Consent to Overseas Transfer of Personal Information

Effective date: 2026-07-31

WillSignal stores and processes personal information using cloud infrastructure outside Korea. Where required under the Personal Information Protection Act, we ask for your separate consent to this overseas transfer.

By selecting "Agree," you consent to the overseas transfer described below.

1. Details of the overseas transfer

WillSignal is the personal information controller and entrusts storage and processing to Amazon Web Services, Inc., which acts on WillSignal's behalf and under its instructions and does not use the information for its own purposes.

• Overseas recipient: WillSignal (operated by an individual developer), as service operator, and Amazon Web Services, Inc., as cloud infrastructure provider.
• Recipient contact: admin.willsignal+privacy@gmail.com (WillSignal); Amazon Web Services privacy contact as published by AWS.
• Country of transfer: United States.
• Region / location: Amazon Web Services us-east-1 (Northern Virginia).
• Time and method of transfer: at account creation and during service use, through encrypted network connections (HTTPS) and cloud storage/processing systems.
• Purpose of transfer: to provide WillSignal, including account operation, authentication, encrypted message storage, signal countdowns, inactivity-triggered delivery, recipient verification, security, logging, abuse prevention, support, and legal compliance.
• Retention and use period: as described in the Privacy Policy and the retention list below; not longer than necessary unless required or permitted by law.

2. Items transferred

The following categories of personal information may be transferred overseas:

• account identifiers, such as social-login provider ID, username and tag, internal account ID, and email address if collected;
• recipient and designation information, such as recipient email addresses, sender/recipient relationships, verification status, and reveal settings;
• friends and social connections, such as friend requests and their status, your friends list, the private nickname you set for another user, and the users you have blocked, including when a block started and ended;
• message content and message metadata, including encrypted message bodies, titles or labels, delivery status, timestamps, encryption mode, key version, and message identifiers;
• locked-message encryption data, such as public keys, client-encrypted private keys, encrypted message keys, key versions, key fingerprints, and recovery-related encrypted material, if applicable;
• signal and service settings, such as countdown settings, check-in timestamps, activity timestamps, language preferences, notification preferences, and skin or display preferences;
• technical, security, and consent evidence, such as IP address, user agent, device/browser information, timestamps, access logs, accepted document version and hash, and consent/withdrawal records;
• support communications and related information if you contact us;
• abuse reports, including the report you submit, what you are reporting and why, and, if you choose to include it, the content of the message you are reporting.

Locked message bodies are designed so that WillSignal cannot read them after lock. Metadata and non-locked messages are handled differently, as described in the Privacy Policy.

3. Retention and use period

Personal information transferred overseas is retained and used for the periods described in the Privacy Policy.

Unless a longer retention period is required or permitted by law, WillSignal applies the following retention periods:

• Account data: until account deletion, plus a 30-day recoverable deletion period.
• Message content and message metadata: until account deletion or message deletion, plus a 30-day recoverable deletion period.
• Recipient and designation data: until account deletion or removal of the relevant recipient/designation, plus a 30-day recoverable deletion period.
• Locked-message encrypted key material: until account deletion or deletion of the related locked message, plus a 30-day recoverable deletion period, unless earlier deletion makes recovery impossible.
• Signal and check-in records: until account deletion, plus a 30-day recoverable deletion period.
• Access logs and operational request logs: up to 30 days.
• Security and audit-event records: identifying details such as IP address, device/user-agent, and request identifiers are removed within 180 days; a limited audit reference (an internal account identifier, the event type, and a timestamp, without IP, device, or request details) may be retained longer where needed for security, abuse prevention, dispute handling, or legal compliance.
• Consent and acceptance evidence: 3 years after account deletion or withdrawal, unless longer retention is needed for dispute handling or legal compliance.
• Support records: until account deletion, plus a 30-day recoverable deletion period, unless longer retention is needed for dispute handling or legal compliance.
• Friends and social connections: until you remove the connection or delete your account, plus a 30-day recoverable deletion period. A block is kept after you unblock, for as long as your account exists, so that messages delivered while the block was active are not revealed again by unblocking.
• Abuse reports: a report is kept after the reporting or reported account is deleted, with the links to those accounts removed, for safety, abuse prevention, dispute handling, and legal compliance. Message content included in a report is deleted 30 days after the report is resolved, or when the reported account is permanently deleted, whichever comes first — unless it is subject to a legal or investigative hold.
• Invitations sent to an email address that has no WillSignal account: an invitation that is never accepted, and the email address in it, are deleted 90 days after the invitation is sent. If the invitation is accepted, the record is kept while that account exists and is deleted when the account is permanently deleted.
• Do-not-contact and email-suppression records (an email address and the reason it was suppressed): kept for as long as needed to honor the suppression, including after account deletion.
• Backups: deleted or overwritten on a rolling cycle of up to 7 days, unless backup retention is extended for security, disaster recovery, or legal reasons.

4. Your right to refuse

You may refuse this overseas transfer by not creating an account or not using WillSignal.

Because WillSignal's infrastructure is located outside Korea, we cannot provide the service without the overseas transfer described above.

After creating an account, you may withdraw consent by deleting your account or contacting admin.willsignal+privacy@gmail.com. If you withdraw consent to an overseas transfer necessary to provide the service, we may no longer be able to provide WillSignal to you.