Consumer Health Data Privacy Policy

This policy is for consumers in Washington, Nevada, Connecticut and other US states with consumer health data laws. It adds to our Privacy Policy, which applies to everyone. Bosong is a mood diary, not a medical service.

Last updated: 2026-10-14 · Effective date: 2026-10-14 · Version: 1.1

The English text is the original of this document. If a translation differs from it, the English text is used to interpret the meaning only where the law of your country allows this; otherwise the version in your own language is the binding one. Your mandatory rights never depend on the language you read.

Summary

Topic	In short
Without Bosong Plus	Nothing. Your diary stays on your device and the app sends no consumer health data to us.
With Bosong Plus	Your end-to-end encrypted backup, which we cannot read, and the fact that your account uses Bosong Plus. See section 2.
Sale and sharing	We do not sell or share consumer health data with third parties or affiliates. See section 6.
Your rights	Confirm, access, delete, withdraw consent and appeal. Write to contact@xiu.kr or delete your backup in the app. See section 7.

1. Who we are

This policy is published by XIUSoft (시우소프트), Republic of Korea, business registration number 752-41-01398, 901-401, 33 Dongtanjungsimsangga 1-gil, Dongtan-gu, Hwaseong-si, Gyeonggi-do, 18455, Republic of Korea; contact@xiu.kr; +82 507-1432-9182. It covers the Bosong app and Bosong Plus. Words such as “consumer health data”, “collect”, “share” and “sell” have the meaning given in the consumer health data laws of Washington (My Health My Data Act), Nevada and Connecticut.

2. Consumer health data we collect

We collect consumer health data only if you turn on Bosong Plus, and only these categories:

Your encrypted backup, uploaded only after your separate consent: the ciphertext of your entries, tags, presets and custom feeling names. Entries can contain feelings and their strength, rest days, notes and gratitude lines. They are encrypted on your device before upload, and we cannot decrypt them.
The fact that your XIUSoft account uses Bosong Plus (your subscription status), which could suggest that you keep a mood diary.
Technical data about the backup that we can see: each item’s kind, random ID and size, the time our server stored it and a deletion marker.

We collect no other consumer health data. If you email us, we use what you write only to answer you and delete it 30 days after our answer; please do not include health information. The help card, the statistics and everything you do without Bosong Plus stay on your device and are never sent to us. We do not infer or derive health information about you.

Apple Health: if you turn on sending State of Mind to Health (off by default), your entries are written only to the Health app on your device. We do not receive this data and Bosong never reads from Health, so it is not consumer health data that we collect.

3. Why we collect and use it

Only to provide what you ask for: to store your backup, sync it between your devices, restore it on a new device, and know when your subscription ends so that we can delete the backup 90 days later. We do not use it for advertising, profiling or research, or to train large language models or other AI models.

4. Sources

You, through the Bosong app on your devices; and, for subscription status, the app store you bought from and our subscription provider RevenueCat.

5. Consent

The app uploads your backup only after your separate, explicit consent, which it asks for as its own step (an unticked box) before the first upload, apart from the Terms and the purchase. You can withdraw consent at any time by deleting your backup in the app (Settings > Bosong Plus > Delete Bosong data only) or by writing to contact@xiu.kr.

6. Who receives it

We do not sell or share consumer health data with third parties or affiliates. Only processors that act on our instructions receive it, as needed to provide the service: Oracle hosts our server in Osaka, Japan (encrypted backup and subscription records); RevenueCat, Inc. processes your subscription status (never your entries); and Google (Google Workspace) handles only the emails you send us. Encrypted copies of our server’s backups are also kept on our own backup device in the Republic of Korea. We have no affiliates that receive it. No third party collects information about your activity over time or across websites or apps through Bosong.

7. Your rights

Wherever you live in the United States, you can ask us to confirm whether we collect, share or sell your consumer health data and to give you access to it, including a list of the processors we disclosed it to; delete it (in the app, Settings > Bosong Plus > Delete Bosong data only, or by writing to us); and withdraw your consent. Copies in our encrypted disaster-recovery backups disappear within 30 days.

To make a request, write to contact@xiu.kr from your account email; we may need to confirm that the account is yours. We answer within 45 days, which we may extend once by another 45 days when reasonably necessary, telling you why. Requests are free, and we do not treat you differently for using your rights.

If we refuse a request, you may appeal by replying to our decision at contact@xiu.kr. We answer an appeal within 45 days and explain our reasons. If we deny your appeal, you may complain to the attorney general of your state, for example in Washington at www.atg.wa.gov/file-complaint or in Connecticut at portal.ct.gov/ag.

8. Security and retention

Your backup is end-to-end encrypted with AES-256-GCM on your device, and access to our server is restricted (Privacy Policy, section 11). We keep it while you subscribe and for 90 days after your subscription ends, then delete it (Privacy Policy, section 7).

9. Changes and contact

If what we collect changes, we will update this policy first and, where the law requires, ask for your consent before collecting a new category of consumer health data. Questions: contact@xiu.kr.