Privacy Policy

1. Purposes of Processing Personal Data

We process personal data for the purposes below. The personal data processed will not be used for any purpose other than the following, and where the purpose of use changes, we will take necessary measures such as obtaining separate consent under Article 18 of PIPA.

• Inquiries and support — receiving and responding to inquiries (partnerships, press, recruiting, etc.) by email, identity verification, and maintaining a communication channel
• Providing the Services (games) — delivering game content and features, creating and authenticating accounts via Firebase Authentication (guest anonymous sign-in and Google/Apple/Kakao social login) and storing account data, providing a ranking (leaderboard) service via an account identifier (or, for games without a login, that game's device-based identifier), storing user settings and progress, sending push notifications, and app integrity verification and remote configuration
• Operating and improving the Services — usage analytics, error/crash diagnostics and incident handling, quality improvement, and new feature development
• Marketing and advertising — serving in-game ads, and providing personalized ads and event information (where separately consented)

2. Personal Data We Process

We process the minimum personal data necessary to provide the Services, as follows.

※ PopRise uses Firebase Authentication for accounts and authentication; guests are also identified by a Firebase anonymous UID. This UID is not shown on the leaderboard or any other public screen — what is public is the nickname you choose and game records such as score, combo, blocks, and level. We do not send your name or email directly as Firebase Analytics events. On iOS, the advertising identifier (IDFA) is used only if you allow app tracking (ATT). Games without a login may use that game's device-based identifier instead of the account-based items above.

※ These items may change when a game launches or a feature is added; we will update and disclose this policy accordingly.

3. Children Under 14

Our Services are intended for users aged 14 and older, and we do not collect the personal data of children under 14 without the consent of their legal guardian. Where consent is required to collect, use, or provide the personal data of a child under 14, we obtain the legal guardian’s consent and may request the minimum information necessary to verify it.

4. Processing and Retention Period

We process and retain personal data within the period required by law or the period consented to at the time of collection, as follows.

• Inquiry-related data — 3 years after the inquiry is resolved (to address potential disputes)
• Game usage data — until the collection purpose is achieved or the service terminates (or the period required by applicable law, if any)
• Account information (social login linkage, etc.) — until you request account deletion or the service terminates
• Ranking (leaderboard) data — until the service terminates or you request deletion
• Automatically collected data (access logs, etc.) — 3 months, under the Protection of Communications Secrets Act

Where other laws require retention for a specified period, we retain the data for the period prescribed by those laws.

5. Destruction of Personal Data

When personal data becomes unnecessary — for example, when the retention period expires or the processing purpose is achieved — we destroy it without delay (within 5 days, absent justifiable cause).

• Procedure — we identify the data for which a destruction reason has arisen and destroy it with the approval of the Data Protection Officer.
• Method — electronic files are permanently deleted by a method that prevents recovery; paper documents are shredded or incinerated.

6. Provision to Third Parties

We process personal data only within the scope of the purposes stated in Section 1, and provide personal data to third parties only where it falls under Articles 17 and 18 of PIPA, such as with the data subject’s consent or under specific legal provisions. We do not currently provide personal data to third parties; should this become necessary, we will update this policy in advance and obtain any required consent.

7. Outsourcing of Processing

We may outsource personal data processing tasks as follows to provide the Services smoothly.

※ Under Article 26 of PIPA, our contracts specify the prohibition of processing beyond the outsourced purpose, security measures, restrictions on re-outsourcing, and we supervise the contractors. We will disclose any changes to the outsourced tasks or contractors through this policy.

※ Social login for account-based games is provided through the authentication services of Google, Apple, and Kakao (iOS only); each provider’s handling of personal data is governed by its own privacy policy (Google, Apple, Kakao).

8. Transfer of Personal Data Overseas

In the course of using overseas providers for website hosting, inquiry handling, advertising, and analytics, personal data may be transferred overseas. We take the measures necessary for a safe transfer pursuant to Article 28-8 of PIPA.

※ The ad SDK (LevelPlay) mediates multiple ad networks, and personal data may be transferred overseas to each mediated network as well. For details on the ad SDK provider’s data processing, see https://unity.com/legal/game-growth/privacy-policy.

9. Security Measures

We take the following measures to ensure the security of personal data.

• Administrative — establishing and implementing an internal management plan, minimizing and training personnel who handle personal data
• Technical — access-rights management for the processing system, access control, encryption of data in transit (HTTPS), and installation and inspection of security programs
• Physical — access control to systems where personal data is stored

10. Cookies and How to Refuse Them

We may use cookies to provide tailored services. A cookie is a small piece of information that the website server sends to your browser and stores on your device.

You can refuse or delete cookies through your browser settings. However, refusing cookies may make some services harder to use.

• Chrome — Settings > Privacy and security > Cookies and other site data
• Edge — Settings > Cookies and site permissions > Manage and delete cookies and site data
• Safari — Preferences > Privacy > Cookies and website data

We use Google LLC (Google Analytics 4) and Microsoft Corporation (Microsoft Clarity) for website visitor analytics. Google Analytics collects visit and page-view records via cookies and online identifiers , and Microsoft Clarity records page interactions such as clicks and scrolls (session recordings, heatmaps) via cookies and online identifiers, and we enable them only when a visitor selects “Accept” in the cookie consent banner (no analytics cookies are set otherwise). You can change or withdraw consent at any time via the “Cookie Settings” link in the footer.

• Opt out of Google Analytics — install Google’s opt-out browser add-on: https://tools.google.com/dlpage/gaoptout
• For details on Google’s data processing: https://policies.google.com/privacy
• For details on Microsoft’s (Clarity) data processing: https://privacy.microsoft.com/privacystatement

11. Behavioral / Advertising Data and Opt-Out

To serve in-game ads (interstitials) in account-based games (e.g. PopRise), we use the ad mediation SDK LevelPlay (Unity Technologies / ironSource Ltd. (LevelPlay)). Through LevelPlay, mediated ad networks such as ironSource and Unity Ads are permitted to collect behavioral data to deliver personalized advertising. ironSource Ad Quality also runs to measure ad quality and prevent fraud.

• Behavioral data collected — advertising identifier (Android advertising ID/GAID, iOS IDFA), IP-based approximate location, device/OS/app version, app/service usage history, ad impression/click/performance/diagnostic records, and consent-state signals
• Method — automatically collected through the ad SDK while you use the Services
• Purpose — delivering personalized advertising based on your interests, and measuring ad performance and quality

※ The Google Mobile Ads (AdMob) SDK is bundled as a dependency of the Google User Messaging Platform (UMP) plugin, but we do not currently request or serve AdMob ads. In-game ad serving is limited to LevelPlay interstitials.

Consent in regulated regions (EEA, UK, Switzerland, etc.) — users in these regions are shown the Google UMP consent flow. In these regions we conservatively keep consent for analytics and personalized ads in a “denied” state by default, and choosing to keep seeing ads on the UMP screen (making ad requests possible) does not, by itself, enable analytics or personalized ads.

You can adjust personalized ads and analytics as follows.

• Device settings (limit ad tracking) — Android: Settings > Privacy > Ads > Delete advertising ID (or opt out of personalized ads) / iOS: Settings > Privacy & Security > Tracking > turn off “Allow Apps to Request to Track” (if you do not allow ATT, the IDFA is not used)
• In-app settings — you can turn off usage analytics (Analytics) collection in the game settings, and users in regulated regions (the EEA and regulated US states) are offered a “privacy options” screen where they can change their consent and choices at any time (changes apply immediately).

※ The app reads the US IAB GPP signal stored by Google UMP and passes your “Do Not Sell or Share” (sale/share opt-out) choice to the ad SDK (LevelPlay’s CCPA setting). You can change this choice through the “privacy options” screen above, and it takes effect immediately.

12. Your Rights and How to Exercise Them

You may at any time request access to, correction, deletion, or suspension of processing of your personal data, and withdraw consent. You can exercise these rights by contacting the Data Protection Officer in writing or by email, and we will act without delay.

If you request correction or deletion of an error in your personal data, we will not use or provide that data until the correction or deletion is complete. For children under 14, the legal guardian may exercise these rights on the child’s behalf.

Account & data deletion requests — account policies differ from game to game. For account-based games (e.g. PopRise) you may request deletion of your account (Firebase Authentication) and linked data; for games without a separate login you may request deletion of the data tied to that game’s device-based identifier (such as ranking records). See the Account & Data Deletion page for how to request deletion and what is deleted or retained, or email contact@craystream.com. We delete it without delay, except for data we are legally required to retain. You can stop the collection of your advertising identifier yourself via the device settings described in Section 11.

13. Data Protection Officer

We have designated a Data Protection Officer who is responsible for overseeing personal data processing and for handling data subjects’ inquiries, complaints, and remedies.

• Data Protection Officer
• Name: Dongbum Kim
• Title: Privacy Officer
• Email: contact@craystream.com

You may direct any questions, complaints, or remedy requests regarding personal data arising from your use of the Services to the Data Protection Officer, and we will respond and act without delay.

14. Remedies for Rights Infringement

To seek dispute resolution, counseling, or other remedies for personal data infringement, you may contact the following Korean agencies.

• Personal Information Dispute Mediation Committee — 1833-6972 (www.kopico.go.kr)
• Privacy Infringement Report Center (KISA) — 118 (privacy.kisa.or.kr)
• Supreme Prosecutors’ Office, Cybercrime — 1301 (www.spo.go.kr)
• National Police Agency, Cyber Bureau — 182 (ecrm.police.go.kr)

15. Changes to This Policy

This Privacy Policy is effective as of the date below. Any additions, deletions, or corrections required by law or policy will be announced on this page before they take effect.

• Previous effective date: 2026-07-10
• Effective date: 2026-07-21