Privacy Policy

Effective date: not yet provided by the operator

Pabal (Pabal.me, "the service") is a messenger that runs on a server managed by (주)레벨업소프트 ("the operator"). This policy says, plainly, what personal information the service keeps, why, where and for how long. It is a translation of the Korean policy; if the two differ, the Korean text applies.

At a glance

• Your chats, photos and files are stored on the operator's server. What travels between the app and the server is encrypted, but on the server it is stored in a form the operator can read. End-to-end encryption (secret chats), which only the devices themselves could unlock, is not offered at present.
• Calls between people are unlocked only on the two devices, and the server does not listen. Calls to a bot with voice turned on are the exception: the audio is passed in real time to an AI provider. The operator does not store call audio.
• No ads are shown, you are not tracked for advertising or analytics, and personal information is never sold.
• You can correct or delete your information in the app, and delete your account as described on the Support page.

Operator

• Operator: (주)레벨업소프트
• Representative: 장효정
• Address: not yet provided by the operator
• Business registration number: 401-86-01720
• Contact: halo@levelupsoft.com

What is processed

This is everything the service receives and keeps.

• Account — your phone number (to sign up and sign in) and name. If you set them: a username, profile photo, bio and birthday. If you chose to receive sign-in codes by email: that email address.
• Chats — messages you send and receive, media you send such as photos, files and voice messages, stories you post, the names, photos and members of groups, and read receipts.
• Contacts — when the app matches your address book it sends phone numbers and names; only those that belong to people who use Pabal are saved as your contacts. Numbers of people who have not signed up are not stored.
• Location — the coordinates in a message when you send your location yourself. The service does not otherwise collect your location.
• Devices and connections — the model, operating system, app version and language of each device you sign in on, the IP address and time you connect from, and the authorization key used to encrypt the connection between the app and the server. For a device whose app signed up for notifications (Android or iPhone): the device token that says where to send them, the key (made by the app) used to encrypt them so that only that device can read them, and the language and app version to write them for.
• Consent record — which version of the Terms of Service you accepted, and when.
• Calls to voice bots — records of those calls (who called which bot, when and for how long, the usage, which AI and whose key was used, how the call ended) and, from the first time you call one (every time on iPhone), that you confirmed you are 19 or over, and whether you chose to keep the conversation in your chat. Call audio is not stored (see "Calls to voice bots" below).

Voice and video calls between people are encrypted between the two devices. The server only relays the signals that connect them and does not listen to or record calls; when the devices cannot reach each other directly, the operator's relay server passes on the encrypted call without being able to read it. Calls to a bot with voice turned on are different (see "Calls to voice bots" below). Push notifications (new messages, incoming calls) travel through Google Firebase Cloud Messaging to the Android app and through the Apple Push Notification service to the iPhone app, encrypted between the server and the device (see "What other people and third parties receive" below).

Calls to voice bots

If the person who made a bot ("the bot's developer") has turned voice on, you can call that bot, and an AI answers for it. These calls are not end-to-end encrypted. The connection between the app and the server is encrypted, but the other end of the call is not another person's device: it is the operator's voice gateway, which decodes the audio and passes it to an AI.

• Where the audio goes — during the call the gateway streams what the caller says to a realtime voice AI provider and plays back the bot's replies that the provider produces. The recipient is Google LLC (Gemini Live API on Vertex AI); the country and region where it is processed, what is sent, and the recipient's contact and retention are listed under "Processing on the operator's behalf" and "Transfers abroad" below.
• You are told first — the first time you call a bot (every time on iPhone), the app tells you that an AI will answer and where the audio goes, and the call screen shows it too. When the call connects, a notice that this is an AI bot plays first, and nothing said before it ends is sent anywhere. Calls to voice bots are for people aged 19 or over.
• Not stored — the operator does not record or store call audio; it is handled in memory only while the call lasts.
• Transcripts — off by default. If the bot's developer has turned them on, the notice at the start of the call says so, and the text of the conversation, written by the AI, is passed to the bot's developer. The operator does not keep it. Text the bot's developer does not collect is removed from the server's memory within 24 hours.
• Keeping the conversation in your chat — off by default. If the caller turns on "Keep this call's conversation as text in my chat" on the confirm sheet, then after the call the text of that call's conversation, written by the AI, is kept as messages in the caller's chat with the bot. Only the caller can see these messages, they can be deleted like any other message (and are deleted with the account), and they are not given to the bot's developer. Like other messages they are stored on the server and are not encrypted at rest (see "How it is stored and protected" below). Numbers that look like card numbers or resident registration numbers are kept masked. When you report your chat with the bot, these messages are not among the recent messages the report takes by itself; they go with a report only if you pick them. If it was on but the server could not keep the conversation, one line saying so is kept instead. This choice is separate from the bot developer's "Transcripts" (just above), and whether it was on is kept with the record of that call. The same rules apply to a call from a bot (see "Calls from bots" below) when you chose "Keep the call's conversation as text in my chat" on its permission sheet.
• What the bot's developer receives — the caller's account ID, name and language setting (not the phone number), and when the call happened, how long it lasted and how it ended. If the bot uses tools (such as looking up an order), it also receives the values the AI took from the conversation (such as an order number).
• Call records — who called which bot, when and for how long, the usage, which AI and whose key was used, and how the call ended are kept for 180 days, to apply limits, work out costs and deal with abuse.
• Reports — reporting a voice bot keeps a copy of your recent calls to it (times and lengths) and of the bot's settings at that moment with the report. Other people's calls are not included.
• When the bot's developer takes the audio — a bot's developer can have the audio sent through the gateway to their own server ("raw audio" mode) or to an AI provider account of their own ("their own key"). The bot's developer is then responsible for how it is processed, and on every such call the app tells you where the audio goes.

Servers a bot's owner connects (MCP)

A bot's owner can connect an outside server (an MCP server) to their bot, so that during a call the AI can look something up with that server's tools (for example a store's opening hours).

• What goes there — values the AI takes from what the caller says (for example a branch name) are sent to that server. The audio itself is not. Values such as card numbers, resident registration numbers or passwords are filtered out by the operator's server first and never sent.
• Who receives it — before the call, the app's confirm sheet shows that server's operator, country, purposes, the data it handles, how long it keeps it and who else it passes it to — marked "Published by the server's operator" or "Declared by the bot's developer · not verified". When any of that changes, you are asked again.
• Responsibility — the bot's owner (and that server's operator) are responsible for what that server and those it passes data to do with it. To refuse, do not call that bot.
• What the operator keeps — the registration (a hash of the address, the declared recipients, the tool list) until the bot's owner deletes it (30 days for a failed one). A caller's consent record keeps the hash of the recipients the sheet showed. The values sent to a tool and its results are not stored. The secrets used to connect are kept encrypted and apart, and never logged.

Calls from bots

A bot whose developer turned this on, and which the operator allowed, may call you only if you allowed that bot to. These calls are made by an AI voice, not a person. You allow each bot separately on the app's permission sheet, and only if you are 19 or older. Saying no costs you nothing in Pabal. You can turn a permission off at any time from the bot's menu ("Stop calls from this bot") or from "Bots allowed to call me" in Settings, and a bot you block cannot call you. The bot developer terms forbid making the permission a condition of a service or getting it by deceit.

• What the permission sheet shows — the bot's name and @username, its developer's display name, the purposes the bot declared (reminders, wake-up, deliveries, appointments), the quiet hours and the wake-up window, what follows here, and a link to this section. If the developer, the purposes or the bot's name change, or the sheet itself changes, you are asked again, and you are also asked again once a year. No call comes until you allow it again, and if you do not allow it again within 30 days of being asked, the permission turns off and a line in your chat with the bot says so.
• Not end-to-end encrypted — unlike calls between people, these calls are not end-to-end encrypted. The app's connection to the server is encrypted, but Pabal's voice server decrypts the audio and passes it to the AI.
• Where the audio goes, and transfer abroad — if you answer, then during the call your voice, the conversation and what the bot's developer added for this call go over an encrypted connection to the recipient, Google LLC (Iowa, USA, Google Cloud us-central1), and are processed there to produce the bot's replies. Google LLC does not keep them after processing, except that content its automated checks flag as possible abuse may be logged for up to 90 days. The audio of a call you do not answer goes nowhere. The recipient's contact is under "Transfers abroad" below. To refuse, do not allow the bot, or turn the permission off; you then do not get that bot's calls.
• What the bot's developer gets — your Pabal id, whether your permission is on (the answers to the bot's call requests show it — even in your quiet hours, when nothing rings), whether you answered, when the call started and how long it lasted, and who hung up. A missed call and a declined one look the same. Your phone number, time zone, quiet hours and which device rang are not sent. The text of what was said in the call (a transcript) is not sent to the bot's developer. The developer may use this only for the declared purposes, must not give it to anyone, and must delete it once the permission is off (bot developer terms).
• Time zone — your device's time zone name (for example Asia/Seoul) is used only to keep the quiet hours. One is kept per device, only while you have a permission for some bot, and deleted when you sign out on that device, when no permission is left, or when you delete your account. If no device has sent a new time zone for more than 90 days, it is not deleted, but no bot's call rings for you (it counts as quiet hours). A watch with Answer on Watch turned on in the Pabal Watch app keeps its time zone whether or not you have a permission; it is deleted when you remove the watch or turn Answer on Watch off. Location is not used.
• Quiet hours and rests — no calls at night (21:00–08:00 by default; you can make it longer). Only a wake-up call from a bot that declared wake-up may come inside the quiet hours, in the wake-up window you chose (2 hours at most). If you don't answer or decline, the bot cannot call again for 24 hours. The number of calls a day and the time between calls are limited too. Calling a bot yourself, and the app's "Calls" privacy setting, are separate from this permission.
• No recording — the audio is not recorded. What the bot's developer added for the call and the text of what the bot said are kept for 30 days to look into reports, then deleted. Keeping the conversation in your own chat, if you choose it, is just below under "Keeping the conversation".
• Keeping the conversation — only if you chose "Keep the call's conversation as text in my chat" on the permission sheet: after a call from the bot ends, what both sides said, written by the AI, is kept as messages in your chat with the bot. Only you can see them, and no copy goes to the bot's developer. Numbers that look like card numbers or resident registration numbers are kept masked, and these messages are not among the recent messages a report on your chat with the bot takes by itself (they go with a report only if you pick them). They stay until you delete them or your account. If the server or the voice server could not keep a call's conversation, one line saying "This call's conversation could not be kept" is kept instead. The rules are those of "Keeping the conversation in your chat" for calls to bots.
• Reported calls — if you report the bot, a copy of its call requests to you from the last 30 days (purpose and time), what its developer added and what the bot said is kept with the report (as for any report, under "How long it is kept, and deletion" below). A report has a length limit (32,768 characters): past it, what the bot said and then what its developer added are cut, each from the oldest calls first, and the call requests (purpose and time) themselves only last. Other people's calls are not included. Reporting a bot you have allowed turns the permission off. When you report a call from a bot you can give "Unwanted call" as the reason.
• The record of your permission — each time you allow a bot we keep when it was turned on and off, which sheet you saw and where the audio goes. Instead of your account number we keep an HMAC made with an evidence key only the operator holds. That key is kept apart from every other key and used only in a dispute, to check "did this person allow this call". This record is kept for 180 days after the month the permission ends, and a bot's call requests for 30 days. Your age confirmation is kept until you delete your account. If you choose "I am under 19", no bot can call you for a year and every permission you gave is deleted.
• The "allowed" notice — when you allow a bot, a line in your chat with it, on all your devices, says which device allowed it, when, and the quiet hours. If someone else allowed it on one of your devices, that line lets you notice and turn it off.
• Devices — the computer app rings only while it is open. Do Not Disturb and Sleep may keep a device from ringing. If you turn on Answer on Watch in the Pabal Watch app, your Apple Watch rings too, and with your iPhone nearby you may see the ring twice. The ring shows "(AI)" after the bot's name, so it is not taken for a person's call. A call from a bot you allowed can be answered on any device signed in to your account, and whoever answers, the bot says the call's purpose and what its developer added. If you share a computer with others, sign out on it.
• Watch push — turning on Answer on Watch keeps the watch's VoIP push token, a 32-byte push key, its app build and its time zone on the server. The watch's ring goes through Apple's VoIP push, and its content is encrypted so that only that watch can read it: Apple can see only that a call push came to the Pabal watch app at that time, the device token and the size — it cannot see who called whom. A server whose operator has not turned on watch rings keeps no token or key. Removing the watch, or turning Answer on Watch off, deletes them.

Why it is used

• Signing up, signing in and confirming it is you (sending sign-in codes)
• Delivering the messages and files you send, and keeping your chats in step across your devices
• Finding the people in your contacts who use Pabal
• Answering calls to bots that have voice turned on with an AI, applying call limits and working out costs
• Reviewing reports, acting on breaches of the terms, stopping spam and abuse, and keeping the service secure
• Answering your questions, running the server and fixing faults

It is not used for anything else — not for advertising, marketing or profiling.

How it is stored and protected

• Everything is stored in a database (PostgreSQL) and on disks of a server the operator manages.
• Traffic between the app and the server is encrypted with MTProto 2.0, and the website is served over HTTPS only.
• Messages and files on the server are not encrypted. The operator looks at them only where needed to review reports, to comply with the law, and to run and secure the service.
• The admin page does not open at the public address and needs an administrator token, and the database is not reachable from the internet (in the standard installation).

What other people and third parties receive

• Other users — your name, username and profile photo are visible to people who find you or chat with you. Your phone number is visible only to people who saved you as a contact or already have your number. Messages you send to a group are visible to its members.
• Bots — a bot is run by the bot's developer, not by Pabal. Messages you send to a bot, group messages the bot can see, and your name, username and language setting are passed to the bot's developer. The audio of a call to a bot with voice turned on is, by default, handled not by the bot's developer but by the operator's voice gateway and an AI provider; for a bot whose developer uses raw audio mode or their own key, the bot's developer handles it (see "Calls to voice bots" above).
• Realtime voice AI provider — in a call to a bot with voice turned on, the gateway sends the caller's audio here to produce the bot's replies, as work the operator has it do. What is sent from the operator's account is not used by the provider to train its models. Who the provider is, which country it is in and how long it keeps data are listed under "Processing on the operator's behalf" and "Transfers abroad" below. For a bot whose developer uses their own key, the audio goes to that developer's account, and how it is handled follows the agreement between that developer and the provider.
• Google (Firebase Cloud Messaging) — to tell an Android app that is closed or off screen about a new message or an incoming call, the server sends a notification to Google's Firebase Cloud Messaging (FCM), which delivers it to the device. What the notification says (the sender's name, a preview of the message, a group's name) is encrypted by the server with a key only that device has, so Google cannot read it. Google receives only the device token and what it needs to deliver the notification (when it was sent, its priority, how long to keep it), and its servers may be outside Korea.
• Apple (Apple Push Notification service) — to tell an iPhone app that is off screen about a new message or an incoming call, the server sends a notification to the Apple Push Notification service (APNs), which delivers it to the device. What the notification says (the sender's name, a preview of the message, a group's name, who is calling) is encrypted by the server with a key only that device has, so Apple cannot read it; the only notification text Apple sees is the app's name and a line with no content, such as "You have a new notification". Apple receives the device token and what it needs to deliver the notification (when it was sent, its priority, how long to keep it, its kind), and its servers may be outside Korea. If the operator has not turned this on, the iPhone app is not sent push notifications. The desktop apps are not sent push notifications.
• Services that deliver sign-in codes — if the operator has set codes to be sent by text message or email, the phone number or email address and the code are passed to that delivery service (an SMS provider or a mail server).
• Legal requests — information is disclosed to authorities only when they require it through the procedures the law provides, and only as far as necessary.

Apart from this, personal information is not given to third parties or sold.

Processing on the operator's behalf

Where the operator has another company do part of the work of running the service, these are the companies and the work they do.

• not yet provided by the operator

Transfers abroad

Where personal information is moved to another country, this is what is moved, to whom and to which country, when and how, why, and how long the recipient keeps it. If you do not want this, write to the privacy officer (not yet provided by the operator); features that need the transfer (for example sign-in codes sent by text message, or calls to voice bots) may then not be available to you.

• not yet provided by the operator

How long it is kept, and deletion

• Retention (as set by the operator): not yet provided by the operator
• Server logs (IP addresses, device information and so on) are cleared automatically in the standard installation: the server's log files are deleted after 30 days, and the log the container keeps is limited to its latest 100 MB, the oldest lines being overwritten first.
• Database backups are kept for 14 days and then deleted in the standard installation.
• Records of calls to voice bots are deleted after 180 days; after that only monthly totals per bot remain, which do not show who called. Call audio is not stored, and transcripts are only passed to the bot's developer, not kept. A conversation the caller chose to keep in their chat stays there as the caller's messages until the caller deletes them or their account.
• When you delete your account, the account and what it kept — your profile and phone number, profile photos, contacts, your chat list and your side of your messages, stories, login email, records of your calls to voice bots, and the bots you made (with their voice settings and call records) — are deleted at once, and every device signed in to it is signed out. The copies in other people's chats and what you wrote in groups remain theirs, shown as sent by "Deleted Account".
• A device's notification token and key are deleted as soon as the device signs out, the account is deleted, or Google reports that the token no longer reaches an app (because it was uninstalled, for example).
• The account's ID (not its phone number or name) is kept so that it is never given to anyone else. Which version of the terms it accepted and when, reports with how they were handled (including a copy of what was reported and, for a report about a voice bot, the bot's voice settings at the time and the reporter's recent calls to it), and — for an account the operator deleted on request — when and how that request was received and handled (without phone numbers, email addresses, names or usernames), are kept for disputes and legal obligations.
• For an account that was suspended for breaking the rules, the suspension record (the account's ID, its phone number, the reason, the date, and the date it was lifted if it was) stays after the account is deleted: it keeps the same number from signing up again while the suspension lasts, and serves disputes and legal obligations.
• Deletion removes the data from the database and the disks; what remains in backups goes when the backups' retention ends.

Your rights

• In the app you can edit your profile, delete messages (including for the other side) and delete contacts yourself.
• You can ask to see, correct, delete or stop the processing of your personal information by writing to not yet provided by the operator or to @PabalSupport in the app. We act once we have confirmed it is you, and within 10 days of receiving your request we tell you how it was handled (or that we could not confirm it is you). Account deletion requests follow the steps on the support page.
• A legal representative, or someone you have authorized, can ask the same way.

Children

• People under 14 may not sign up; an account found to belong to someone younger is deleted.
• Calls to voice bots are for people aged 19 or over; the app asks you to confirm this the first time you call one (every time on iPhone).
• A parent or guardian can contact Support about a child's account to see or delete it.

The website and cookies

The website (Pabal.me) uses no cookies. It keeps a single value in your browser's storage to remember whether you chose the light or the dark theme, and uses no visitor analytics or ad trackers.

Privacy officer

• Person responsible for personal information: 김동섭 (not yet provided by the operator)
• Support: support@levelupsoft.com, or @PabalSupport in the app

Remedies

You can also ask these Korean public bodies for advice on, or report, a privacy violation.

• Personal Information Infringement Report Center — privacy.kisa.or.kr, 118 (in Korea)
• Personal Information Dispute Mediation Committee — www.kopico.go.kr, 1833-6972
• Supreme Prosecutors' Office — www.spo.go.kr, 1301 (in Korea)
• Korean National Police Agency — ecrm.police.go.kr, 182 (in Korea)

Changes to this policy

If this policy changes, the change is announced on this page 7 days before it takes effect, and for important changes the app asks for your consent again. This policy applies from not yet provided by the operator.