Where this policy applies
碼庫科技有限公司 (Marku), a company registered in Taiwan ("we", "us"), operates the following sites and apps and is responsible for the personal data you provide or generate in them:
- the Marku platform at marku.com.tw
- FireFrame at fire-frame.com, including To Be Continued
- Meowgood at meowgood.com, including the web versions of Meow Stars and Meowlendar
- the Meow Stars and Meowlendar apps for iPhone and Android
Where a site or app has its own privacy notice, that notice adds to this policy. When you follow a link from our pages to another site (for example, from a product recommendation card to Shopee), that site's own policy applies to how it handles your data.
The short version
- You can use most of the tools on FireFrame and Meowgood without signing in. We only need your data for your Marku account and membership plan.
- We never store your card number. Payments are made on the pages of NewebPay or PayPal.
- Analytics on our sites load only after you agree. We do not sell your personal data.
- You can delete your account at any time, or email us to access, correct or delete your data.
What we collect, why, and how long we keep it
When you use a Marku account
| Data | Where it comes from | What we use it for | How long we keep it |
|---|---|---|---|
| Your Google account ID, email address and name | Google provides them with your permission when you sign in with Google. Google also provides your profile picture URL and whether your email is verified; we do not store the picture URL | Creating and recognising your account, signing you in on our sites, sending billing notices and notices of changes to our terms, answering support requests | While your account exists; deleted when you delete your account |
| Sign-in sessions and when they expire | Created when you sign in | Keeping you signed in, and ending your session when you sign out | Deleted 7 days after the session expires or you sign out |
| Your interface language, and your time zone if you set one | Your language and settings on the Marku platform | Showing pages and sending email in your language, and showing times in your time zone | While your account exists; deleted when you delete your account |
| Subscriptions and payments: plan, status, amount and dates of each period, the payment provider's subscription and transaction IDs, invoice numbers | Created by us and the payment provider when you subscribe and at each charge | Taking payment, renewals, cancellations and refunds, issuing invoices, reconciling accounts | Kept as Taiwan's tax and accounting laws require (accounting records for at least 5 years); after you delete your account, linked only to a code that identifies no one |
| A hash of your payment method: the first six and last four digits of your card returned by NewebPay, or your PayPal payer ID, stored only after salted hashing | The payment provider | Telling whether two payments use the same payment method, to stop people rewarding themselves | Same as subscriptions and payments |
| Entitlements: which features you can use and until when, and records of anything an administrator grants or withdraws (with a reason code) | Created when you subscribe and when an administrator acts on your account | Working out which features you can use, and handling customer service | While your account exists; deleted when you delete your account |
| Your weekly allowance, each use, and the Bricks going in and out of your Brick Box | Created as you use the service | Calculating your allowance and Bricks, showing them in "My allowance" and your Brick Box, answering support requests | While your account exists; deleted when you delete your account |
| Unlock records: which chapter you got, when, how much allowance it used, and a hash of the device ID | Created when you unlock or read | Letting you read what you unlocked again without using allowance again, counting readers for each chapter, preventing abuse | While your account exists; deleted when you delete your account |
| Email delivery records: which notice we sent, when, and whether it was delivered or bounced. We do not store your address or the full text of the email; we look up your address when sending | Created when we send; reported by the email service | Confirming that notices arrive and handling bounces | Delivery records: 365 days. Permanently bouncing addresses, stored only as a hash: while your account exists. All deleted when you delete your account |
| Unfinished checkouts, and notifications and reconciliation records from payment providers | Created when you pay | Confirming payment results and reconciling accounts | Unfinished checkouts: 30 days; notifications and reconciliation records: 180 days |
When you email us
| Data | Where it comes from | What we use it for | How long we keep it |
|---|---|---|---|
| Your email address, your message and our replies | You write to our support address | Replying to you, handling refunds and disputes | Deleted once your request is resolved and no longer needed for any follow-up dispute |
When you browse our sites
| Data | Where it comes from | What we use it for | How long we keep it |
|---|---|---|---|
| Server logs: time, URL path, result and duration of each request, plus our own internal IDs. They do not include your email, name, IP address or cookies | Your browser's requests to our servers | Finding errors and keeping the service secure | Up to 90 days |
| Site usage statistics: pages viewed, time spent, clicks, device and browser, approximate region derived from your IP address | Google Analytics 4, loaded only after you allow "Analytics" in Cookie settings | Understanding how our sites are used and improving them | As set in Google Analytics, up to 14 months |
| Connection data: IP address, browser and device information | Our sites and files are delivered by Cloudflare; our pages also load fonts and a tag manager (Google Tag Manager) from Google, and the tag manager does not load analytics until you agree | Delivering pages and files to your device and blocking attacks | Under Cloudflare's and Google's policies |
When you use our apps
| Data | Where it comes from | What we use it for | How long we keep it |
|---|---|---|---|
| Advertising data: your Android advertising ID, approximate location, device information, crash and performance diagnostics, and your interactions with ads | Collected by Google AdMob when it shows ads in our apps. On iPhone we do not ask for tracking permission, so AdMob cannot access your iPhone's advertising identifier | Showing ads, limiting how often they appear, and measuring results | Under Google's policies |
In the European Economic Area, the UK and Switzerland, the apps ask for your consent to personalised ads when you first open them, and you can change your choice later under "Privacy options" in the app.
Data that stays on your device
- Preferences and settings: language, appearance, your cookie choices, recently used tools, and when on-page notices (such as the cookie banner) were shown or closed.
- What you enter in our tools, such as the date, time and place of birth used to cast a chart in Meow Stars, and the resulting chart.
This data is stored in your browser or in the app and is never uploaded to our servers. You can delete it in the tool, or clear it all at once by clearing your browser's site data or uninstalling the app.
Purposes under Taiwan law
Under Taiwan's Personal Data Protection Act, we process your data for contracts, customer management and services, accounting, information and database services, information security, e-commerce services, and statistics and research. The Chinese version of this policy lists the official purpose and data category codes. We collect, process and use this data electronically; our staff handle support requests and accounting.
Legal bases (EEA and UK)
If the GDPR or the UK GDPR applies to you, we rely on:
- performance of a contract for your account, plan and entitlements, payments, allowance, Bricks, unlocked content and the notices we must send you;
- legitimate interests for server logs, security, preventing abuse (the device ID and payment method hashes), and handling support requests and disputes;
- consent for site analytics and, in the apps, personalised ads; you can withdraw consent at any time;
- legal obligations and our legitimate interest in keeping proper accounts for payment and invoice records.
Who we share data with
We do not sell your personal data. We share it only with the following, and only as much as each needs to provide its service:
| Recipient | What it does | What it receives |
|---|---|---|
| Sign in with Google; fonts, tag management and (with your consent) analytics on our sites; AdMob ads in our apps | When you sign in with Google, Google knows you signed in to Marku; otherwise see the tables above | |
| NewebPay | Recurring credit card payments for plans in New Taiwan dollars; electronic invoices (NewebPay's ezPay invoice service) | Order number, amount and your email address; you enter your card number directly on NewebPay's page |
| PayPal | Subscriptions for plans in US dollars | Plan and amount; you sign in and pay at PayPal, and PayPal shares your PayPal account name, email address and payment records with the receiving account "Marku" under its own policy |
| Amazon Web Services (Amazon SES) | Sending our email notices | Your email address and the content of the email; the service reports deliveries, bounces and complaints |
| Microsoft Azure | Our servers and database | The data listed under "When you use a Marku account" |
| Cloudflare | Hosting and delivering our sites and files | Connection data; the files of paid content |
| Microsoft 365 | Our support mailbox | The emails you send us |
| Taiwan's Ministry of Finance e-invoice platform | Electronic invoices that Taiwan law requires us to upload | The invoice details |
| Authorities and courts | When the law requires it | The data the law requires |
| A company that takes over our business | In a merger, acquisition or transfer of business | The data involved |
Where your data is processed
Our servers and database are in Microsoft Azure's East Asia region (Hong Kong). The service providers listed above also process data outside Taiwan, for example in the United States. Data protection laws there may differ from those where you live; we only use providers that apply data protection safeguards, and we handle your data as this policy describes.
How we protect your data
- All traffic between our sites, apps and servers is encrypted (HTTPS), and the cookies that keep you signed in cannot be read by page scripts.
- Your card number never passes through us, and we keep only a salted hash of your payment method.
- Our server logs do not record your email, name, IP address or cookies.
- Only the staff and programs that need your data can access it.
No method of transmission or storage can be guaranteed to be completely secure.
Your rights
Under Taiwan's Personal Data Protection Act and the laws where you live (such as the GDPR in the EU and the UK GDPR), you can:
- ask whether we hold your data, see it, or get a copy;
- have your data completed or corrected;
- ask us to stop collecting, processing or using it;
- ask us to delete it;
- withdraw consent you have given, for example for analytics cookies;
- if the GDPR or the UK GDPR applies to you, object to processing based on legitimate interests, ask us to restrict processing, receive your data in a portable format, and complain to your local data protection authority.
Things you can do yourself:
- Delete your account in your account settings on the Marku platform.
- Change your cookie choices under "Cookie settings" at the bottom of our pages.
For now, we only send billing notices and notices of changes to our terms. You need to receive these, so you cannot unsubscribe from them. If we start sending other email (for example about new features and events), we will get your consent or let you unsubscribe at any time, as the law requires.
For anything else, email [email protected] from the email address of your account. Once we have confirmed it is you, we handle requests to see or copy your data within 15 days, and requests to complete, correct, stop processing or delete your data within 30 days. If we need more time, we tell you why first, and the extension will not be longer than the original period. If the law requires us to keep some data (such as accounting records), we explain why we cannot delete it.
You do not have to give us your data, but without the data from your Google account we cannot create a Marku account, without payment you cannot use a paid plan, and refusing analytics cookies does not affect your use of our sites.
Children
Our services are not designed for children under 13. If you are a parent or guardian and find that your child has given us personal data, please email us and we will delete it.
Cookies and similar technologies
| Type | Used for | Can you turn it off? |
|---|---|---|
| Necessary | Keeping you signed in (stored under our server's address and unreadable by page scripts; expires after 30 days without use or 90 days at most), temporary data during sign-in (10 minutes), protection against forged requests, a device ID (random, 1 year, used only to tell whether two actions come from the same device, never to identify you), an ad-free marker (only on paid plans, removed when the plan ends or you sign out), your cookie choices, language and appearance | No; without them our sites do not work properly |
| Analytics | Google Analytics 4 cookies | Off by default and loaded only after you agree; you can turn them off anytime in "Cookie settings" |
| Advertising | Sites: we do not use third-party ad networks and set no advertising cookies; product recommendation cards are affiliate links we place ourselves and take you to Shopee only when you click. Apps: see "When you use our apps" | — |
Each site's Cookie Policy lists the cookies and local storage it uses, with what each is for and how long it is kept.
Changes to this policy
We may change this policy at any time by posting it on our sites and updating the effective date. Where the law requires us to notify you in advance or to get your consent, we will do so.
Contact us
碼庫科技有限公司 (Marku), 臺南市中西區淺草里西門商場28號3樓. Email: [email protected]. Phone: +886 968 668 876.