Privacy Policy

1. Purposes of Processing Personal Information

The Company processes personal information for the following purposes. Personal information that has been processed shall not be used for any purpose other than the following, and if the purposes of use change, the Company will implement necessary measures such as obtaining separate consent.

• Member registration and management: Member identification, identity verification, prevention of misuse, and confirmation of intent to register
• Provision of the Service: providing information necessary for use of the Service, including chess games, puzzles, learning, and analysis, and sending app notifications
• Service improvement: usage statistics analysis, development of new services, provision of personalized services
• Customer support: handling inquiries, delivering notices, dispute resolution
• Marketing (where optional consent is given): notification of new services, provision of event information

2. Categories of Personal Information Processed

※ If you access the Service from outside Korea, your country is estimated from your IP address to show a notice offering English; the estimated country is not stored.

3. Retention and Use Period of Personal Information

• Member information: Destroyed immediately upon Account deletion (provided, however, that where retention is required under applicable laws and regulations, such information shall be retained for the period prescribed thereby)
• Game records: Because game records also belong to the opponent, they remain after Account deletion, shown without a name as 'Deleted user' or a random identifier; personally identifiable information such as email addresses is deleted immediately
• Access logs and IP addresses: Retained for three months in accordance with the Protection of Communications Secrets Act
• Records of misuse: Retained for one year to prevent repeated misuse
• Puzzle and learning records, usage statistics: After Account deletion, used solely for Service usage statistics in a form not linked to any name or email address
• Records of consent to the Terms (time of consent): Retained as evidence that consent was obtained
• Push notification tokens: Deleted upon Account deletion, or when the notification service reports that the token can no longer be used
• Rate-limiting records (IP addresses, email addresses, etc.): Automatically deleted after at most about two hours

4. Provision of Personal Information to Third Parties

As a general rule, the Company does not provide Users' personal information to third parties. However, the following cases are exceptions:

• Where the User has given prior consent
• Where required by statute or where a law-enforcement authority requests disclosure in accordance with the procedures prescribed by statute for investigative purposes

5. Entrustment of Personal Information Processing and Overseas Transfer

The Company entrusts the processing of personal information as set out below in order to provide the Service smoothly. As all processors (entrusted parties) are located outside the Republic of Korea, personal information is transferred overseas as processing entrustment and storage necessary for the performance of a service agreement, pursuant to Article 28-8 (1) 3 of the Personal Information Protection Act:

• Timing and method of transfer: Transmitted over encrypted communication (HTTPS) each time you use the Service.
• Retention and use period: Retained for the periods set out in 3. (Retention and Use Period of Personal Information) above, and no longer retained once the entrustment agreement ends. However, the processors (entrusted parties) keep emails sent and their records for 30 days, app notifications not yet delivered to the device for up to four weeks, and database backups for up to seven days, and then delete them. Email addresses that bounced or were reported as spam remain on the email delivery processor's suppression list so that no further emails are sent to them, and the Company will delete them upon request.
• How to refuse: If you do not wish your personal information to be transferred overseas, you may refuse by not signing up or by deleting your Account; however, the Service cannot be provided without the processors (entrusted parties) listed above, so in that case you will not be able to use the Service.
• Information transferred overseas may be accessed by courts, investigative authorities, or other such bodies in accordance with the laws and regulations of the destination country.

Note: Processors may not use personal information for any purpose other than performing the entrusted work, and the Company supervises and manages personal information protection matters that may arise in the course of the entrusted work.

6. Rights and Obligations of Data Subjects and How to Exercise Them

Users may exercise the following rights as data subjects:

• Request to access personal information
• Request to correct errors or inaccuracies
• Request to delete personal information (processed immediately upon Account deletion)
• Request to suspend processing

The above rights may be exercised directly through the Settings menu within the Service, or by contacting the Personal Information Protection Officer designated below in writing or by e-mail, in which case the Company will take action without delay.

7. Procedures and Methods for Destruction of Personal Information

When the retention period for personal information has elapsed or the purpose of processing has been achieved, the Company destroys the relevant personal information without delay. Personal information in electronic file format is deleted using technical methods that render the records unrecoverable, and personal information printed on paper is destroyed by shredding or incineration.

8. Measures to Ensure the Security of Personal Information

The Company takes the following measures to prevent the loss, theft, leakage, or alteration of Users' personal information:

• Minimization of personnel who process personal information, and training of such personnel
• Encrypted storage of important information such as passwords (bcrypt hashing)
• Technical safeguards against hacking and similar threats (HTTPS communication, application of CSP/HSTS headers)
• Retention of access logs and prevention of forgery or alteration
• Management of access privileges to personal information processing systems

9. Operation of Cookies

The Company may use cookies to provide Users with personalized services. Users may allow or refuse all cookies, or require confirmation before a cookie is stored, by configuring their web browser options. However, if the storage of cookies is refused, access to certain parts of the Service may be restricted. The Company does not use cookies for advertising or tracking purposes, and the Service does not respond differently to a browser's "Do Not Track" signal. The Company does not embed tools of other companies that track Users across different sites in the Service. However, if a profile photo points to an external address (for example, a Google account photo), the site hosting it may receive connection information (such as the IP address and that site's cookies) when the photo is loaded.

10. Protection of Personal Information of Children Under the Age of 14

The Company does not accept membership registrations from children under the age of 14. Under Article 22-2 of the Personal Information Protection Act, the consent of a legal representative is required to process the personal information of a child under the age of 14; however, the Company does not operate such a consent procedure. At registration, the Company confirms that the User is 14 years of age or older.

11. Personal Information Protection Officer

12. Changes to the Privacy Policy

This Privacy Policy applies from its effective date. When content is added, deleted, or corrected, the changes and the effective date are posted on this Privacy Policy page at least seven days before they take effect; changes that materially affect Users' rights are posted at least 30 days in advance and also notified through the Service or by email or other means. Where applicable law requires consent for a change, separate consent will be obtained.