Privacy Policy

1. Controller and purposes. The operator identified below processes personal data for account management, requested analysis and storage, subscriptions, security, support and legal obligations. Necessary contract processing relies on Article 15(1)(4) of Korea's Personal Information Protection Act; processing required by law relies on Article 15(1)(2). Optional processing requiring consent has a separate notice describing the data, purpose, period and right to refuse.

2. Account and access information. Registration collects email, display name and password; passwords are stored as hashes. We process account creation, update and verification times, session tokens, IP addresses, browser information and security records. If you use multifactor authentication, we process encrypted authentication secrets, hashed recovery codes and authentication records. We send verification and password-reset emails.

3. Analysis and optional features. Saved commanders, tactics, books, equipment, progression, formations, game, season, language, region, requests, results and usage are linked to your account. Sharing, alliance, referral and affiliate features process public result summaries, membership and roles, invitations, referral and reward records, and affiliate display names, channel URLs and applications. You need not submit feature-specific data when you do not use that feature.

4. Billing and support. We process billing country, product, amount, currency, tax, provider customer, transaction and subscription identifiers, payment, refund and renewal status, and checkout acknowledgment records. Paddle's checkout handles card numbers and security codes; our server does not store them. Support uses account ID, email, category, message and handling records. Queued email content is encrypted. Do not include unnecessary national identifiers, card details or other sensitive material in support messages.

5. Usage records. Our own systems record user IDs or hashed identifiers, times, language, region, game context and necessary feature events for delivery, usage administration and error handling. We do not use these records for automated decisions with legal or similarly significant effects on individuals. Battle recommendations concern the game formations you supply.

6. Retention. Account, inventory and saved results are retained while you use the service and removed when account closure or a relevant deletion request is processed. Where Korean e-commerce law requires retention, contract, withdrawal, payment and delivery records are kept for five years, consumer complaints and disputes for three years, and advertising records for six months. Only necessary identifying, transaction or support fields are retained for those purposes. Specific operational log, email-job and backup periods and exceptions appear in the retention notice below.

7. Erasure. We erase unnecessary data without undue delay when its purpose or retention period ends. Legally retained records are separated from ordinary service data with restricted access and recorded grounds, fields and periods. Electronic records are deleted to prevent recovery; paper records are shredded or destroyed. Previously processed deletion requests must also be applied when restoring backups. Staff process account-closure and rights requests after identity verification.

8. External processing and international transfers. Data entered into Paddle's checkout and the product, country and internal transaction identifiers we send are used by Paddle to sell and process payment; we receive payment status. Paddle handles buyer data under its own privacy policy. The processor and transfer notice below identifies hosting, database and email providers and relevant overseas recipients, countries, fields, purposes, timing, methods, retention, legal grounds and refusal options. Separate transfer consent is obtained before a transfer where required.

9. Disclosure and sharing. A share link makes its public analysis summary available to anyone holding the link; recipients' saved copies may survive revocation. Alliance features display membership and role information needed for the feature. Other third-party disclosure occurs only with consent or another lawful basis and within its necessary scope. Share links do not expose full inventories or authentication credentials.

10. Cookies and device storage. We use essential authentication and request-forgery protection cookies, localStorage for inventory, analysis cache, settings and alliance credentials, and sessionStorage for referral codes. The default sign-in session lasts seven days and may renew with use. Browser settings let you block cookies or clear site data, which may affect sign-in and saved settings. On shared devices, sign out and clear stored site data.

11. Your rights and safeguards. You or an authorized representative may request access, correction, erasure, restriction, consent withdrawal and legally available portability through the privacy contact or support below. Email or telephone requests remain available if you cannot sign in. We verify identity or authority, review retention obligations, and respond within applicable deadlines or explain restrictions. Consent-based processing of children under 14 requires verified legal-representative consent; unlawfully collected child data is addressed through restriction or deletion. Safeguards include restricted access, credential hashing, encryption and security records.

12. Contact and changes. The privacy officer or responsible department's contact is listed below. You may also seek help from Korea's privacy infringement reporting centre at 118 or the Personal Information Dispute Mediation Committee. We publish the effective date and material changes to this policy and obtain new consent before processing that requires it.