1. Information we process and why
| Category | Items | Purpose |
|---|---|---|
| Email sign-up | Email address, password (stored only as an irreversible hash), nickname | Identifying members and signing in; sign-up verification codes, password resets and security notices by email |
| Social sign-in | The account identifier, email address (if provided) and name or nickname (used only to suggest your first nickname and not stored separately) given by the sign-in provider (Google, Apple, Kakao, Naver, Facebook, Zalo) | Identifying members and signing in. We do not receive profile photos |
| Trial (no sign-up) | A randomly generated account identifier, game records | Letting you play a match without signing up |
| Playing the game | Nickname, avatar combination, per-country game wallets, assets and inventory, match records (opponent, time, trade timing and prices, results — including play-together matches, which are not reflected in rating, wallets, rankings, the match history list or friend-match records), rating and tier, records of game-money transfers between countries, ranking records, email language, sign-up source (the partner, if you arrived through a partner link or a partner app) | Providing the game, showing leaderboards and the Hall of Fame, fair matchmaking, game-record statistics and service improvement, per-partner usage totals |
| Friends, blocks and reports | Friend relationships, friend request records, block list, report records (reason and your nickname at the time of the report) | Providing the friends feature, handling violations of operating policy |
| Trial invites (play together) | A hashed (encrypted) value of the invite link, the member who invited, the country, the member or trial account that opened the link, the time it was created, and when the sign-up link expires and is used | Connecting you for a play-together trial, and making friends between the person who signed up after the trial and the person who invited them |
| Online status | The country you are connected to (kept in a temporary server store and deleted automatically about 90 seconds after you disconnect) | Showing your friends whether you are online |
| Push notifications (app only, if you allow them) | Device notification token, device type (Android or iOS), notification language | Delivering notifications for friend requests, accepted friend requests, friends who signed up through a trial link, and friend match requests. We do not send advertising or event notifications. Before you consent to the processing of personal information, we do not create a notification token or send one to our server |
| In-app purchases (app only) | Store transaction ID, product, amount and currency, payment and refund status | Confirming and delivering purchases, handling refunds, keeping records required by law. The Company does not receive card numbers or other payment details (Google Play and the App Store handle them) |
| Security | IP address, device type (app/web platform, summary of browser information), failed sign-in records | Blocking unauthorized sign-ins and excessive requests, new-device sign-in alerts |
| Inquiries | Email address, content of the inquiry | Answering inquiries |
- The Company does not use advertising or analytics tools, and does not use personal information for marketing or sell it.
- The Company does not collect your real name, phone number, date of birth or address.
Information shown to other users: signed-in users can open other users’ profile cards from places such as leaderboards, match results, match history and friend lists. A profile card shows your nickname, avatar, tier and rating, the first country you opened and the country you are currently in inside the game (not your real-world location), your ranked match record (wins, losses, win rate) and bankruptcy count for each country, your net worth, game wallet balance and asset valuation for each country, and your luxury collection and showcase item. The country you are currently in inside the game (not your real-world location) is also shown in friend lists, in friend search results for users who enter your exact nickname, and in friend requests you send or receive. Your friends can also see your friend-match record against them (wins, losses, draws and virtual profit or loss) for each country. Whether you are online is visible only to your friends. However, during a match your opponent is told when your connection drops and when it comes back. Someone who receives a play-together link can see the inviter’s nickname without signing in, and once they join the play-together trial you can see each other’s nickname and avatar. We do not show your email address, sign-up source or login records. Users who have blocked each other cannot find one another or send requests in friend search.
2. How long we keep it
- Member information: until you delete your account. Once you delete it you can no longer sign in, and if you come back with the same email or social account within 30 days you can restore the account. After 30 days we destroy your email address, password hash, social connections, nickname and avatar, and keep match records only in anonymized form so that no one can tell whose they were (so that your opponents’ match histories stay intact).
- Trial accounts: cleaned up automatically 30 days after they are created.
- Play-together invite records: destroyed daily once the sign-up link period (7 days from when they joined the play-together trial) has passed after the invite ended. An invite nobody joins ends after 30 minutes and is destroyed at the next cleanup. Play-together match records are not part of this cleanup and are kept like other match records (anonymized when a member deletes their account, as described under Member information).
- Friend relationships, friend request records, block list and report records: destroyed together when the account of either party is destroyed (30 days after withdrawal).
- Sign-in session information (refresh tokens): up to 14 days. IP ranges and device summaries used to recognize new devices: up to 30 days.
- Push notification tokens: when you log out, the app asks our server to delete that device’s token; destroyed immediately when you withdraw, immediately when a password change or reset logs out your other devices, and when you remove the app from a device and the notification service reports the token as invalid. Tokens that have not been refreshed for 30 days (for example, when the app has not been opened on that device for more than 30 days) are deleted automatically. We do not store notification tokens for accounts that have not completed consent to the processing of personal information.
Records that the law requires us to keep are stored separately for the periods below, even after you delete your account.
- Records of contracts, withdrawal of purchases, payments and supply of goods: 5 years (Act on the Consumer Protection in Electronic Commerce, Korea)
- Records of consumer complaints and dispute resolution: 3 years (same Act)
- Service access records (IP addresses, etc.): 3 months (Protection of Communications Secrets Act, Korea)
3. Destruction of personal information
When a retention period ends or the purpose has been achieved, we destroy the personal information without delay. Electronic files are deleted in a way that cannot be recovered; we do not keep paper records.
4. Provision to third parties
The Company does not provide your personal information to third parties, except when required by law.
- A social sign-in you choose is handled under that provider’s policy (Google, Apple, Kakao, Naver, Meta (Facebook), Zalo), and the Company receives only the items listed above that are needed to sign you in.
- If you arrive through a partner’s link, the Company reports only per-partner totals of visits, sign-ups and usage to that partner. We do not give partners information that could identify an individual user.
5. Outsourcing of processing
| Processor | Task |
|---|---|
| Kakao Corp. (Daum Smartwork) | Sending service emails (sign-up verification codes, password resets, security notices) |
| Vultr | Operating the service servers and storing data |
| Google LLC (Firebase Cloud Messaging) | Delivering app notifications (push) |
| Apple Inc. (Apple Push Notification service, iOS only) | Delivering app notifications (push) |
6. Processing outside Korea
If you choose to sign in with Google, Apple, Facebook or Zalo, information is exchanged with that company’s servers (in the United States, Vietnam and elsewhere) to verify the sign-in.
When you set a password, we check whether it has appeared in a data breach by sending only the first 5 characters of the password’s hash to Have I Been Pwned (United States). This value reveals neither your password nor who you are.
To deliver notifications to users who allow push notifications, we transfer personal information abroad as follows. Recipients: Google LLC (Firebase Cloud Messaging) and Apple Inc. (Apple Push Notification service, iOS devices only). Country: United States. Items: device notification token, member ID (an internal service number), request number and expiry time, a notification number (a random value), and notification content (the friend’s nickname and the kind of notification; for match requests also the bet tier and country). Purpose: delivering friend notifications so you receive them even when the app is closed or in the background (they are also sent while you are using the app). When and how: sent over the network each time a notification is created. Retention: after delivery, according to each company’s own policy. How to refuse and its effect: if you turn notifications off in your device settings and then open the app, the app deletes that device’s notification token and nothing is transferred any more (you still receive friend notifications while the app is open). When you log out, the app asks our server to delete that device’s token, and when you withdraw the token is destroyed immediately.
7. Your rights
You may at any time request access to, correction or deletion of, or suspension of the processing of your personal information.
- Nickname, avatar and language: change them yourself in the app’s profile and settings.
- Deleting your account: do it yourself in the app or web game under Settings › Delete account. See “Account deletion” for details.
- Any other request: email the Chief Privacy Officer below and we will reply within 10 days.
8. What we store on your device or browser
- App: sign-in tokens are kept in the device’s secure storage (iOS Keychain, Android Keystore). Your language, sound settings, selected country and — if you turn on “Remember email” — your email address are also stored on the device.
- Web game: the same information is kept in browser storage (localStorage). Please sign out on shared computers.
- Play-together links: a web game that opens the link keeps the invite details (link value, country, inviter’s nickname, and after you have played together, the sign-up link value) only in that tab’s temporary storage (sessionStorage); they disappear when you close the tab, finish the invite, log out or sign up. If you choose to sign up after the trial, the sign-up link value used to make you friends with the inviter is kept for up to 7 days in the device’s secure storage (app) or browser storage (web game), and removed once the friendship is made or the period ends.
- Website: only your chosen language and which lessons you have read are stored in your browser. We do not use cookies or tracking tools.
9. Children
You must be at least 14 years old to sign up for the Service. If you use the Service in Vietnamese, you must be at least 16. If we learn that we have collected personal information from someone below this age, we will destroy it without delay.
10. Security measures
All communication is encrypted (HTTPS, WSS), and passwords are stored only as irreversible hashes (bcrypt). Repeated failed sign-ins require an additional verification code, and signing in from a new device triggers an email alert. Administrator access is limited to separate accounts and permissions.
11. Chief Privacy Officer
- Name: Yeonwoo Jo (Representative)
- Contact: admin@chartfighter.com
You may also report or seek advice on privacy violations to the Personal Information Infringement Report Center of Korea (privacy.kisa.or.kr, 118 within Korea) or the Personal Information Dispute Mediation Committee (www.kopico.go.kr, +82-1833-6972).
12. Effective date and changes
The effective date of this Policy will be announced on this page when the Service launches.
If this Policy changes, we will announce it on the website and in the app 7 days before the change takes effect (30 days before for changes unfavorable to users).