Privacy Policy

Effective date: 2026-09-23

Pabal (Pabal.me, "the service") is a messenger that runs on a server managed by Levelupsoft Inc. ("the operator"). This policy says, plainly, what personal information the service keeps, why, where and for how long. It is a translation of the Korean policy; if the two differ, the Korean text applies.

At a glance

• Your chats, photos and files are stored on the operator's server. What travels between the app and the server is encrypted, but on the server it is stored in a form the operator can read. End-to-end encryption (secret chats), which only the devices themselves could unlock, is not offered at present.
• No ads are shown, you are not tracked for advertising or analytics, and personal information is never sold.
• You can correct or delete your information in the app, and delete your account as described on the Support page.

Operator

• Operator: Levelupsoft Inc.
• Representative: Hyojeong Jang
• Address: 101-1203, Jinweoldong, BrownStone Apt., 18, Seomun-daero 678beon-gil, Nam-gu, Gwangju, Republic of Korea
• Contact: halo@levelupsoft.com

What is processed

This is everything the service receives and keeps.

• Account — your phone number (to sign up and sign in) and name. If you set them: a username, profile photo, bio and birthday. If you chose to receive sign-in codes by email: that email address.
• Chats — messages you send and receive, media you send such as photos, files and voice messages, stories you post, the names, photos and members of groups, and read receipts.
• Contacts — when the app matches your address book it sends phone numbers and names; only those that belong to people who use Pabal are saved as your contacts. Numbers of people who have not signed up are not stored.
• Location — the coordinates in a message when you send your location yourself. The service does not otherwise collect your location.
• Devices and connections — the model, operating system, app version and language of each device you sign in on, the IP address and time you connect from, and the authorization key used to encrypt the connection between the app and the server. For a device whose app signed up for notifications (Android or iPhone): the device token that says where to send them, the key (made by the app) used to encrypt them so that only that device can read them, and the language and app version to write them for.
• Consent record — which version of the Terms of Service you accepted, and when.

Voice calls are encrypted between the two devices. The server only relays the signals that connect them and does not listen to or record calls; when the devices cannot reach each other directly, the operator's relay server passes on the encrypted call without being able to read it. Push notifications (new messages, incoming calls) travel through Google Firebase Cloud Messaging to the Android app and through the Apple Push Notification service to the iPhone app, encrypted between the server and the device (see "What other people and third parties receive" below).

Why it is used

• Signing up, signing in and confirming it is you (sending sign-in codes)
• Delivering the messages and files you send, and keeping your chats in step across your devices
• Finding the people in your contacts who use Pabal
• Reviewing reports, acting on breaches of the terms, stopping spam and abuse, and keeping the service secure
• Answering your questions, running the server and fixing faults

It is not used for anything else — not for advertising, marketing or profiling.

How it is stored and protected

• Everything is stored in a database (PostgreSQL) and on disks of a server the operator manages.
• Traffic between the app and the server is encrypted with MTProto 2.0, and the website is served over HTTPS only.
• Messages and files on the server are not encrypted. The operator looks at them only where needed to review reports, to comply with the law, and to run and secure the service.
• The admin page does not open at the public address and needs an administrator token, and the database is not reachable from the internet (in the standard installation).

What other people and third parties receive

• Other users — your name, username and profile photo are visible to people who find you or chat with you. Your phone number is visible only to people who saved you as a contact or already have your number. Messages you send to a group are visible to its members.
• Bots — a bot is run by whoever made it, not by Pabal. Messages you send to a bot, group messages the bot can see, and your name, username and language setting are passed to the bot's operator.
• Google (Firebase Cloud Messaging) — to tell an Android app that is closed or off screen about a new message or an incoming call, the server sends a notification to Google's Firebase Cloud Messaging (FCM), which delivers it to the device. What the notification says (the sender's name, a preview of the message, a group's name) is encrypted by the server with a key only that device has, so Google cannot read it. Google receives only the device token and what it needs to deliver the notification (when it was sent, its priority, how long to keep it), and its servers may be outside Korea.
• Apple (Apple Push Notification service) — to tell an iPhone app that is off screen about a new message or an incoming call, the server sends a notification to the Apple Push Notification service (APNs), which delivers it to the device. What the notification says (the sender's name, a preview of the message, a group's name, who is calling) is encrypted by the server with a key only that device has, so Apple cannot read it; the only notification text Apple sees is the app's name and a line with no content, such as "You have a new notification". Apple receives the device token and what it needs to deliver the notification (when it was sent, its priority, how long to keep it, its kind), and its servers may be outside Korea. If the operator has not turned this on, the iPhone app is not sent push notifications. The desktop apps are not sent push notifications.
• Services that deliver sign-in codes — if the operator has set codes to be sent by text message or email, the phone number or email address and the code are passed to that delivery service (an SMS provider or a mail server).
• Legal requests — information is disclosed to authorities only when they require it through the procedures the law provides, and only as far as necessary.

Apart from this, personal information is not given to third parties or sold.

Processing on the operator's behalf

Where the operator has another company do part of the work of running the service, these are the companies and the work they do.

• Google LLC — 로그인 인증 코드 이메일 발송 (Gmail; sign-in code e-mail) · Solapi Inc. — 인증 코드 문자 발송, 문자 발송을 켰을 때 (sign-in code SMS, when enabled) · Google LLC — 안드로이드 앱 알림 전달, 알림 내용은 기기마다 암호화되어 Google 은 볼 수 없음 (Firebase Cloud Messaging; Android push notifications, content encrypted per device so Google cannot read it) · Apple Inc. — 아이폰 앱 알림 전달, 알림 내용은 기기마다 암호화되어 Apple 은 볼 수 없음 (Apple Push Notification service; iPhone push notifications, content encrypted per device so Apple cannot read it) · Google LLC — 위치 메시지 속 지도 그림, 공유된 위치의 좌표만 보내 지도 그림을 받음, 누가 보냈는지는 보내지 않음 (Google Maps Static API; map pictures in location messages — only the shared point's coordinates are sent, not who shared it)

Transfers abroad

Where personal information is moved to another country, this is what is moved, to whom and to which country, when and how, why, and how long the recipient keeps it. If you do not want this, write to the privacy officer (halo@levelupsoft.com); features that need the transfer (for example sign-in codes sent by text message) may then not be available to you.

• Google LLC (미국 USA) — 이메일 주소와 인증 코드 / e-mail address and sign-in code; 코드를 요청할 때 인터넷으로 / over the internet when a code is requested; 코드 전달 목적 / to deliver the code; 보관 기간은 Google 정책에 따름 / kept per Google's policy · Google LLC (미국 USA) — 안드로이드 기기의 알림 토큰과 암호화된 알림 / the Android device's push token and the encrypted notification; 알림을 보낼 때 인터넷으로 / over the internet when a notification is sent; 알림 전달 목적 / to deliver notifications; 전달되면 지워지고, 전달되지 않으면 최대 1일 / deleted once delivered, at most 1 day if undelivered · Apple Inc. (미국 USA) — 아이폰의 알림 토큰과 암호화된 알림 / the iPhone's push token and the encrypted notification; 알림을 보낼 때 인터넷으로 / over the internet when a notification is sent; 알림 전달 목적 / to deliver notifications; 전달되면 지워지고, 전달되지 않으면 최대 1일 / deleted once delivered, at most 1 day if undelivered · Google LLC (미국 USA) — 공유된 위치의 좌표(위도·경도)와 지도 크기·언어 / the shared location's coordinates (latitude, longitude) with the map's size and language; 위치 메시지의 지도를 처음 보여 줄 때 인터넷으로 / over the internet when a location message's map is first shown; 지도 그림을 받기 위해 / to get the map picture; 보관 기간은 Google 정책에 따름 / kept per Google's policy

How long it is kept, and deletion

• Retention (as set by the operator): 계정을 삭제할 때까지 보관합니다 (Kept until the account is deleted).
• Server logs (IP addresses, device information and so on) are cleared automatically in the standard installation: the server's log files are deleted after 30 days, and the log the container keeps is limited to its latest 100 MB, the oldest lines being overwritten first.
• Database backups are kept for 14 days and then deleted in the standard installation.
• When you delete your account, the account and what it kept — your profile and phone number, profile photos, contacts, your chat list and your side of your messages, stories, login email and the bots you made — are deleted at once, and every device signed in to it is signed out. The copies in other people's chats and what you wrote in groups remain theirs, shown as sent by "Deleted Account".
• A device's notification token and key are deleted as soon as the device signs out, the account is deleted, or Google reports that the token no longer reaches an app (because it was uninstalled, for example).
• The account's ID (not its phone number or name) is kept so that it is never given to anyone else. Which version of the terms it accepted and when, reports with how they were handled (including a copy of what was reported), and — for an account the operator deleted on request — when and how that request was received and handled (without phone numbers, email addresses, names or usernames), are kept for disputes and legal obligations.
• For an account that was suspended for breaking the rules, the suspension record (the account's ID, its phone number, the reason, the date, and the date it was lifted if it was) stays after the account is deleted: it keeps the same number from signing up again while the suspension lasts, and serves disputes and legal obligations.
• Deletion removes the data from the database and the disks; what remains in backups goes when the backups' retention ends.

Your rights

• In the app you can edit your profile, delete messages (including for the other side) and delete contacts yourself.
• You can ask to see, correct, delete or stop the processing of your personal information by writing to halo@levelupsoft.com or to @PabalSupport in the app. We act once we have confirmed it is you, and within 10 days of receiving your request we tell you how it was handled (or that we could not confirm it is you). Account deletion requests follow the steps on the support page.
• A legal representative, or someone you have authorized, can ask the same way.

Children

• People under 14 may not sign up; an account found to belong to someone younger is deleted.
• A parent or guardian can contact Support about a child's account to see or delete it.

The website and cookies

The website (Pabal.me) uses no cookies. It keeps a single value in your browser's storage to remember whether you chose the light or the dark theme, and uses no visitor analytics or ad trackers.

Privacy officer

• Person responsible for personal information: DongSeop Kim (halo@levelupsoft.com)
• Support: halo@levelupsoft.com, or @PabalSupport in the app

Remedies

You can also ask these Korean public bodies for advice on, or report, a privacy violation.

• Personal Information Infringement Report Center — privacy.kisa.or.kr, 118 (in Korea)
• Personal Information Dispute Mediation Committee — www.kopico.go.kr, 1833-6972
• Supreme Prosecutors' Office — www.spo.go.kr, 1301 (in Korea)
• Korean National Police Agency — ecrm.police.go.kr, 182 (in Korea)

Changes to this policy

If this policy changes, the change is announced on this page 7 days before it takes effect, and for important changes the app asks for your consent again. This policy applies from 2026-09-23.