Privacy Policy

1. Purposes and Categories of Personal Information Processed

MegaWave (the “Operator”) processes the personal information needed to identify members of WebDeck, store personal shortcuts and sync them across devices, secure the service, and handle inquiries. Information needed to provide the membership service is processed on the basis of entering into and performing a contract under Article 15(1)4 of the Personal Information Protection Act, and any processing that requires separate consent is carried out only after that consent is obtained.

Membership information is processed when you use Google or Apple sign-in or email sign-up and sign-in, and service data is collected when you enter it or confirm an import. Automatically generated information is processed as you access the service and make requests. The password for an email account is passed to Firebase Authentication to verify your identity when signing up, signing in, and deleting your account, and it isn't stored on the Operator's servers or database. If you use Apple sign-in, Apple provides your email address (an Apple private relay address if you choose to hide your email) and name, which are processed; if no name is provided, the part of the email address before the @ is displayed as your name. WebDeck doesn't collect your Google or Apple password or the contacts, mail, or Drive files in your Google account.

WebDeck doesn't store your full browsing history or your shortcut click history as a separate activity log. However, the URLs you register, requests to look up site icons, and the service's own access and error records are processed for the purposes above. The service may display advertising to support its operation. Currently no advertising provider's tracking tools are integrated, and any future processing of information for advertising will follow the notice in Section 8 and the procedures required by applicable law.

We don't ask for unique identifiers such as resident registration numbers or sensitive information such as health data or political views. Please take care not to enter passwords, authentication tokens, or other people's personal information in shortcut names, URLs, or inquiries.

2. Retention and Use Period

We don't automatically delete an account or personal list just because you haven't accessed it for a long time. Daily statistics of access, save, and error counts that can't identify individuals may be kept for analyzing how the service operates.

If information must be preserved under law, it is kept only for the items and period that law specifies, and is managed separately from information used to provide the service. WebDeck currently offers no payment features and doesn't collect payment or purchase history.

3. Procedures and Methods for Destroying Personal Information

Personal information that is no longer needed because the retention period has passed or the purpose of processing has been achieved is destroyed without delay. Electronic information is deleted so that it can't be recovered and used, and any paper materials are shredded or incinerated.

When you request “Delete account” in Settings, access to your service data is blocked immediately and we proceed to delete your WebDeck personal data and the linked Firebase authentication account. If deletion can't be completed because of a problem with an external authentication service or similar, it is managed as a retry job, and requests that fail automatic processing are reviewed and followed up by the Operator.

Information included in backups is removed when the retention period in Section 2 expires. Data from a deleted account isn't made available to the service again even when a backup is restored. Deleting your WebDeck account is not a procedure for deleting your Google or Apple account itself.

4. Provision of Personal Information to Third Parties

The Operator doesn't sell your personal information. Whenever personal information needs to be provided to a third party, including for advertising delivery or performance measurement, we confirm a lawful basis for processing, tell you the recipient, purpose, items, retention period, and your right to refuse, and obtain separate consent. Where information may be provided without consent, such as in response to a lawful request under the law, we confirm the requirements and provide only the minimum necessary.

Entrustment of processing for providing the service follows the next section. When you open a shortcut and visit an external website, the operator of that website processes your access information under its own policies.

If an advertising provider directly collects information through a tool in the service, we explain the provider, the items, method, and purpose of collection, the retention period, and how to refuse in Section 8. Agreeing to the terms or acknowledging this policy when you sign up is not treated as separate consent to providing personal information for advertising purposes.

5. Entrustment of Personal Information Processing

Through the entrustment agreements and the personal information processing terms of the services, the Operator sets requirements for prohibiting processing beyond the entrusted purpose, safety measures, management of sub-entrustment, and protection of data subjects' rights and responsibility, and checks how processors handle the information. If the entrusted work or the processor changes, we will disclose it through this policy.

6. Overseas Transfer of Personal Information

WebDeck entrusts the processing and storage of personal information overseas for the authentication, storage, and hosting work needed to perform its contract with members. This transfer is made by disclosing the matters below in this policy, in accordance with Article 28-8(1)3(a) of the Personal Information Protection Act.

Where it hasn't applied a service that fixes the processing location by country, Cloudflare uses its global network. You can check in the country list above which countries your access information may be processed in, and the placement region of the database doesn't mean that is where every request is processed.

If you don't want your information transferred overseas, you can decline to sign up, request account deletion in Settings, or ask webdeck@megawave.app to stop the transfer. If the transfers needed for authentication and storage are stopped, it becomes difficult to provide the membership service, so your use may be restricted or the service contract may end. For any transfer that requires additional consent under law, we will tell you separately and obtain consent.

7. External Site Icons and Links

To show site icons, WebDeck's server sends requests to the registered sites and to the icon providers those sites specify. When looking up a page, the query part of the URL is removed, and your cookies, authentication information, and WebDeck's page address aren't passed along in external requests. The external site may receive the host and path being looked up for the icon and the connection information of WebDeck's server.

If the original icon can't be fetched, the site's host name is passed to Google's favicon service to look up a substitute icon. This request doesn't include the path or query of the registered URL, or your name, email, account identifier, or authentication information.

For sites the WebDeck server can't look up, such as addresses on an internal network (private IPs or internal domains), or sites whose icon the server fails to fetch, your browser requests the site's default icon paths (such as /favicon.ico and /apple-touch-icon.png) directly. These requests don't go through WebDeck's server, so the site may receive your IP address, your browser information, and any cookies that site has set, but WebDeck's page address isn't passed along.

A lookup made to show an icon doesn't mean you visited that site. When you actually open an external link, you connect directly to that site, and for how your personal information is handled after that, please check that site's privacy policy.

8. Browser Storage, Advertising, and Behavioral Information

To keep you signed in, speed up return visits, allow offline viewing, and apply display settings, we use your browser's local storage, session storage, IndexedDB, and cache. The stored information includes your sign-in state, an account identification hint, your last personal list, your theme, display language, and selected group, and site icon information.

The personal list cache is no longer used for reading 30 days after it's saved. This doesn't mean the data stored in your browser is physically deleted automatically at that time. When you sign out or delete your account, the personal list cache and account hint in the current browser are cleaned up. Personal caches on other devices are cleaned up the next time that device connects and checks its authentication state, and icon and static screen caches may remain.

You can delete WebDeck's stored data or block storage from “Site data,” “Cookies and site permissions,” or the equivalent menu in your browser settings. If you block it, some features, such as staying signed in and offline viewing, may not work. On a shared device, please sign out after use and delete site data if necessary.

The Operator may show general advertising, contextual advertising, or personalized advertising based on your interests. Depending on how advertising is delivered, an advertising provider may use tools such as cookies, pixels, and tags to process your IP address, browser and device information, advertising identifier, ad impressions and clicks, and information about your use of the service. This describes processing methods that may be introduced, and no collection through such advertising tools is currently carried out.

Before introducing advertising tools, we will disclose in this policy and in any separate notice needed the actual party that collects and uses information, the items, method, purpose, retention period, whether information is provided to third parties, entrusted, or transferred overseas, and how to refuse or withdraw. Personalized advertising that processes personal information will be provided only after we have a lawful basis for processing and have obtained any separate consent the law requires. Even if your personal list or account information is used for advertising purposes, we will explain that purpose and scope separately and obtain the necessary consent.

If you don't consent to optional processing of advertising-related information that is based on consent, or you withdraw consent, you can still use the basic membership service. In that case, general advertising may be shown. When introduced, you can refuse personalized advertising through the ad settings provided or the settings of the advertising provider, and you can also use your browser's features to block third-party cookies and delete site data. Whether ads are shown and whether you consent to information processing for personalized advertising are separate matters.

9. Data Subject Rights and How to Exercise Them

You can request access to, correction or deletion of, and suspension of processing of your personal information, and withdraw consent. You can view, edit, and delete your personal list on the service screens, and export it as a JSON file or request account deletion in Settings. If account information such as your name or email needs to be corrected, please send a request through the contact point below.

Other requests are accepted at webdeck@megawave.app. You can also exercise these rights through a legal representative or an authorized agent, and the Operator may ask for the minimum materials needed to confirm that you or your agent are legitimate. The Operator acts within the period and following the procedures set by applicable law and, where there is a legal limitation, explains the reason and how to object.

If you stop or delete the processing of required information, it may be difficult to use the membership service that needs it. You must not exercise your rights in a way that infringes on the personal information or rights of others.

10. Safety Measures for Personal Information

The Operator applies technical safeguards such as encryption in transit over HTTPS, authentication token verification, checking access permissions to data per account, verifying request origins, limiting excessive requests, and applying security headers. Operational secrets are managed in the server environment and are not exposed to the browser.

Access to personal information is limited to what is needed for the work, and failures and unauthorized access are addressed through processors' security features and operational records. If an incident such as a leak of personal information occurs, we carry out the notification and reporting required by applicable law and take steps to minimize harm.

11. Contact for Privacy Protection and Complaints

Responsible for handling personal information, exercising rights, protection work, and complaints: MegaWave
Email: webdeck@megawave.app

12. Effective Date and Changes to This Privacy Policy

This policy applies from October 9, 2026. If its content changes, we will announce the changes and the effective date in the service or on this page. Changes that significantly affect your rights will be announced with sufficient advance notice, and where separate consent is required by law, we will explain the changes and obtain your consent.

If there is a previous policy, we will provide the history of changes from the effective date of the revision so that you can review it.

Change history: Version 1.3 (effective October 9, 2026) — clarified that the display settings saved to your account include the display language.