Privacy notice
How Idea Scorecard processes inputs, accounts, payments and market preferences. Updated September 6, 2026.
Planner and scorecard sharing
Saved planner drafts and seven-day checklist progress stay in this browser. Draft transfer uses tab session storage and does not send the draft to AI until you submit an analysis. Idea sharing is OFF by default. Turning it ON publishes only the introduction you approve. Cards store the score, evidence profile, market, date and rubric; reactions and optional questions are visible only to the author. Original inputs, detailed reports and search responses are excluded. The old full-report sharing API is retired. Legacy fragment links are user-edited and not server-authenticated. Your share or download button triggers transfer to the selected app or an image download; copies cannot be recalled.
Operator and scope
OPTIWORK operates Idea Scorecard. This notice covers its website and idea analysis features. For privacy questions and requests, contact contact@optiwork.co.kr.
Information processed
We process your submitted business ideas, questions and optional images; generated results and shared summaries; Google sign-in identifiers, email and session information; guest cookies used to connect pre-login reports; stored reports and credit transactions; and Polar order, subscription, payment and refund identifiers. Card numbers and security codes are not stored on Idea Scorecard's server. Infrastructure may process IP addresses, access times and device/browser information for security and operation.
Market recommendation and availability
The hosting platform's IP-derived country code suggests a target market and checks provider regional availability. It is not a legal determination of residence. We do not request GPS permission. You may change your target market, but that does not override service availability restrictions. Your explicit preference is stored in the browser and the selected target market and optional state/city are saved with your analysis. The original detected country is not separately stored in the report.
AI and search providers
Inputs and optional images are sent to Google Gemini to generate results. For detailed US/Korean reports, public-source research also uses Google Search grounding and may generate search queries derived from your idea and selected region. Search responses and suggestions are displayed only to the requester and are not stored in our report database or browser history. Google describes its own retention and processing in its terms. Do not submit personal identifiers, health information, payment information, customer lists, trade secrets, confidential drawings or other sensitive material. Provider data-use terms depend on their services and account settings; we do not promise that inputs are never used for model improvement or human review.
Infrastructure and authentication
Vercel provides hosting and delivery. Supabase provides Google sign-in integration, sessions and report/credit storage. Before sign-in, reports are associated with a guest identifier; signing in connects eligible reports from that browser to your account. These providers may process data in countries other than where you are located. Their policies describe their handling of data.
Payments and advertising
Polar processes payments and receives your email and an app-specific customer identifier. Polar and its payment processors handle payment-method details. Where advertising is enabled, Google AdSense and applicable consent-management features may process cookies, identifiers and ad interactions. The English interface currently contains no ad placements. Sponsored content, if added, must be labeled and does not affect scores.
Storage and sharing
Reports, results and credit records are stored for account access and service operation; logging out or clearing browser history does not delete server records. Some results and preferences are also stored on your device. New server-issued links expire and can be revoked; older English fragment links remain user-edited copies. Anyone with the link can view or forward them; a shared link or downloaded file cannot be remotely recalled. Do not include secrets in a shared summary.
Account tools and security
Account checklists and evidence notes are stored in Supabase. Evidence is self-reported, not independently verified. New server-issued links expire after 7 days and can be revoked in your account; copies and screenshots cannot be recalled. Selected questions can receive private feedback. Abuse prevention uses a daily keyed hash of IP addresses, not raw IP in the quota records. Coarse share-view, referral-click and checkout-request counters are recorded without member or report identifiers; they may include bots and retries and do not establish individual purchase attribution. The cleanup target for security/AI logs and expired sharing records is 90 days. Existing reports remain until requested for deletion. Encrypted backups may temporarily retain deleted data; deletion requests must be reapplied on restoration.
Export and deletion
Your account offers a private JSON export, permanent deletion of individual reports and an account-deletion request. Account deletion is reviewed, not immediate, and does not automatically cancel subscription renewal. Use billing management to cancel renewal first. Local browser copies must be cleared separately. Financial records may require separate retention.
Requests and retention
You can remove browser-local data in browser settings. For access, correction, account deletion or other privacy requests, email contact@optiwork.co.kr. After identity verification, we handle the request and delete information not required for a lawful retention purpose. Payment/dispute and operational records may need to be retained under applicable requirements. We do not claim that this notice alone establishes compliance with every jurisdiction.
Provider policies and updates
Review the provider policies linked below. We update this notice when data handling changes and will provide additional notice for material changes where required.