The effective date will be announced when confirmed.
Effective Date: [Effective Date]
This is a translation provided for convenience. The Korean version is the official version, and if the two differ, the Korean version prevails.
FL Games (the "Company") establishes and publishes this Privacy Policy as follows in order to protect Users' personal information in accordance with the Personal Information Protection Act of Korea and other applicable laws, and to handle related concerns promptly and smoothly.
1. Personal Information Processed and Purposes
The Company processes only the minimum information necessary to provide the Service. The Company does not ask for your name, phone number or address when you start the game. However, if you link an external account, the information provided by that service may be stored on the account authentication server as shown below.
· Category: Account / Items: Member identification number (UID), account type, account creation and last login date and time / Purpose: Account creation, login, restoring progress across devices / Legal basis: Performance of contract
· Category: Account linking (if chosen) / Items: The identifier of the linked external account, and the email address, name (display name) and profile photo URL provided by that service — Google: email, name, profile photo / Apple: email (Apple relay address if "Hide My Email" is chosen), name (first time only) / Game Center, Google Play Games: player ID, display name / Purpose: External account login, account recovery / Legal basis: Performance of contract (where the User chooses to link)
· Category: Gameplay / Items: Nickname, game progress, currency and item data, service usage records, access date and time / Purpose: Providing the game service, saving and synchronization, preventing fraudulent use, restrictions on use / Legal basis: Performance of contract
· Category: Payment / Items: Order number (transaction ID), product ID, payment date, time and amount, payment status (including refunds) / Purpose: Delivering Paid Products, processing withdrawals and refunds, preventing fraudulent payments / Legal basis: Performance of contract, legal obligations
· Category: Device and app / Items: Device model, OS version, app version, language and time zone settings, country information, device identifier / Purpose: Checking service compatibility, analyzing errors, calculating reset times, checking for duplicate logins / Legal basis: Performance of contract
· Category: Analytics and errors / Items: App instance ID, in-game behavior events, error (crash) logs / Purpose: Improving the Service, statistical analysis, fixing errors / Legal basis: Improving and stably providing the Service
· Category: Advertising / Items: Advertising identifier (Android Advertising ID — unless turned off in device settings; not collected on iOS), IP address, ad impression and viewing records / Purpose: Serving ads, granting rewarded ad rewards, measuring ad performance / Legal basis: Performance of contract (serving ads, granting rewards), the User's device settings (personalized ads on Android)
· Category: Customer support / Items: Email address, inquiry content, attachments / Purpose: Responding to inquiries, handling disputes / Legal basis: The User's request
- The Company does not process sensitive information (health, beliefs, etc.) or unique identification information (such as resident registration numbers), and does not process pseudonymized information.
- Payment method information such as card details is processed by the app markets (Google, Apple); the Company does not collect it.
- IP addresses, device identification information similar to cookies and usage records may be generated and collected automatically while using the Service.
2. Children Under 14
The Company does not allow children under 14 to use the Service and does not knowingly collect children's personal information. If the Company learns that information of a child under 14 has been collected, it will destroy it without delay. (For Users residing in the United States and Canada, this includes not collecting information of children under 13.)
3. Retention Period and Destruction
3-1. Retention period
· Item: Account and gameplay information / Retention: Destroyed without delay after the 30-day grace period following an account deletion request
· Item: Long-term inactive accounts / Retention: Destroyed upon deletion when deleted under Article 12 of the Terms
· Item: Analytics and error information / Retention: Up to 14 months from collection (based on the analytics service's retention setting)
· Item: Customer inquiry records / Retention: 3 years after the inquiry is resolved
Where retention is required by applicable laws, the following information is kept separately for the periods below.
· Law: Act on the Consumer Protection in Electronic Commerce / Item: Records of contracts or withdrawals / Period: 5 years
· Law: Act on the Consumer Protection in Electronic Commerce / Item: Records of payments and supply of goods / Period: 5 years
· Law: Act on the Consumer Protection in Electronic Commerce / Item: Records of consumer complaints or dispute handling / Period: 3 years
· Law: Protection of Communications Secrets Act / Item: Service access records (logs, access IP) / Period: 3 months
The identification information of accounts permanently restricted for violating the Terms of Service, and the reasons for restriction, may be kept for 1 year from the date of restriction to prevent fraudulent use through re-registration.
3-2. Destruction procedure
1. Information whose retention period has ended or whose processing purpose has been achieved is selected for destruction without delay.
2. When a User requests account deletion, the User is logged out immediately and the account is recorded as scheduled for deletion. During the grace period, the information is not used except when the User logs in again with the same account and chooses to restore it, and after the 30-day grace period, the account authentication information (including the identifier and email of linked external accounts) and game data are deleted automatically.
3. Payment and withdrawal records that must be kept under applicable laws are stored separately from game data for the required period and then destroyed.
3-3. Destruction method
Electronic files are deleted in a way that cannot be recovered, and information remaining in cloud server backups is deleted sequentially according to the backup retention cycle. The Company does not keep personal information in paper documents.
4. Outsourcing of Processing and Transfer Abroad
The Company outsources personal information processing as follows to provide the Service. Because some of the processors' servers are located abroad, items whose "Location" below is outside Korea are transferred overseas. Personal information is transmitted over the network from time to time while the Service is used.
· Processor (contact): Google LLC — Firebase Cloud Firestore, Cloud Functions (https://support.google.com/policies/contact/general_privacy_form) / Location: Republic of Korea (Seoul region) — not a transfer abroad / Items: Account, gameplay, payment records / Purpose: Data storage and synchronization, payment verification, processing account destruction / Retention: The retention period in §3
· Processor (contact): Google LLC — Firebase Realtime Database (Google contact above) / Location: Singapore / Items: Member identification number, device identifier, session ID / Purpose: Checking for duplicate logins to the same account / Retention: Deleted automatically when the session ends
· Processor (contact): Google LLC — Firebase Authentication, Remote Config (Google contact above) / Location: United States / Items: Member identification number, linked account information (§1), device and app information / Purpose: Account authentication, remote configuration / Retention: Until the account is destroyed
· Processor (contact): Google LLC — Firebase Analytics, Crashlytics (Google contact above) / Location: United States / Items: Analytics and error information, device and app information / Purpose: Statistical analysis, error analysis / Retention: Analytics 14 months from collection, Crashlytics 90 days from collection
· Processor (contact): Unity Technologies — LevelPlay (ad mediation), Unity Ads (ad network) ([email protected]) / Location: United States / Items: Advertising identifier (on Android, where allowed), IP address, device information, ad impression and viewing records / Purpose: Serving ads, verifying rewarded ad rewards, measuring ad performance / Retention: Until the purposes of serving ads and measuring performance are achieved (see https://unity.com/legal/game-player-and-app-user-privacy-policy for specific periods)
· Processor (contact): Google LLC — AdMob (ad network) (Google contact above) / Location: United States / Items: Advertising identifier (on Android, where allowed), IP address, device information, ad impression records / Purpose: Serving ads, measuring ad performance / Retention: Until the purposes of serving ads and measuring performance are achieved (see https://policies.google.com/privacy for specific periods)
· Processor (contact): Google LLC — Google Play (Google contact above) / Apple Inc. — App Store, Sign in with Apple, Game Center (https://www.apple.com/legal/privacy/contact/) / Location: United States / Items: Payment records, external account identifiers / Purpose: Payment processing, external account login / Retention: According to each company's privacy policy (https://policies.google.com/privacy, https://www.apple.com/legal/privacy/) and applicable laws
- Legal basis: Processing essential to providing the Service (Firebase, payment and login, serving rewarded ads and verifying rewards) is based on Article 28-8(1)(3) of the Personal Information Protection Act (outsourcing and storage necessary for concluding and performing the contract with the User, disclosed in this Privacy Policy). Separately, advertising identifiers are processed for personalized ads only where the User has allowed it in the device settings (§6).
- Users may refuse the transfer abroad, but since the above tasks are essential to providing the Service, a User who refuses cannot use the Service. If you wish to refuse, please stop using the Service and delete your account.
- Personalized ads and tracking through advertising identifiers can be refused by the methods in §6 below, and refusing does not limit use of the Service (non-personalized ads may be shown).
- The Company does not sell personal information to third parties.
5. Provision of Personal Information to Third Parties
The Company processes Users' personal information only within the scope of the purposes in Section 1 and does not provide it to third parties, except with the User's consent or where specifically provided by law (such as lawful requests from investigative agencies).
6. Automatic Collection Tools and How to Refuse
The Service uses advertising identifiers and app instance IDs. Users can limit their collection and use as follows.
· Device: Android / Method: Settings → Google (or Privacy) → Ads → Delete advertising ID
· Device: iOS / Method: The Service does not request app tracking on iOS and does not collect the advertising identifier (IDFA). Only non-personalized ads are shown, so no setting is needed.
6-2. Processing of behavioral information for personalized ads
· Category: Items collected / Details: Advertising identifier, app usage records (ad impressions, views and clicks), device information, IP address
· Category: Collection method / Details: Collected automatically through ad SDKs when the User runs the app and ads are displayed
· Category: Purpose / Details: Serving ads relevant to the User's interests, measuring ad performance, preventing ad fraud
· Category: Retention / Details: According to each advertising company's policy (§4)
· Category: Collecting and processing companies / Details: Unity Technologies (LevelPlay, Unity Ads), Google LLC (AdMob)
· Category: How to refuse / Details: The device settings in §6. Non-personalized ads are still shown if you refuse, and ad rewards are the same
The Company does not provide personalized ads to Users it knows to be children under 14.
6-3. Automated decisions
The Company may analyze usage records by automated means to detect fraudulent use (modified clients, abnormal payments, etc.). The Company does not finalize a suspension or permanent restriction based solely on detection results; it takes action after an operator has reviewed the case. Users may object to restrictions and request an explanation in accordance with the Operation Policy.
When a payment cancellation or refund is confirmed, the recovery of currency and the feature restrictions for a negative balance are applied automatically under Article 27 of the Terms of Service, and Users may request an explanation and re-review at [email protected].
7. Users' Rights and How to Exercise Them
① Users may at any time request access to, correction, deletion or suspension of processing of their personal information, or withdraw consent.
② Users can delete their account themselves in the game under Settings → Account → Delete Account. Even if you have already deleted the app, you can request deletion at https://sites.google.com/view/kittypop-help or [email protected]. Other rights can also be exercised by request to [email protected]. Please include your member number from the settings menu for identity verification.
③ The Company takes action within 10 days of receiving a request and informs the User of the result.
④ Rights may be exercised through a legal representative or an authorized person, in which case a power of attorney must be submitted.
⑤ Information that applicable laws require to be retained (§3-1) cannot be deleted on request.
8. Measures to Ensure the Security of Personal Information
The Company takes the following measures to ensure the security of personal information.
1. Access control: The server database is restricted by security rules so that each User can read and write only their own data, administrative privileges are limited to the representative's account, and two-step verification is used.
2. Encryption in transit: All communications are encrypted with TLS.
3. App integrity checks: Technologies to block access from abnormal clients (such as App Check) are applied.
4. Minimal collection: Identifying information such as names and contact details is not collected when starting the game.
5. Retention of access records: Access records for the administration console are kept.
9. Privacy Officer
· Category: Privacy Officer / Details: SEO DEOKGYU (Representative)
· Category: Contact / Details: [email protected], +82-70-8080-0417
Users may direct all inquiries, complaints and requests for remedies related to personal information protection arising from use of the Service to the contact above.
10. Remedies for Infringement of Rights
If you need to report or seek advice on an infringement of personal information, you may contact the following organizations in Korea.
· Organization: Personal Information Dispute Mediation Committee / Contact: 1833-6972 (www.kopico.go.kr)
· Organization: Personal Information Infringement Report Center / Contact: 118 (privacy.kisa.or.kr)
· Organization: Supreme Prosecutors' Office Cyber Investigation Division / Contact: 1301 (www.spo.go.kr)
· Organization: Korean National Police Agency Cyber Investigation Bureau / Contact: 182 (ecrm.police.go.kr)
11. Additional Information for Users Outside Korea
11-1. Service regions
The Service is not distributed in the European Economic Area (EEA), the United Kingdom or Switzerland.
11-1-2. Users in Canada (PIPEDA, Quebec privacy law, etc.)
- The Company processes personal information within the scope of the purposes described in this Privacy Policy, and Users can review this Privacy Policy before using the Service.
- Users may request access to, correction or deletion of their personal information and may refuse personalized ads (§6). Requests can be made to the Privacy Officer in §9.
- As described in §4, personal information is transferred to and stored in regions outside Canada (including Quebec), such as the United States, and may be accessed by authorities of those countries under their laws. The Company protects it through contracts with processors and the processors' safeguards.
- Users may file a complaint with the Office of the Privacy Commissioner of Canada or the Commission d'accès à l'information of Quebec.
11-2. Users in the United States (California CCPA/CPRA, etc. — where those laws apply)
- The Company does not sell personal information. Sharing advertising identifiers for personalized ads may constitute "sharing" under some state laws, and you can opt out by the methods in §6.
- Users may request access to, deletion or correction of the categories of information collected, and may opt out of sharing. The Company does not discriminate against Users for exercising their rights.
- The Service is not directed to children under 13.
11-3. Users in Japan
- Personal information is transferred abroad (to the United States, etc.) as described in §4 above. For the personal information protection systems of the destination countries, please refer to the materials published by the Personal Information Protection Commission of Japan.
12. Changes to This Privacy Policy
This Privacy Policy applies from [Effective Date]. If any content is added, deleted or modified, the Company will announce it within the Service from 7 days before it takes effect (30 days before for changes that are important to Users' rights).
- Previous versions: None
Website inquiries and analytics
Website inquiries are sent through Cloudflare to the support mailbox. Cloudflare Turnstile helps prevent automated submissions. Your email and message are used to handle the inquiry and kept for three years after resolution. When configured, this website uses Cloudflare Web Analytics. Google Analytics runs only with your permission. You can change this choice using Analytics settings in the footer.