Current version · in effect since November 3, 2026
Purple Studio Privacy Policy
3PM Inc. (registered in Korea as 주식회사 오후3시; the “Company”) provides the Windows desktop app Purple Studio (the “App”). In accordance with Article 30 of the Personal Information Protection Act of the Republic of Korea (the “PIPA”), the Company has established and discloses this Privacy Policy to protect your personal information and to handle related complaints promptly.
Effective date: November 3, 2026
This Privacy Policy is provided in Korean and English. If the two versions conflict, the English version prevails to the extent permitted by applicable law.
- What the Company receives
- Your email address, name, and profile picture address when you sign in with a Google account, and the status of your subscription and add-ons
- What the Company does not receive
- Your exchange, OpenAI, Anthropic, and Telegram API keys, strategies, trade records, and AI conversations — these are stored only on your PC
- Payment information
- Handled by Microsoft Store; the Company does not receive card numbers or other payment method information
Personal Information We Process and Why
The Company processes only the minimum personal information needed for the purposes below. If a purpose changes, the Company will take the measures required by Article 18 of the PIPA, such as obtaining your separate consent.
Account identification and sign-in
- Items
- Email address, name, profile picture address (URL), and Google account unique identifier
- How collected
- Provided by Google when you sign in to the App with your Google account
- Purpose
- Verifying your identity, keeping you signed in, and checking your access rights
Subscriptions and add-ons
- Items
- Plan (Free or Pro), subscription status and expiry date and time, purchased add-ons, and the date and time of each purchase or cancellation
- How collected
- Generated when a subscription or purchase is processed. While you are signed in, the App checks your access rights with the Company’s server about every 10 minutes
- Purpose
- Providing paid features and checking access rights
Microsoft Store purchase linking
- Items
- Microsoft Store product identifier, purchase and subscription status and expiry date and time, and the purchase verification key issued by Microsoft Store
- How collected
- When the App checks your purchase history after you buy a subscription or add-on in Microsoft Store
- Purpose
- Linking subscriptions and add-ons paid for in Microsoft Store to your account
Information generated automatically while you use the service
- Items
- IP address, access date and time, and device and browser information
- How collected
- Recorded on the account authentication server when you sign in and when your access rights are checked
- Purpose
- Managing sign-in sessions, preventing fraudulent use, and investigating security incidents
Inquiries and requests to exercise your rights
- Items
- Email address and the content of your inquiry
- How collected
- When you send an inquiry or request by email
- Purpose
- Responding to inquiries and handling requests such as access, correction, and deletion
The Company does not collect unique identification information such as resident registration numbers, sensitive information, phone numbers, postal addresses, or payment method information.
Retention Period
- Account identification, subscription, add-on, and Microsoft Store purchase linking information: kept until you request membership withdrawal (account deletion).
- Access records: destroyed together with your account when it is deleted. The processor’s system operation logs are deleted automatically once the retention period set by the processor has passed.
- Records of inquiries and rights requests: kept for one year from the date the request is resolved, then destroyed.
- Where another law requires information to be preserved, it is kept separately from other information for the required period.
Signing out of the App does not by itself delete your account information. To delete your account, contact the Chief Privacy Officer below.
How We Destroy Personal Information
- Personal information is destroyed without delay when the retention period ends, the purpose of processing has been achieved, or a deletion request is received.
- Information in electronic files is permanently deleted in a way that cannot be recovered. When an account is deleted, the subscription, add-on, and purchase linking information connected to that account is deleted with it.
- The Company does not keep personal information in paper documents.
Provision to Third Parties
The Company does not provide your personal information to third parties, except where Articles 17 and 18 of the PIPA permit it, such as when you consent or when a law specifically provides for it.
Outsourcing of Processing
To provide the service, the Company outsources the following personal information processing tasks.
- Processor
- Supabase, Inc.
- Outsourced tasks
- Account authentication (Google sign-in), operation of the account database, and operation of the access-rights check server
- Storage location
- Seoul region, Republic of Korea
In accordance with Article 26 of the PIPA, the Company’s outsourcing contract sets out, among other things, a prohibition on processing for purposes other than the outsourced tasks, technical and administrative safeguards, and restrictions on further outsourcing, and the Company supervises whether the processor handles personal information safely. If the processor or the outsourced tasks change, the Company will disclose the change in this Privacy Policy.
Transfers Outside Korea
For the outsourced processing and storage needed to perform its contract with you, the Company transfers personal information outside Korea as described below, and discloses these matters in this Privacy Policy under Article 28-8(1)(3) of the PIPA.
Supabase, Inc.
- Items transferred
- The account identification, subscription and add-on, Microsoft Store purchase linking, and automatically generated information described in Section 01
- Destination country
- United States. The data is stored in the Seoul region of the Republic of Korea, but because the processor is a U.S. company, it may be accessed from outside Korea during system operation, maintenance, and incident response
- When and how
- Sent over an encrypted network when you sign in and when your access rights are checked, and accessed remotely when operation or incident response requires it
- Recipient
- Supabase, Inc. · privacy@supabase.com
- Purpose and retention
- Performing the outsourced tasks described in Section 05 · until you withdraw your membership or the outsourcing contract ends
- How to refuse, and the effect
- No transfer takes place if you do not sign in with Google. If you have already signed in, you can request deletion of your account. Without signing in, you cannot use features that require sign-in, such as subscriptions and add-ons
Microsoft Corporation
- Items transferred
- The purchase verification key issued by Microsoft Store and an identifier used to link your account
- Destination country
- United States
- When and how
- When the App checks your purchase history after you buy in Microsoft Store, the Company’s server sends the data to the Microsoft Store service over an encrypted network
- Recipient
- Microsoft Corporation · Privacy inquiries
- Purpose and retention
- Verifying purchases · as set out in Microsoft’s privacy statement
- How to refuse, and the effect
- No transfer takes place if you do not make a purchase in Microsoft Store. In that case, you cannot use paid subscriptions or add-ons
External Services You Connect Directly
Some features of the App connect from your PC directly to the services below, using API keys or settings you enter yourself. This data does not pass through the Company’s servers, and the Company cannot receive or view it. Each service’s processing is governed by that service’s privacy policy.
- Bybit
- Market data, and order, balance, and position requests for your Bybit account (live or demo). Requests signed with your API key and order details (symbol, side, quantity, and price) are sent. Privacy policy
- OpenAI
- When AI features use OpenAI, strategy descriptions and conversation content, strategy configurations, recent market data, backtest and optimization results, and data for chart analysis are sent using your API key. The News & Events feature also uses OpenAI’s web search tool. Privacy policy
- Anthropic
- When AI features use Anthropic, the same information as for OpenAI (strategy descriptions and conversation content, strategy configurations, recent market data, backtest and optimization results, and data for chart analysis) is sent using your API key. The News & Events feature also uses Anthropic’s web search tool. Each AI request uses only one of the two services: the one selected in settings or, if none is selected, Anthropic when an Anthropic API key is set, otherwise OpenAI when an OpenAI API key is set. Privacy policy
- Telegram
- If you turn on notifications, the chat ID you specify and notification messages (account equity; session name; the symbol, side, quantity, entry price, unrealized profit and loss, and return of open positions; net profit and loss; win rate; number of trades; maximum drawdown; profit factor; and warnings) are sent to your bot. If you turn on remote control, while the App is running it keeps checking your bot for new commands (repeating requests that each wait up to 25 seconds), and from the messages it receives it reads only the items needed to handle a command (the command or button you pressed, the chat ID, the sender ID, and the message number and time sent). Only commands that you yourself send in the one-to-one chat matching the chat ID you specify are handled; messages from other chats or other senders get no reply, and their content is not stored. In reply to your commands, your account equity, available balance, and margin rates; your open positions (the same items as in notifications); live or demo and the session name; slot numbers, names, symbols, strategy names, and operating status; command results and error messages; and the command menu are sent to your bot. Privacy policy
- jsDelivr
- When you open a backtest report, the chart library is downloaded from jsDelivr, and your IP address is sent to jsDelivr in the process. Privacy policy
- Sign-in takes place on Google’s page in your default browser. Privacy policy
- Microsoft
- App installation, payment, and subscription management are handled by Microsoft Store. Privacy statement
Information Stored Only on Your PC
The following information is stored only in the App’s data folder (PurpleStudio) under your Windows user account and is not sent to the Company.
- Stored encrypted with Windows Data Protection (DPAPI): your Bybit API key and secret, OpenAI API key, Anthropic API key, Telegram bot token, the token that keeps you signed in, and access-rights check results
- Stored unencrypted: strategies, AI conversation history, order and trade records, market data, backtest and optimization results and reports, Telegram chat ID, remote control settings (whether it is on, the bot ID, and the number of the last message received and when it was received), and App activity logs
Signing out deletes the sign-in token and the access-rights check results from your PC, but the other information remains. Bar-by-bar entries in the App activity logs are deleted automatically after 7 days, AI conversations can be deleted one at a time in the App, and all other information remains until you delete it in the App or delete the App’s data folder. If you share your PC with other people, please use separate Windows user accounts.
Your Rights and How to Exercise Them
- You may at any time request access to, correction of, deletion of (including membership withdrawal), or suspension of processing of your personal information.
- Send your request to 3pm@yeonha.studio. To verify your identity, please send it from the email address of the Google account you use to sign in.
- The Company will act on your request within 10 days of receiving it and tell you the result. If the Company refuses or limits a request in accordance with the law, it will tell you why.
- You may also make a request through a representative, such as a legal representative or a person you have authorized; in that case, a power of attorney must be submitted with the request.
Security Measures
- Administrative: the number of people who can access personal information is kept to a minimum.
- Technical: all communication between the App and the server is encrypted (HTTPS). The account database applies row-level access control so that a user’s App cannot look up other users’ information, and access-rights check results are digitally signed. API keys and sign-in tokens are encrypted on your PC with Windows Data Protection.
- Physical: account information is kept in the processor’s data centers under the processor’s physical security controls. The Company does not keep personal information on separate physical media.
Automatic Collection Tools and How to Refuse Them
The App does not use cookies, advertising identifiers, or behavioral analytics tools, and does not send usage statistics or error reports to the Company. However, Google may use cookies on the Google page that opens during sign-in, and you can refuse cookies in your browser settings. If you refuse cookies, Google sign-in may be restricted.
Children Under 14
The App is not intended for children under the age of 14, and the Company does not knowingly collect their personal information. If the Company learns that personal information of a child under 14 has been collected, it will destroy that information without delay.
Chief Privacy Officer
For inquiries, complaints, or requests for relief regarding the processing of personal information, please contact the Chief Privacy Officer below. The Company will respond and act without delay.
- Chief Privacy Officer
- Minho Hwang (CEO)
- Contact
- 3pm@yeonha.studio
Remedies for Infringement
To seek relief for an infringement of your personal information, you may apply for dispute resolution or counseling to the following agencies in the Republic of Korea.
- Personal Information Dispute Mediation Committee
- 1833-6972 · www.kopico.go.kr
- Personal Information Infringement Report Center (KISA)
- 118 · privacy.kisa.or.kr
- Supreme Prosecutors’ Office, Cyber Investigation Division
- 1301 · www.spo.go.kr
- Korean National Police Agency, Cyber Investigation Bureau
- 182 · ecrm.cyber.go.kr
Changes to This Privacy Policy
This Privacy Policy applies from its effective date. If anything is added, deleted, or modified, the Company will give notice on this page at least 7 days before the change takes effect, or at least 30 days before for changes that materially affect your rights. Previous versions of this Privacy Policy will remain available on this page.
Versions
-
November 3, 2026 Current You are viewing this version
To describe that the AI features of the App can now send requests to Anthropic (Claude) as well as OpenAI, using your own API key.
-
October 16, 2026 Previous
To describe the Telegram remote control feature of the App, which lets you send commands to the App from your own Telegram bot.
-
September 14, 2026 Previous