Cookie & Tracking Policy

Effective Date: September 15, 2026

Version: 1.0.8

This Cookie & Tracking Policy explains how Ludilogy Inc. ("Company," "we," "us," or "our"), a company headquartered in the Republic of Korea, uses cookies and similar tracking technologies.

1. What Are Cookies?

Cookies are small text files stored on your device when you visit a website or use an app. They help provide functionality and improve user experience.

2. Types of Tracking Technologies We Use

2.1 Essential Technologies

• Authentication tokens: To keep you signed in
• Session data: To remember your preferences during a session
• Security tokens: To protect against security threats

2.2 Analytics

• Firebase Analytics: Aggregated usage statistics
• Crash reporting (Crashlytics): To identify and fix bugs

2.3 Performance

• Caching: To load content faster
• Performance monitoring: To identify slow areas

3. Mobile App Tracking

As a mobile application, SayWave uses:

• Device identifiers: For analytics and push notifications
• Firebase Cloud Messaging tokens: For delivering push notifications
• Local storage (AsyncStorage): For app preferences and caching

4. Your Choices

4.1 Push Notifications

You can control push notifications through your device settings.

4.2 Analytics

You can limit analytics collection through your device privacy settings.

4.3 Account Deletion

Deleting your account removes your data from our systems.

5. Contact Us

For questions about this policy:

• Email: privacy@ludilogy.com

Web Cookies & Consent

Ludilogy Inc., 52 Geumto-ro, Sujeong-gu, Seongnam-si, Gyeonggi-do, Republic of Korea, Gyeonggi Startup Bridge Bldg E Unit 501B, uses optional basic statistics to understand and improve www.saywave.ai. After a visible notice and before creating an identifier or loading analytics, basic measurement may start without a button click. Visitors in the European Economic Area, the United Kingdom, Switzerland and Quebec, and visitors whose location cannot be verified, are asked for permission first under our policy. A missing choice is not stored as explicit consent. In Singapore, our limited service-improvement measurement relies on assessed legitimate interests, with the safeguards and rights described here.

Our own measurement creates a random browser ID and stores only that ID and the Korean-calendar activity date in a database operated for us by Supabase, Inc.; we do not add account data, IP, browser details, URLs, location or campaign values. We do not send this ID to Google. Records cover the latest 35 Korean-calendar days; the browser ID expires after 35 days without acknowledged activity. Ten visible seconds or a genuine interaction qualify as activity. Daily, weekly and monthly totals deduplicate browsers over 1, 7 and 30 days, not people. Known crawlers, previews and hidden pages are filtered, without guaranteeing every bot is excluded. Separate bio totals count daily page/events without visitor IDs, not unique users. The /download shortcut is counted the same way: only which store or page a visit was sent to and an optional channel tag in the link are stored per Korean-calendar day, without visitor IDs. Abuse controls briefly process IP in memory; hosting and network providers also process request information.

Google Analytics loads only when our processing agreement and privacy settings have been verified. Google LLC receives the public page address and title (which can include wave IDs and public bio or creator handles), predefined source/medium categories and basic usage events, plus its browser/cookie and network information, including IP needed for communication and approximate location. We do not send account IDs, our browser ID, arbitrary query strings or campaign names. Google advertising storage, advertising user data, personalization, Signals and sharing for other Google products are disabled. Google and our infrastructure providers may process information outside your country, including the United States. See Google's use of partner-site data and our full privacy notice for recipients, processing territories and safeguards.

Limited public-page session replay for an adult audience (18+). Microsoft Clarity is controlled separately from usage statistics. Outside the European Economic Area, the United Kingdom, Switzerland and Quebec, the reviewed public pages may begin recording after the visible notice without a permission-button click. In those regions, or when location cannot be verified, a separate replay permission is required. A previous replay refusal always wins. Public feeds, introductions, bio pages and posts confirmed as published and listed may be measured; search, profiles, private or unpublished shares and unknown surfaces are excluded even when replay is permitted. Game contents inside separate cross-origin frames are not recorded. We mask text and images and filter outgoing data before Microsoft receives it: contact/account information, search terms, arbitrary URL parameters/fragments, referrers, page titles, private links, unapproved DOM attributes, CSS content and diagnostic messages are removed or masked. Approved public page addresses can retain content identifiers or a public bio handle; these identify published content, not the visitor's account. Microsoft Corporation is an independent controller and processes permitted layout, click, scroll, random browser/session identifiers and network information, including IP/browser information involved in transmission, in the United States and other locations. Microsoft Ads sharing is disabled, and we do not connect replay to visitor accounts or GA identifiers. Microsoft Privacy Statement. Our pinned client limits its browser identifier cookie to 35 days and session cookie to one day; an allowed session may renew them. A tab identifier lasts within its tab. Explicit replay grants are valid for at most 270 days; replay refusals do not expire into permission. Clarity generally provides recordings for 30 days and heatmaps for up to nine months; its server/backup retention follows Microsoft's policies. Turning replay off stops capture and pending transmission and removes accessible replay cookies/tab identifiers; it does not automatically erase already received Microsoft data. Basic GA cookie lifetime remains 35 days and its server retention is separate.

Use Cookie settings in the footer to stop measurement or change/withdraw a choice without losing the service. GPC and Do Not Track stop analytics and replay. An explicit refusal continues until changed or browser storage is cleared; a 365-day limit or version change does not turn it into permission. Explicit analytics permission is valid for at most 365 days; replay permission for at most 270 days. Withdrawal removes our ID and requests deletion of its retained activity; failed deletion is shown and retried. We retain a one-way ID hash and withdrawal date for up to 35 Korean-calendar days only to block delayed writes; these are pseudonymous, not anonymous. Past Google/Microsoft data is not automatically erased. For access, correction, deletion, restriction or withdrawal requests and questions about our measurement basis, contact support@ludilogy.com; details are in the full privacy notice.

Last updated: September 15, 2026

Version: 1.0.8