Privacy Policy - DBerio Database Client

CodeSand Co., Ltd. (the "Company") values the personal information of users of DBerio (the "Service") and complies with applicable laws such as the Personal Information Protection Act of Korea. This Privacy Policy is written so that users can check what information the Company sends, when, where it goes, what it is used for, and when it is deleted.

Summary. This app has no accounts, and the Company does not operate a server that receives users' data. Connection profiles, passwords and workspace state are all stored only on the user's device, and the contents of databases travel only between the user's device and the servers the user specifies. The app has no sign-up, login, usage statistics, error reporting or advertising. The only information the Company receives is inquiries users send by email or through the inquiry form on the Company website.

Article 1 (Personal Information Collected)

General: Through the app, the Company does not collect names, contact details, location, payment method information, or unique identification information such as resident registration numbers. Because the Service has no accounts, it does not collect IDs, passwords or social account information, and it does not use tools that collect usage statistics, error reports or advertising identifiers. Names and contact details are received only when the user enters them to make an inquiry (Section B).

A. Information that stays on the device and is not collected by the Company

The Service needs the information below to work, and all of it is stored only on the user's device. There is no path for it to be sent to the Company, and the Company cannot access it.

Connection profiles — connection name, database type, host and port, user name, default database, SSH tunnel and TLS settings, paths of files the user chose (SSH keys, certificates, SQLite files), trusted SSH host key fingerprints, connection color, production-server flag, groups. Stored in a settings file in the app's data folder.
Passwords — database passwords, SSH passwords, key passphrases. Stored only in the operating system's password store (macOS Keychain, Windows Credential Manager) and never written to the settings file.
Workspace state — open connections, query tab titles and contents, screen layout, language setting. Stored in the app's internal storage.
Favorite queries (if you use this feature) — the name and text of queries you save under a name, and the connection profile and database name they were saved for. Stored in a file in the app's data folder.
File re-access permissions — in the Mac App Store version, macOS access permission data for reopening files the user chose on the next launch. Stored in the app's data folder.
Subscription status — whether the Pro subscription is valid. The app checks this on the device, with the App Store for the Mac App Store version and with the Microsoft Store for the Windows version. It contains no payment method information.

Contents of databases. The Service displays the structure and data of the databases the user connects to, and sends the queries the user runs to those servers. This communication takes place only between the user's device and the servers the user specifies, and is not passed to the Company or to any third party designated by the Company. Export and backup files are saved only in the locations the user chooses.

Communication with the outside. The Service connects over the network only to ① the database servers and SSH servers the user specifies (when opening a connection) and ② the Apple App Store (to show subscription product information, process purchases and restores, and check subscription status — Mac App Store version) and ③ the Microsoft Store (to show subscription product information, process purchases and check subscription status — Windows version). When the user clicks a link to the Terms, the Privacy Policy or subscription management, the default web browser opens that page.

B. Information collected by the Company

Inquiries and reply contact details Only when the user sends them

Items collected: ① Email inquiries — the sender address, subject and body of the email the user sends, and any files the user attaches ② Web inquiry form — inquiry type, subject and message, files the user attaches (up to 5 files, 10 MB each), name, reply email address, phone number (optional). When the form is submitted, the IP address, browser information (User-Agent), referring page address and display language are recorded with it, and if the user is logged in to the Company website, that member ID is recorded as well
When collected: ① when the user sends an inquiry to the email address in Article 11 ② when the user submits the inquiry form on the Company website (codesand.co.kr), reached from the "Contact" link on the Service website. The app never sends anything on its own
Sent to / stored at: ① Email inquiries are received by Mailgun (United States) and forwarded to the Company's mailbox system (server in Seoul, Republic of Korea), where they are kept ② Web inquiry form submissions are received directly by the Company website server (Seoul, Republic of Korea) and stored in its inquiry database; attached files are stored in the Company website's file storage (Amazon Web Services, Seoul region, Republic of Korea). For both routes, the receipt confirmation email and the Company's reply are sent via Mailgun (United States)
Purpose: replying to and handling inquiries, reproducing and fixing reported problems. The items recorded automatically when the form is submitted are used only to handle the inquiry and to check for abusive submissions

Connection details and database contents are not sent with an inquiry unless the user writes or attaches them. Please do not include passwords or sensitive data in inquiries. The inquiry form on the Company website is shared with the Company's other services, and that page also presents the Company website's privacy policy. Inquiries about the Service are handled as set out in this Privacy Policy.

Article 2 (Purposes of Use)

The Company uses the personal information it collects only for the following purposes, and if a purpose changes, it gives notice in advance and obtains any required consent.

Providing the Service — connecting to databases, saving connection profiles, running queries and showing results (processed only on the device)
Checking and applying the Paid Product subscription (checked on the device with each store: the Mac App Store or the Microsoft Store)
Responding to customer inquiries and handling disputes

Article 3 (Retention Period and Destruction)

A. Information stored on the device

Connection profiles, passwords, workspace state and favorite queries exist only on the user's device and are kept until the user deletes them. Because the Company does not hold them, there is no information or destruction procedure on the Company's side. How to delete them is set out in Article 7.

B. Items kept under applicable law

Records of consumer complaints or dispute handling (including the content, attached files and contact details of inquiries received by email or through the inquiry form on the Company website, and the items recorded when the form is submitted) — 3 years (Act on the Consumer Protection in Electronic Commerce, etc. of Korea)
Other information that applicable laws require to be kept — for the period set by those laws

The body of inquiry emails is not stored at Mailgun and is kept only in the Company's mailbox (server in Seoul, Republic of Korea). Processing records (sender and recipient addresses, subject, time, delivery result) may remain at Mailgun for up to 30 days under Mailgun's retention policy (Article 6).

Payment and refund records for the Paid Product are kept by each store (the Mac App Store or the Microsoft Store) in accordance with its own policies and applicable laws, and the Company does not hold them.

C. Method of destruction

Information whose retention period has expired or whose purpose has been achieved is permanently deleted in a way that cannot be recovered or reproduced from electronic files.

Article 4 (Provision to Third Parties)

The Company does not provide users' personal information to third parties, except in the following cases:

where the user has consented in advance;
where there is a provision in law, or where an investigative agency requests it in accordance with the procedures and methods set by law for investigative purposes.

Data exchanged with database servers the user specifies, and files the user exports and passes on, are the user's own choice and are not provision to third parties by the Company.

Inquiries submitted through the inquiry form on the Company website (codesand.co.kr) are received and handled directly by the same company, CodeSand Co., Ltd., and are not provided to any other business.

Article 5 (Entrustment of Processing)

The Company entrusts the processing of personal information to the following companies to provide the Service. If the trustee or the entrusted work changes, the Company will disclose it through this Privacy Policy.

Apple Inc.

Entrusted work: processing of App Store subscription payments
Processing location: United States

The seller of the Paid Product is the Apple App Store, which processes payments in accordance with Apple's terms and Privacy Policy. The Company does not collect or store payment method information.

Microsoft Corporation

Entrusted work: processing of Microsoft Store subscription payments
Processing location: United States and other countries where Microsoft operates facilities

Payments for the Windows version are processed by the Microsoft Store in accordance with Microsoft's terms and Privacy Statement. The Company does not collect or store payment method information.

Mailgun Technologies, Inc.

Entrusted work: receiving and forwarding inquiry emails, sending receipt confirmation and reply emails
Processing location: United States

Amazon Web Services, Inc.

Entrusted work: storage of files attached to the web inquiry form
Processing location: Republic of Korea (Seoul region)

The Constant Company, LLC (Vultr)

Entrusted work: operation of the Company web service server that runs the inquiry form and the inquiry mailbox
Processing location: Republic of Korea (Seoul region)

Inquiry emails are received by Mailgun (United States) and forwarded to the Company's mailbox system (server in Seoul, Republic of Korea); web inquiry form submissions are received directly by the Company server (Seoul, Republic of Korea). Receipt confirmation emails and the Company's replies are sent via Mailgun (United States). Details of transfers to companies whose processing location is outside Korea are set out in Article 6. Each company's privacy policy: Mailgun · Amazon Web Services · Vultr

Article 6 (Overseas Transfer of Personal Information)

In providing the Service, the Company transfers personal information overseas as follows. This transfer is entrustment and storage of processing for the conclusion and performance of a contract with the data subject under Article 28-8(1)(3) of the Personal Information Protection Act of Korea, and disclosing the following through this Privacy Policy replaces the related notice.

Apple Inc.

Destination country: United States
Items transferred: transaction information for App Store subscription payments (based on the Apple account — the Company cannot access payment method information)
Time and method of transfer: sent over the network when the user purchases or restores a subscription or when the app checks the subscription status
Purpose: processing App Store payments
Retention period: until the end of the entrustment contract or the achievement of the purpose. Actual retention follows Apple's Privacy Policy

Microsoft Corporation

Destination country: the United States and other countries where Microsoft, its affiliates or its service providers operate facilities, including the user's region
Items transferred: transaction information for Microsoft Store subscription payments (based on the Microsoft account — the Company cannot access payment method information)
Time and method of transfer: sent over the network when the user purchases a subscription or when the app checks the subscription status
Purpose: processing Microsoft Store payments
Retention period: until the end of the entrustment contract or the achievement of the purpose. Actual retention follows Microsoft's Privacy Statement

Mailgun Technologies, Inc.

Recipient: Mailgun Technologies, Inc. (United States; privacy officer contact dpo@sinch.com)
Destination country: United States
Items transferred: email address and name, email subject and body, attached files (for email inquiries), and the inquiry content included in receipt confirmation and reply emails
Time and method of transfer: sent over the network when the user sends an inquiry email, when a receipt confirmation email is sent for a form submission, and when the Company replies
Purpose: receiving and forwarding inquiry emails, sending receipt confirmation and reply emails
Retention period: the body of emails is not stored at Mailgun and is kept only in the Company's mailbox (server in Seoul, Republic of Korea). Processing records (sender and recipient addresses, subject, time, delivery result) may remain at Mailgun for up to 30 days under Mailgun's retention policy (including replies sent)

If the user does not want personal information to be transferred overseas, the user may say so to the Privacy Officer in Article 11. In that case, purchase and use of the Paid Product through the store may be restricted, while the features within the free range can be used as they are without any overseas transfer. Because receipt confirmations and replies to inquiries are sent by email, refusing the transfer of inquiry emails (Mailgun) means the Company cannot reply to the inquiry.

Article 7 (Users' Rights and How to Exercise Them)

Users may at any time request access to, correction, deletion or suspension of processing of their personal information, and withdraw consent. These rights can be exercised as follows.

In the app — deleting a connection profile also deletes its password stored in the Keychain (macOS) or Credential Manager (Windows) and the favorite queries saved for that connection. Favorite queries can also be deleted one at a time. The app's data folder may remain after the app is deleted, and you can delete it yourself (Mac App Store version: ~/Library/Containers/com.codesand.dberio).
In the operating system — items remaining in the Keychain (macOS) or Credential Manager (Windows) can be removed directly with that tool.
By email or the inquiry form — send a request to the Privacy Officer in Article 11 by email, or through the inquiry form on the Company website, and the Company will handle it without delay and reply with the result.

Because the Service has no accounts, the Company does not hold a personal information file that identifies and stores individual users, and to that extent there is nothing to access or correct. However, if you have sent an inquiry by email or through the inquiry form, you may request access to or deletion of that inquiry and the items recorded with it.

The legal representative of a child under 14 may exercise the above rights on behalf of the child. If there is a legitimate reason to restrict a request, the Company will inform you of the reason.

Article 8 (Security Measures)

The Company implements the following measures:

A structure that does not collect — connection profiles, passwords and database contents are not sent to the Company's servers. The app has no communication path for sending this information to the Company.
Separate storage of passwords — passwords are not written to the settings file and are stored only in the operating system's password store (macOS Keychain, Windows Credential Manager).
No accounts or passwords — because the Service does not create accounts, the Company does not collect or store users' login information.
No handling of payment method information — payments are processed by each store (the Mac App Store or the Microsoft Store), and the Company's systems do not handle payment method information.

Article 9 (Installation, Operation and Refusal of Automatic Collection Devices)

The app does not install or operate cookies or any other devices that automatically collect personal information. Cookies and web usage statistics on the Company website (codesand.co.kr), reached from the "Contact" link on the Service website, are governed by that website's privacy policy.

Article 10 (Personal Information of Children under 14)

The Service is not directed at children under 14 and does not knowingly collect children's personal information. If the Company learns that personal information of a child under 14 has been collected, it destroys that information without delay.

Article 11 (Privacy Officer and Remedies)

The Company has designated a Privacy Officer, and users' inquiries, complaints, remedies for damage and access requests concerning the processing of personal information are handled by the department below.

Department: Privacy Team, CodeSand Co., Ltd.
Email: dberio@reply.codesand.co.kr
Web inquiry: the inquiry form on the Company website (the "Contact" link in the Service website menu and footer)

Users may apply to the following organizations (Republic of Korea) for dispute resolution or consultation to obtain remedies for infringement of personal information:

Personal Information Dispute Mediation Committee — +82-1833-6972 (kopico.go.kr)
Personal Information Infringement Report Center — 118 within Korea (privacy.kisa.or.kr)
Supreme Prosecutors' Office — 1301 within Korea (spo.go.kr)
Korean National Police Agency Cyber Investigation Bureau — 182 within Korea (ecrm.police.go.kr)

Article 12 (Changes to This Privacy Policy)

Effective date: October 26, 2026 (first effective October 8, 2026)

The contents of this Privacy Policy may be added to, deleted or amended due to changes in laws, policies or the Service, and any change will be posted on the Service website with the reason and the effective date. Before starting any new processing of personal information, the Company will give notice of the change and have a lawful basis for processing, such as consent where required by applicable law.

Disclaimer →