service providersCloud infrastructure including Cloud Run, Firestore/Firebase, and Cloud Logging
Google LLC / Gmail / Google SMTPSending email OTP authentication messages
TURN infrastructure hosting providerHosting the Company-operated coturn relay when Direct WebRTC connection fails

For processing activities subject to applicable laws, the Company makes reasonable efforts to manage necessary safeguards, including restrictions on processing personal information beyond the permitted purposes and implementation of security measures.

8. OTP Delivery Through Gmail / Google SMTP

HSKLink uses Gmail / Google SMTP services to send email OTP authentication messages.

During the delivery of OTP authentication emails, the following information may be transmitted to Google:

  • User email address
  • Contents of the OTP authentication email
  • Technical information necessary for email transmission and delivery

Google operates servers worldwide to provide services including Gmail, and information may therefore be processed outside the country in which the user resides.

The Company does not separately provide user email addresses to Google for purposes other than email authentication.

9. International Transfer of Personal Information

HSKLink may process or store certain personal information outside the Republic of Korea in order to provide the Service.

Legal Basis for International Transfer

Pursuant to Article 28-8(1)(3) of the Personal Information Protection Act of the Republic of Korea, the Company may transfer personal information abroad where overseas outsourcing or storage is necessary for the conclusion or performance of a service agreement with the data subject, provided that the matters required under applicable law are disclosed through this Privacy Policy.

① Google Cloud Run

Recipient

Google Cloud-related contracting entity

Contact

Google Privacy Team
googlekrsupport@google.com

Country of Transfer

Japan

Region

asia-northeast1 (Tokyo)

Personal Information Transferred

  • Email address
  • Member account and authentication-related information
  • Service session and usage status information
  • Technical information generated during system operation

Purpose of Transfer

  • Operation of HSKLink web/API servers
  • WebSocket signaling
  • Processing APIs related to email authentication
  • Management of service status
  • Maintaining system stability and security

Timing and Method of Transfer

  • Transferred through encrypted network communications when the user uses the Service

Retention and Use Period

  • In accordance with the retention periods specified for each category in this Privacy Policy

How to Refuse International Transfer and Effects of Refusal

Users may stop overseas processing of personal information by withdrawing their membership and discontinuing use of the Service.

However, because HSKLink’s Cloud Run servers are operated in a Japan region, refusal of such overseas processing may prevent normal use of core functions such as login and signaling.

② Firebase / Firestore

Recipient

Google Cloud-related contracting entity

Country of Processing

Republic of Korea

Region

asia-northeast3 (Seoul)

Personal Information That May Be Processed

  • Email address
  • Member account information
  • OTP authentication verification information
  • Service usage status
  • Session identifiers
  • Connection success or failure status
  • Minimum technical indicators required for service operation and security monitoring

Purpose of Processing

  • Storage of member information
  • Authentication and service usage status management
  • Service stability and security management

Because the primary data storage location of Firestore is Seoul, Republic of Korea, primary database storage itself is considered domestic processing.

However, Google policies may apply where separate processing occurs in connection with support, backups, or global service operations.

③ Gmail / Google SMTP

Recipient

Google LLC and related Google service operating entities

Contact

Google Privacy Team
googlekrsupport@google.com

Countries Where Processing May Occur

The United States and other countries where Google operates servers to provide Gmail and related services

Information Transferred

  • User email address
  • Information required to deliver OTP authentication messages

Purpose of Transfer

  • Sending OTP emails for HSKLink login

Timing and Method of Transfer

  • When the user requests OTP authentication, through encrypted network or SMTP communications

Retention and Use Period

  • In accordance with Google’s service operation and privacy policies. The Company does not request Google to retain personal information beyond what is necessary for authentication purposes.

How to Refuse International Transfer and Effects of Refusal

Users may refuse such processing by not requesting OTP authentication or by discontinuing use of HSKLink.

However, because HSKLink currently uses email OTP as its login method, refusal of email-related processing may restrict the user’s ability to log in.

④ Company-operated TURN Service

Recipient or Processor

TURN infrastructure hosting provider for turn1.hsklink.xfc.icu

Information Processed

  • Network connection information such as IP addresses
  • Technical information required for TURN connection
  • Encrypted WebRTC traffic

Purpose of Processing

  • Relaying WebRTC traffic when Direct P2P connection is unavailable

Timing of Processing

  • While a TURN connection is actively being used

Method of Processing

  • Relay of encrypted WebRTC packets over the Internet

Countries of Processing

  • Singapore, where the current turn1.hsklink.xfc.icu relay is hosted

Retention Period

  • Processed temporarily during communication. HSKLink is not configured to permanently store user files on TURN servers.

How to Refuse International Transfer and Effects of Refusal

Users may discontinue use of HSKLink or use the Service in a network environment where TURN relay is not required.

If TURN processing is refused or unavailable, P2P connections may not be established in certain mobile networks, corporate networks, or other restricted environments.

10. Google Cloud Logging

HSKLink uses Google Cloud Logging for service stability and system security.

The following information may be automatically recorded:

  • IP address
  • Access time
  • Request path
  • HTTP status code
  • Request and error identifiers
  • System error information

The default retention period for the _Default bucket used for general service logs is 30 days.

Google’s mandatory security and audit logs stored in the _Required bucket may be retained for 400 days.

The runtime regions of Cloud Run or Firestore and the storage location of Cloud Logging buckets are not necessarily the same.

The actual storage location of log data depends on the log bucket location configured in Logs Storage for the applicable Google Cloud project.

11. Provision of Personal Information to Third Parties

The Company does not, in principle, provide users’ personal information to third parties.

However, personal information may be provided in accordance with applicable laws in the following cases:

1. Where the user has provided prior consent

2. Where applicable laws specifically require or permit such provision

3. Where there is a lawful request from a court, investigative authority, administrative agency, or other competent authority

4. Where otherwise permitted under the Personal Information Protection Act

Outsourcing of personal information processing for cloud infrastructure, email transmission, communication relay, and similar service operation purposes is managed separately from third-party provision in accordance with applicable laws.

12. Destruction of Personal Information

The Company destroys personal information without undue delay when the purpose of processing has been achieved or the applicable retention period has expired.

Personal information stored electronically is deleted using methods designed to make recovery or restoration difficult.

Where information must be retained for a certain period under applicable laws, such information is stored separately from other personal information and destroyed after the applicable retention period expires.

13. Rights of Data Subjects and How to Exercise Them

Users may exercise the following rights at any time in accordance with applicable laws:

  • Request access to personal information
  • Request correction of personal information
  • Request deletion of personal information
  • Request suspension of personal information processing
  • Withdraw consent
  • Withdraw membership

Requests regarding the exercise of rights or personal information may be submitted through the following contact details:

Email: xfcinfo@gmail.com
Telephone: +82-2-322-8396

The Company processes such requests in accordance with the procedures and timeframes prescribed by applicable laws.

14. Measures to Ensure the Security of Personal Information

The Company implements technical and administrative safeguards appropriate to the characteristics of the Service, including:

  • HTTPS/TLS encrypted communication
  • WebRTC encrypted communication
  • Email OTP authentication
  • OTP validity periods and authentication attempt limits
  • Restrictions on administrator access rights
  • Server-side access control
  • Access controls for Google Cloud infrastructure
  • Management of system and error logs
  • Minimization of personal information collection
  • Non-storage of P2P file content on Company servers
  • Software security updates and vulnerability management
  • Monitoring of abnormal authentication and access activity

The Company continuously seeks to improve reasonable safeguards for protecting personal information.

15. Cookies and Browser Storage Technologies

HSKLink may use the following browser storage technologies, depending on the implementation of the Service, for login, P2P connections, and user convenience features:

  • Cookies
  • Local Storage
  • Session Storage
  • IndexedDB
  • Service Worker Cache

These technologies may be used for the following purposes:

  • Authentication and login state management
  • Device and session state management
  • Storage of user preferences
  • Temporary management of P2P connection and file transfer status
  • Caching of static application resources

The Company applies safeguards to prevent sensitive information, including authentication information, from being unnecessarily exposed in browser storage.

As a general principle, Service Workers are managed so that sensitive API responses relating to authentication, administration, or similar functions are not persistently cached.

Users may delete cookies or browser storage information through their browser settings. However, doing so may restrict normal use of certain features.

16. Personalized Advertising and Behavioral Information

The current HSKLink free beta service does not provide personalized advertising services using users’ personal information or service usage history.

The Company does not analyze or sell the following user content for advertising purposes:

  • File contents
  • Text message contents
  • Voice call contents

If advertising, web analytics, or third-party advertising or analytics services are introduced in the future, the Company will update this Privacy Policy with the relevant processing details and obtain prior consent where required.

17. Paid Services and Payments

HSKLink may offer paid recurring subscriptions such as Plus and Pro through NICE Payments Co., Ltd. (NICEPAY).

For payment authorization, card information entered by the user is encrypted and transmitted to NICEPAY. HSKLink does not store the full card number, card password, date of birth, business registration number, CVC, or raw authorization data in its database.

HSKLink stores only the minimum transaction and subscription records required to provide and manage the paid service, including the login email, plan, amount, currency, order number, transaction number, subscription status, billing period, next billing date, cancellation status, and an encrypted billing reference.

Payment and subscription records are retained for the period required by applicable Korean laws and are deleted or securely de-identified when the retention period ends, unless continued retention is legally required.

18. Children Under the Age of 14

HSKLink is not primarily intended for children under the age of 14.

If the Company provides services in the future that require processing personal information of children under the age of 14, it will follow procedures required by applicable laws, including obtaining consent from a legal guardian where necessary.

19. Personal Information Protection Officer

The Company has designated the following Personal Information Protection Officer to handle inquiries, complaints, and requests for relief relating to personal information processing.

Personal Information Protection Officer

Name: Joo-Hyung Lee
Position: Chief Executive Officer
Company: XFC Inc.
Email: xfcinfo@gmail.com
Telephone: +82-2-322-8396

Users may contact the Personal Information Protection Officer regarding privacy-related inquiries, complaints, or requests for relief arising from use of HSKLink.

20. Remedies for Personal Information Infringement

Users may contact the Company regarding personal information infringement or may seek consultation or dispute resolution through the Personal Information Dispute Mediation Committee or other competent privacy-related institutions in accordance with applicable laws.

21. Changes to This Privacy Policy

The Company may amend this Privacy Policy in response to changes in service features, personal information processing methods, infrastructure configurations, or applicable laws and regulations.

If this Privacy Policy is amended, the Company will announce the details of the changes and the effective date through the HSKLink Service or another appropriate method before the amendment takes effect.

If there is a material change to personal information processing, the Company will provide separate notice or obtain additional consent where required under applicable laws.

22. Business Information

Company Name: XFC Inc.
Representative: Joo-Hyung Lee
Business Registration Number: 105-87-25573
Mail-Order Business Registration Number: 2018-Seoul Jung-gu-1484
Address: Room 1049, Donghwa Parking Building, 60 Sejong-daero 9-gil, Jung-gu, Seoul, Republic of Korea
Email: xfcinfo@gmail.com
Telephone: +82-2-322-8396
Hosting Service Provider: Google Cloud
Service URL: hsklink.xfc.icu

Supplementary Provision

This Privacy Policy shall take effect on August 25, 2026.