01
Scope and controller
This notice explains how Jihoon Lee, operating Vesper Optic from the Republic of Korea ("Vesper," "we," or "us"), handles personal information in the Vesper Optic iPhone app and official website. It applies wherever the service is officially offered, together with the regional provisions below.
- Controller / business operator
- Jihoon Lee
- Country of establishment
- Republic of Korea
- Privacy contact
- [email protected]
A verified postal address and telephone number will be displayed in the relevant App Store storefront before distribution in any jurisdiction that requires public trader or mail-order seller details.
02
Privacy summary
Vesper does not require an account, upload your photos or videos to our servers, run advertising, track you across apps, or use analytics or crash-reporting SDKs.
The app processes photos, videos, edits, optional location information, settings, and purchase entitlement information on the device. We receive personal information when you request a launch notice or intentionally contact us. Launch-notice records are stored with Cloudflare and are not used for newsletters or advertising.
03
Information we handle
| Category | Information | Purpose | Location and period |
|---|---|---|---|
| Photos and edits | Photos, videos, RAW or original files, capture date, camera and EXIF details, Look and edit values, notes, favourites | Capture, non-destructive editing, library display and export | App storage and the Photos library you authorise, until you delete the item or app data |
| Optional location | Capture coordinates, altitude, accuracy, time and place name derived from coordinates | Add an optional location tag and place name to a scene | On the device with the related scene or photo, until that item is deleted |
| App settings | Default Look, capture and save settings, location setting, favourite Looks, tips viewed and first-roll count | Remember choices and manage the first 36 still photos | On the device in SwiftData and UserDefaults until app data is removed |
| Purchase entitlement | Product identifier, active subscription or licence status and transaction verification result | Unlock paid capture and restore purchases | Checked on the device through StoreKit; we do not receive payment-card details |
| Website preference | Selected language | Remember the website display language | Browser localStorage until site data is cleared |
| Launch-notice signup | Email address, selected language, consent version and time, signup status and internal identifier | Send one Vesper Optic launch notice and document consent | Cloudflare D1 until 30 days after the launch notice is sent, or until an earlier withdrawal or deletion request is completed |
| Support enquiries | Sender email, message, attachments and mail metadata | Respond to requests, privacy rights, complaints and disputes | Google Workspace; ordinary enquiries for one year after closure and consumer disputes for three years, unless law requires longer |
We do not collect advertising identifiers, contact lists, health or biometric information, browsing histories from other apps, or data for profiling and automated decisions.
04
Device permissions
| Permission | When used | If declined |
|---|---|---|
| Camera | Take photos and videos | Capture is unavailable |
| Microphone | Record sound with video | Video with sound is unavailable |
| Photos | Save to or import from the Photos library | Only the selected save or import feature is unavailable |
| Location | Add coordinates and a place name when location recording is enabled | Capture continues without location metadata |
Location recording is off by default. We request optional permissions only when the related feature is used, and permissions can be changed in iOS Settings.
05
Purposes and legal bases
Where a law requires a legal basis, we rely on: performance of the service you request for on-device capture, editing and purchase access; your consent for optional location, Photos access and non-essential communications; our legitimate interests in answering enquiries, securing the service and preventing fraud where those interests do not override your rights; and compliance with legal obligations for transaction, complaint and rights records.
You may withdraw consent through iOS Settings or by contacting us. Withdrawal does not affect processing already lawfully performed. Optional processing is not used as a condition for unrelated app features.
06
Apple platform services
The app uses Apple App Store and StoreKit for payment and entitlement verification, Photos and iCloud Photos when enabled by you, and Core Location and CLGeocoder when optional location recording is enabled. Apple handles this information under your Apple account settings and Apple's Privacy Policy.
Apple is responsible for its own payment, account, refund and platform processing. We do not receive your Apple password or full payment-card details.
07
Service providers and international transfers
We do not sell personal information or disclose it for targeted advertising. We use processors only for website and launch-notice operation and requested support.
| Provider | Data and purpose | Locations | Transfer and retention |
|---|---|---|---|
| Google Asia Pacific Pte. Ltd. and Google Workspace subprocessors | Support email address, content, attachments and mail metadata for delivery, storage, spam filtering and security | Singapore, United States, European Union and other countries where Google or its subprocessors operate data centres | Transferred over encrypted networks when email is sent or received; retained for the enquiry periods stated above |
| Cloudflare, Inc. and Cloudflare subprocessors | Launch-notice record, connection and Turnstile verification information for website hosting, form processing, D1 storage, bot prevention and security | United States and other countries where Cloudflare operates its global infrastructure; the D1 database is created with an Asia-Pacific location hint | Transferred over encrypted networks when the website is used or the form is submitted. Signup records are retained until 30 days after the notice is sent or an earlier withdrawal or deletion request; service and security records follow Cloudflare account settings and contractual terms |
Depending on your location, safeguards may include a service contract requiring appropriate protection, approved standard contractual clauses and UK addendum, or an adequacy mechanism. You can avoid these transfers by not submitting the launch-notice form or sending support email; this does not affect use of the on-device app, but we cannot provide the corresponding notice or reply.
08
Website storage and network records
The website does not use analytics, advertising trackers or third-party fonts. It uses browser localStorage only for vesper.lang, which you can remove through browser site-data controls.
Submitting the launch-notice form sends the email address, selected language and consent record through Cloudflare Pages Functions to Cloudflare D1. Cloudflare Turnstile processes connection, browser and challenge information to deter automated signups. We do not store the visitor's IP address in the launch-notice database.
09
Retention and deletion
We keep personal information only for the stated purpose and period, then delete or de-identify it unless a law requires preservation. App scenes and settings are deleted through the app, iOS storage controls or app removal. Copies separately saved to Apple Photos must be managed in Photos.
Launch-notice records are deleted within 30 days after the notice is sent, or earlier after a verified withdrawal or deletion request. Support email is deleted after the applicable period. If a complaint, legal hold or security investigation is active, only the necessary record may be retained until it is resolved.
10
Your choices and privacy rights
Depending on your location, you may request access, correction, deletion, restriction, objection, portability, withdrawal of consent and information about disclosures. You may also complain to your local privacy authority.
- Manage device content and settings directly in the app and iOS Settings.
- Withdraw camera, microphone, Photos or location access in iOS Settings.
- Clear the saved website language through browser site-data controls.
- Ask us to withdraw or delete a launch-notice signup.
- Send a rights request to [email protected].
We may request proportionate information to verify identity and authority. We will respond within the period required by applicable law, explain any lawful limitation and provide an appeal or complaint route where required.
11
Regional privacy provisions
European Economic Area, United Kingdom and Switzerland
You have rights under the GDPR or equivalent local law, including access, rectification, erasure, restriction, portability and objection to processing based on legitimate interests. You may complain to the supervisory authority where you live or work. Vesper performs no behavioural monitoring, and personal information held directly by the operator is currently limited to occasional support enquiries. If applicable law requires an EU, EEA, UK or Swiss representative, representative details will be published before the affected storefront is enabled.
United States
Vesper does not sell personal information, share it for cross-context behavioural advertising, conduct targeted advertising, or use sensitive information to infer characteristics. Residents of states granting privacy rights may exercise them through the contact above. We do not discriminate for exercising a privacy right.
Canada and Québec
Jihoon Lee is the person accountable for privacy and handles access, correction, withdrawal and complaints. Processing outside Canada and Québec may make information accessible under foreign law. A French privacy notice and Québec transfer assessment must be completed before Vesper is specifically offered to Québec consumers.
Australia
You may request access and correction or complain to us first, then to the Office of the Australian Information Commissioner where the Australian Privacy Act applies. Before personal information is disclosed to an overseas recipient, the safeguards and accountability requirements of Australian Privacy Principle 8 will be applied where required.
New Zealand
Jihoon Lee acts as privacy contact and, where the New Zealand Privacy Act applies, privacy officer. You may request access and correction or complain to us first, then to the New Zealand Privacy Commissioner. Overseas processors are subject to contractual and due-diligence safeguards where those laws apply.
Japan
Residents may request disclosure, correction, suspension of use and deletion as provided by the Act on the Protection of Personal Information. Cross-border email processing is limited to requested support and the processor information shown above. A Japanese notice and required commercial disclosures must be available before the Japan storefront is activated.
Taiwan
Residents may request inquiry or review, copies, correction, cessation of collection, processing or use, and deletion under Taiwan's Personal Data Protection Act. Before targeted launch, a Traditional Chinese Article 8 notice must identify the operator, purposes, data categories, period, territory, recipients and methods of use, rights and exercise method, and the effect of not providing the data.
Hong Kong
Residents may exercise applicable access and correction rights under Hong Kong's Personal Data (Privacy) Ordinance. A Traditional Chinese version will be provided if Vesper specifically targets Chinese-language consumers in Hong Kong.
Singapore
Jihoon Lee is the designated data protection contact. Residents may request access and correction, withdraw consent and submit complaints. Overseas transfers will receive a standard of protection comparable to the Singapore PDPA where it applies.
Brazil, Mexico and India
Where Vesper is officially offered in these markets, residents receive all non-waivable rights under the LGPD, Mexican private-sector data law or India's DPDP framework. Portuguese or Spanish notices, a complete controller address, valid international-transfer measures, and India's phased child-consent requirements must be completed before the affected storefront is enabled.
Mainland China
Vesper is not currently offered in mainland China. Mainland distribution will remain disabled until required app filing, local-language notice, personal-information representative or contact arrangements, sensitive-information consent and cross-border-transfer requirements are completed.
12
Children and teenagers
The global launch-notice form is for people aged 18 or older. We do not knowingly collect an email through that form from a child. If we learn that we received a child's information without required authorisation, we will delete it.
The app is a general-audience camera without accounts or operator-managed photo collection. Parents and guardians can use Apple Family, Screen Time, device permissions and Ask to Buy to manage a child's access and purchases.
13
Security safeguards
We minimise collection, keep creative content on the device, leave location off by default, request permissions at the point of use, restrict access to support mail and use protected network connections. If a breach creates a legally reportable risk, we will notify affected people and authorities as required.
No system can be guaranteed completely secure. You should protect the device with a passcode, keep iOS current and maintain a separate copy of important originals.
14
Contact and complaints
- Controller and privacy lead
- Jihoon Lee
- [email protected]
- Country
- Republic of Korea
Please identify your country or region and the right you wish to exercise. We will investigate privacy complaints, explain the result and tell you about an applicable regulator or appeal route. This contact does not prevent you from approaching a regulator directly.
15
Changes to this notice
This notice takes effect on 12 August 2026. We will post a new effective date and explain material changes before they take effect where required. If a change needs consent, we will obtain it rather than treating continued use as consent.