myTobi Terms of Service

These Terms govern the conditions, procedures, rights, obligations, liabilities, and other necessary matters between the Company and users regarding the myTobi service and all related services (hereinafter "the Service") operated by MADORO STUDIO (hereinafter "the Company").

① AI is actively utilized in the operation, production, and provision of the Service, and the majority of features are powered by generative artificial intelligence.

② myTobi is a Memory-First AI system that places Data Sovereignty at its core value and operates under principles of transparent execution.

③ AI responses may contain inaccurate or inappropriate content due to the nature of generative AI. The Company does not guarantee the accuracy, completeness, or suitability of AI responses.

Key terms used in these Terms are defined as follows:

• myTobi — The collective name for the Memory-First AI service provided by the Company. Includes desktop and mobile applications.

• User (Member) — A person who agrees to these Terms, completes registration, and uses the Service.

• Local Memory — The collective term for memory data stored on the user's device. Consists of DIARY (chronological event log) and MIRROR (personal knowledge base).

• Whisper — An end-to-end encrypted (E2EE) private conversation space within myTobi. Provides 1:1 or group conversations between users, with message content automatically deleted.

• ChatPy — A real-time multilingual chat platform operated by the Company. Separate Terms of Service apply.

• heyTobi — An AI automation service (Beta) that directly controls mobile devices through voice commands. Separate Terms of Service apply.

• Voice Service — A feature for conducting voice-based conversations with AI. Includes Speech-to-Text (STT) and Text-to-Speech (TTS).

• Execution Contract — A procedure where the AI specifies the scope of execution, data to be accessed, and expected results to request prior approval from the user before performing specific actions.

• Content — Includes text, voice, images, videos, etc. provided by the Company to users, as well as results generated by users through the Service.

• Paid Service — Features, subscription products, and credit top-up services provided for a fee within the Service.

① The Company shall post the contents of these Terms on the Service screen so that users can easily access them.

② The Company may amend these Terms within the scope that does not violate relevant laws including the Act on Consumer Protection in Electronic Commerce, the Act on Regulation of Terms and Conditions, and the Act on Promotion of Information and Communications Network Utilization and Information Protection.

③ When amending the Terms, the Company shall specify the effective date and reasons for amendment and provide at least 7 days' prior notice. However, for changes unfavorable to users, at least 30 days' prior notice with individual notification shall be provided.

④ If a user does not expressly reject the amended Terms by the effective date, the user shall be deemed to have agreed to the amended Terms.

⑤ Matters not specified in these Terms shall be governed by relevant laws or commercial customs.

① The service agreement is established when the user agrees to these Terms, completes the registration process, and the Company approves the registration.

② Users must use their real name and accurate information. Members who provide false information cannot receive legal protection.

③ Children under the age of 14 must obtain consent from a legal guardian before applying to use the Service.

④ Members must promptly update their information when changes occur. The Company is not liable for disadvantages arising from failure to notify changes.

① The Company may refuse to approve applications in the following cases:

1. Application made under another person's name

2. Application made with false information

3. Re-registration within 1 year after membership revocation due to Terms violation

4. Application by a child under 14 without legal guardian consent

5. Other violations of relevant laws or Company policies

② The Company may defer approval when service capacity is insufficient or when technical or operational difficulties exist.

① Members may request withdrawal at any time, and the Company shall process the withdrawal immediately.

② The Company may restrict, suspend, or terminate membership in the following cases:

1. Registration with false information

2. Failure to pay service fees by due date

3. Interfering with other users' service use or misappropriating information

4. Violating prohibitions under these Terms

5. Engaging in acts contrary to law or public morals

③ When imposing usage restrictions, the Company shall provide prior notice of the reasons, type, duration, and appeal procedures. However, urgent cases may be notified after the fact.

④ Upon membership revocation, registration shall be cancelled with a minimum 30-day opportunity to respond provided before cancellation.

⑤ Upon withdrawal, Local Memory data stored on the user's device remains the user's property; the Company does not delete it. Account information and related data stored on servers shall be permanently deleted within 30 days of withdrawal.

① The Company shall not engage in acts prohibited by relevant laws and these Terms, and shall make its best efforts to provide continuous and stable service.

② The Company shall maintain security systems for personal information protection and shall publish and comply with its Privacy Policy.

③ The Company shall promptly handle legitimate opinions or complaints from users, and shall notify users of the reasons and processing schedule when immediate handling is not feasible.

Users must comply with these Terms, relevant laws, and Company notices, and shall not engage in the following activities:

1. Providing false information when applying for or modifying the Service

2. Misappropriating another person's information or payment methods

3. Altering information posted by the Company or causing service disruption

4. Unauthorized collection, storage, or distribution of other users' personal information

5. Duplicating, disassembling, or modifying the Service through reverse engineering or decompilation

6. Using abnormal methods such as hacking or automated programs to overload Company servers

7. Lending or transferring accounts to third parties

8. Inputting, posting, or distributing obscene, vulgar, violent, or discriminatory content

9. Infringing on others' intellectual property rights, portrait rights, or reputation

10. Using the Service for commercial, advertising, or political purposes without Company consent

11. Exploiting AI technical vulnerabilities to bypass safety measures or deliberately generating biased or illegal results

12. Other acts that violate laws or public morals

Users are responsible for managing their ID, password, and payment information. The Company is not liable for issues arising from negligent management.

The main services provided by the Company are as follows:

1. AI Chat & Memory Management — Conversation response generation using external AI APIs (Google, OpenAI, etc.), personal memory structuring and accumulation through DIARY and MIRROR. Includes memo, calendar, and personal information management features.

2. Voice Service — Voice-based conversations with AI through Speech-to-Text (STT) and Text-to-Speech (TTS). User voice is transmitted to servers for AI response generation and is not retained after processing.

3. Whisper — End-to-end encrypted (E2EE) private conversation space between users. Detailed in Chapter 5 of these Terms.

4. ChatPy — Real-time multilingual chat platform. Separate ChatPy Terms of Service apply.

5. heyTobi (Beta) — Mobile device voice command and automation service. Separate heyTobi Terms of Service apply, and additional consent is required upon first activation.

6. Additional Services — The Company may develop and provide additional services, and separate terms may apply to each.

The Company delivers external AI API responses transparently in principle, but may process or restrict responses as necessary for legal compliance, safety policy enforcement, and malicious/illegal content filtering.

Users are guaranteed the following data sovereignty rights:

• Right to Access — View DIARY and MIRROR data at any time.

• Right to Modify — Modify personal memory data.

• Right to Delete — Permanently delete all or individual memory data.

• Right to Export — Export memory data in standard formats.

• Right to Transfer — Transfer data upon service termination or withdrawal.

Requests exercising these rights shall be processed within a reasonable period (typically 30 days) from receipt. The scope and procedures for complete deletion of data remaining in backup systems and caches shall follow separate operational policies.

① When using the Voice Service, the user's voice is collected via microphone and transmitted to the server.

② Transmitted voice data is immediately deleted after Speech-to-Text (STT) processing and is not permanently stored on the server.

③ AI response audio generated through Text-to-Speech (TTS) is played only on the user's device and is not stored on the server.

④ Voice Service usage is subject to monthly limits based on the user's subscription tier.

⑤ Speech recognition accuracy may vary depending on ambient noise, pronunciation, network conditions, etc. The Company does not guarantee perfect accuracy of speech recognition.

① Actions such as accessing user data or calling external services by AI must receive the user's prior confirmation.

② When an execution request is made, the scope, target data, and expected results are displayed to the user.

③ Users may approve or reject the execution. If rejected, the execution is not performed.

① Users shall use the Service in a reasonable and responsible manner.

② The Company prohibits malicious use such as abnormal API expansion, bot creation, and account sharing, and may block accounts or restrict usage without prior notice when abnormal use is detected.

③ Refunds may be restricted in accordance with relevant laws, Terms, and individual service policies.

① The Service utilizes external AI APIs (Google, OpenAI, etc.) for AI response generation.

② The Company does not guarantee the accuracy or appropriateness of external AI API responses. AI-generated content should be used for reference only and does not replace professional judgment in medical, legal, financial, or other specialized fields.

③ The Company shall make its best efforts but does not bear direct liability for service interruptions caused by external AI provider service failures or policy changes.

④ User input data may be transmitted to external AI APIs for response generation, and such data processing is subject to each AI provider's data processing policies. The Company takes reasonable technical measures to prevent unnecessary transmission of sensitive personal information to AI APIs.

① The Company may suspend service provision in the following cases:

1. Maintenance, replacement, regular inspection, or construction of facilities

2. Power outage making service provision impossible

3. Facility failures or traffic overload making normal provision difficult

4. War, civil unrest, natural disasters, or equivalent national emergencies

5. External partner issues such as AI model provider server problems

② If the service is interrupted due to the Company's intentional or gross negligence and direct damage occurs to the user, the Company shall compensate within the scope prescribed by relevant laws. However, this does not apply to cases under paragraph 1, cases without Company fault, or indirect, special, or consequential damages.

③ If terminating the service for significant business reasons, the Company shall provide at least 30 days' prior notice and provide means for users to download their data for a minimum of 30 days from the termination date.

① Whisper is a private conversation space based on End-to-End Encryption (E2EE) for private conversations between users.

② Whisper supports 1:1 conversations and small group conversations.

③ In Whisper conversations, AI (TOBI) serves as a background observer, not a conversation participant, and does not intervene unless explicitly called by the user.

④ Whisper is not a messenger service; it is a relationship-based conversation space designed for memory generation.

① End-to-End Encryption (E2EE)

All Whisper messages are transmitted with end-to-end encryption. The server only relays messages and cannot read, store, or analyze message content.

② Automatic Message Deletion

Whisper messages and attached files are automatically deleted after the configured retention period (TTL). Deleted messages cannot be recovered. The server does not permanently store messages.

③ AI Summary and Memory Storage (Important)

At the end of a conversation session, each user's AI (TOBI) independently analyzes the conversation to extract summaries, insights, and emotional patterns. The resulting memory data is stored locally only on the respective user's device; the original conversation text is not stored.

Even from the same conversation, each participant's AI may independently generate different summaries.

Users can disable the auto-summary feature in Settings and can view, modify, or delete stored summary data at any time.

④ Translation Service

When using the multilingual auto-translation feature, message content is transmitted to the server for translation processing. In this case, end-to-end encryption is temporarily decrypted during the translation process. Translated content is not permanently stored on the server.

⑤ File Transfer

Photos, files, and other content transferred through Whisper are subject to the same TTL policy as messages and are automatically deleted after the retention period.

① Users bear full legal responsibility for all messages and files transmitted through Whisper.

② Users shall not use Whisper for illegal purposes (fraud, threats, illegal content distribution, etc.).

③ Due to the nature of end-to-end encryption, the Company cannot monitor conversation content and is not liable for disputes between users arising from conversation content.

④ Even with court warrants or lawful requests, the Company is technically unable to provide end-to-end encrypted message content. However, message metadata (sender, recipient, timestamp, etc.) may be provided upon lawful request.

① The Service provides a basic free tier and operates paid subscription services for additional features and extended AI usage.

② By clicking "Purchase," "Pay," or similar buttons, a paid service agreement is established and payment is processed.

③ Payment methods include credit cards, debit cards, easy payment services, and other methods designated by the Company. No additional fees beyond the paid service fee shall be charged.

④ Paid transactions are securely processed through official payment gateway (PG) providers. The Company does not directly store users' financial information.

⑤ For subscription services, automatic payment is processed monthly via the registered payment method, and the usage period is automatically renewed.

⑥ Minors under 19 must obtain legal guardian consent for paid service agreements. Agreements made without consent may be cancelled by the minor or their legal guardian.

① Users may withdraw within 7 days from the later of the purchase date or service availability date in accordance with the Act on Consumer Protection in Electronic Commerce. Withdrawal may be restricted as stipulated by law.

② Withdrawal is restricted in the following cases:

1. When the value has significantly diminished through use or partial consumption

2. When delivery of digital content has commenced

3. When resale has become difficult due to passage of time

4. When the service has been lost or damaged due to user fault

③ Subscription Service Withdrawal

Full refund is available within 7 days of payment if the service has not been used at all.

After service use has commenced, refunds are available minus the value of services already provided, with specific refund methods determined by Company operational policies.

Subscriptions automatically renew unless the user requests cancellation. Cancellation must be requested before the next billing date.

After cancellation request, automatic payment stops from the next billing date.

④ Misleading Advertising

If the paid service content differs from advertisements or contract terms, users may withdraw within 30 days of discovery and 3 months of availability.

⑤ Refund Process

Refunds are processed via the original payment method.

Processing time may vary depending on payment gateway (PG) policies.

The Company may request additional documentation for fraud prevention purposes.

① The Company shall refund overpayments to users.

② Refund costs arising from user fault may be borne by the user within reasonable limits.

③ The Company may request necessary information from users for overpayment refunds.

① Intellectual property rights to the Service's software, design, and technology belong to the Company.

② Rights to content and memory data generated by users through the Service belong to the users.

③ The Company does not guarantee that AI-generated results do not infringe on others' copyrights or intellectual property rights. Responsibility for using AI-generated content lies with the user.

④ Users warrant that texts, images, and other materials input during service use do not infringe third-party rights. Users shall indemnify the Company and resolve any disputes arising from violations.

⑤ The Company may use content posted by users and AI-generated results for service operation and improvement purposes. However, use for promotional or marketing purposes requires separate user consent (opt-in) and must be anonymized/de-identified.

⑥ This Service incorporates some open-source software. Copyright and license information for such open-source components is available within the Service.

① The Company or user shall compensate for damages caused to the other party by violating these Terms. However, this does not apply where there is no intent or negligence.

② The Company is not liable for damages to users arising from the following causes (except in cases of intentional or gross negligence):

1. Service unavailability due to maintenance, replacement, regular inspection, or construction

2. Service disruption due to user intent or negligence

3. Use of services provided free of charge

4. Expected profits from the Service not being realized

5. Information leakage due to user failure to manage account passwords

6. External AI provider service failures or policy changes

7. Unauthorized or abnormal third-party access to servers

③ The Company does not guarantee the legality, originality, accuracy, reliability, or fitness for a particular purpose of AI outputs.

④ All responsibility for issues arising from the use of AI outputs lies with the user; the Company assumes no liability therefor.

⑤ If a user's violation of these Terms causes damage to the Company, the user shall compensate for all damages and indemnify the Company.

① "Tmail" refers to the email service provided by the Company under the `@mytobi.ai` domain, integrated as a native mail client within the myTobi application.

② Tmail handles emails through the following routes:

1. **Outbound** — Emails sent to general addresses (@gmail.com, etc.) via an external mail service (Resend API)

2. **Inbound (Forwarding)** — Emails forwarded to Tmail from external mail services (Gmail, Outlook, Naver, etc.) via auto-forwarding configured by the user

3. **Tmail-to-Tmail Direct** — When both sender and recipient are `@mytobi.ai` users, mail is delivered directly within the Company's infrastructure without passing through external mail servers

③ Details of Tmail not specified in these Terms shall follow the Tmail settings screen and in-app guidance within the myTobi application.

① Tmail operates on a **Local-First** architecture in accordance with myTobi's Data Sovereignty principle. The user's mail data is, in principle, stored on the user's own device.

② The Company's server (Supabase relay table `email_incoming`) functions only as a **transient relay for mail delivery**. As soon as the user's app receives and stores a mail locally, it is automatically deleted from the server (ACK flow).

③ However, if the user does not run the app for an extended period or is offline, undelivered emails are temporarily stored on the Company's server for the retention period selected by the user, then automatically deleted.

④ The user may select the **server retention period** from the following options in the Tmail settings screen, with the default being 15 days:

• 3 days / 7 days / 15 days (recommended) / 30 days

⑤ Undelivered emails that exceed the selected retention period are permanently deleted by the Company's system (pg_cron). **Deleted emails cannot be recovered by any means.**

⑥ The user is responsible for selecting a retention period with full awareness of its meaning and consequences. The Company shall not be liable for any loss of mail caused by expiration of the retention period.

⑦ Mail stored locally is protected by SQLCipher (AES-256) encryption and remains until the user explicitly performs a delete action.

① As part of myTobi's core "AI Assistant" value, Tmail provides automation features that allow TOBI (AI) to process the user's emails based on the user's explicit choice.

② The user may select one of the following four automation levels in the Tmail settings screen, with the default being **Off (disabled)**:

• **Level 0 (Off)** — TOBI does not access the user's emails at all.

• **Level 1 (Read only)** — TOBI reads mail bodies and uses them as context (e.g., "Tell me about the meeting email I received yesterday"). Mail content is not modified.

• **Level 2 (Read & Classify)** — In addition to Level 1, TOBI automatically classifies emails by category and assigns priorities.

• **Level 3 (Auto-reply)** — In addition to Level 2, TOBI drafts replies. **However, replies are never automatically sent without the user's explicit approval.**

③ The user may change or disable the automation level at any time, and the Company shall reflect the user's choice immediately.

④ During mail processing, TOBI may transmit mail content to external AI APIs (e.g., Google Gemini, OpenAI), with personally identifiable information masked to the maximum extent possible. The data processing methods of external AI providers are subject to their respective policies.

⑤ Reply drafts and classification results generated by TOBI may be inaccurate or inappropriate due to the nature of generative AI. **The user is responsible for reviewing the content before sending.** The Company does not guarantee the accuracy of any mail content drafted by TOBI.

⑥ Activating an automation level shall be deemed as explicit consent to the processing methods described in paragraphs ② and ④ above.

① When the user configures auto-forwarding from external mail services (Gmail, Outlook, Naver, etc.) to Tmail, **the original forwarded emails remain stored on the external provider's servers**, and the terms and privacy policies of those providers apply.

② The Company shall not be liable for any service outages, policy changes, or data loss of external mail providers.

③ When the user sends emails from Tmail to external email addresses (@gmail.com, etc.), the sent emails are stored by the Company's commissioned delivery service (Resend) and the recipient's mail server, in the same manner as ordinary email.

④ For Tmail-to-Tmail direct delivery, mail content is not exposed to external providers as it does not pass through external mail servers; however, it does pass through the Company's relay infrastructure (transient storage), and the retention policy in Article 26 applies equally.

① The user shall bear sole responsibility for all mail content sent through Tmail and shall not engage in the following activities:

1. Spam mass mailing, phishing, fraud, or distribution of malicious code

2. Defamation, insult, threats, discrimination, or hate speech against others

3. Content that infringes on third-party rights such as copyright, trademark, or trade secrets

4. Illegal information, obscenity, gambling, or content that violates relevant laws

5. Acts that paralyze or attempt to abuse the systems of the Company or third parties

② If damages occur to the Company or third parties due to the user's violation of this Article, the user shall be solely liable to compensate for such damages and shall indemnify the Company.

③ The Company may restrict or suspend Tmail sending functions without prior notice if a violation of this Article is suspected.

④ The Company does not routinely censor or monitor Tmail content but may cooperate when legal obligations arise or when there are lawful requests from authorized agencies.

① Tmail supports email attachments, which are stored encrypted in a cloud storage service (Supabase Storage) commissioned by the Company.

② Download links (Signed URLs) for attachments are valid for 365 days from issuance and automatically expire thereafter.

③ The maximum size per attachment and total attachment volume per send shall be determined by Company policy and may be subject to change.

④ The following attachments may be restricted or blocked from sending:

1. Files containing security threats such as malicious code, viruses, or trojans

2. Executable files (.exe, .bat, etc.) deemed dangerous by the Company

3. Files containing content prohibited under Article 29 of these Terms

① The Company may change or discontinue the Tmail service after prior notice for stability, security, or feature improvements.

② When a user loses myTobi membership or withdraws, that user's `@mytobi.ai` address is immediately deactivated, and the user is responsible for backing up or deleting locally stored mail on their own.

③ Upon withdrawal, transient relay data (`email_incoming`) on the Company's server is immediately deleted.

① The Company may notify users via email, in-app notifications, SMS, or other methods.

② For notifications to an unspecified audience, posting within the Service for 7 or more days may substitute for individual notification.

① These Terms shall be governed by and construed in accordance with the laws of the Republic of Korea.

② The Company and users shall make efforts for amicable resolution of disputes. When litigation is filed, the competent court under the Civil Procedure Act shall have jurisdiction.

These Terms shall take effect from March 25, 2026.

The Tmail-related provisions of these Terms (Chapter 9) shall take effect from April 6, 2026.