Yarn MazePrivacy Policy
Operator name ("we", "us") operates the mobile game Yarn Maze (실타래 미로, the "Game"). This Privacy Policy explains what information we process, why, and the choices you have. We follow the Personal Information Protection Act of the Republic of Korea (PIPA) and other applicable laws.
- There is no sign-up and we never ask for your name, phone number, or email. The Game creates an anonymous account the first time you open it.
- Your nickname, avatar, scores, and records are shown publicly on the leaderboards.
- Payments are handled by the App Store and Google Play. We never receive your card or bank details.
- Ads are served by Google AdMob, which may use your device's advertising ID. You can turn off personalized ads in your device settings.
- We do not sell your personal information.
- You can ask us to delete your data at any time. See How to request data deletion.
1. Information we collect
When you first open the Game it creates an anonymous account. We then process the following information.
| Category | Items | When | Purpose |
|---|---|---|---|
| Account | Anonymous account ID (randomly generated), sign-in token | First launch | Keep your progress and wallet separate from other players' |
| Leaderboard profile (public) | Nickname (up to 12 characters), avatar, total score, stages cleared, rank | When you choose a nickname and when you clear a stage | Show leaderboards |
| Play records | Best time, fewest moves, and best score per stage; the input log of each cleared run (timing, direction, item use) | When you clear a stage | Verify records against cheating; calculate score and coins |
| Wallet | Coins, items (hints, wall breakers, rewinds), owned avatars, ad-free status, history of what you earned and spent | During play | Provide in-game items and resolve disputes |
| Purchase records | Store, transaction ID, purchase token or receipt, product, time of purchase | When you make an in-app purchase | Verify payment, deliver products, restore purchases, handle refunds |
| Ad reward records | Transaction ID and reward type of a rewarded ad | When you finish a rewarded ad | Grant the reward |
| Automatically collected | IP address, access time, device and OS information, app version, error logs | When the app talks to our server | Run the service, keep it secure, fix errors |
| Advertising (collected by Google) | Advertising ID (Android advertising ID; iOS IDFA only if you allow tracking), IP address, device information, ad views and clicks | When ads are shown | Serve and measure ads, prevent invalid clicks |
| Support | Your email address and message | When you contact us | Answer your request |
- We do not collect your name, phone number, postal address, precise location, contacts, or photos.
- Card and bank details are processed by Apple and Google. We never receive them.
- Some progress (current stage, settings, records not yet sent to the server) is also stored on your device. Uninstalling the app deletes that local copy.
Legal basis. We process the information above to the extent needed to provide the Game you asked for, which is performance of our agreement with you (PIPA Article 15(1)(4)). Personalized advertising depends on your choices, such as the iOS tracking prompt and, where required, the consent form shown by Google.
2. How we use information
- Running the Game: save progress, deliver items and avatars, keep your wallet in sync.
- Leaderboards: show overall rank, per-stage times, and fewest-moves rankings.
- Fair play: our server replays your input log to reject impossible records and unearned rewards.
- Purchases: check your receipt directly with the store, deliver what you bought, and restore purchases.
- Advertising: show ads and grant rewarded-ad rewards.
- Operations: fix errors, keep the service secure, answer support requests, and meet legal obligations.
We do not sell personal information or use it for purposes other than those above. If a purpose changes, we will tell you in advance and ask for consent where required.
3. How long we keep information
- Account, leaderboard profile, play records, wallet: kept until you ask us to delete them or the service ends, then destroyed without delay.
- Server access logs (IP address, etc.): kept for a short period (no more than 90 days) for security and troubleshooting.
- Support messages: kept for 3 years after we answer (consumer complaint records).
The following are kept for the period the law requires, stored separately, even if you ask for deletion:
- Records of payment and supply of goods: 5 years (Act on the Consumer Protection in Electronic Commerce)
- Records of contracts and withdrawal of orders: 5 years (same Act)
- Records of consumer complaints and dispute handling: 3 years (same Act)
- Service access logs: 3 months (Protection of Communications Secrets Act)
How we destroy information: electronic files are erased so they cannot be recovered; paper records are shredded or incinerated.
4. Sharing and service providers
We do not provide or sell personal information to other companies, except:
- Public information: your nickname, avatar, scores, records, and rank are visible to other players on the leaderboards.
- Legal requirements: when the law allows it or an authority requests it through the procedure the law sets.
We use the following providers to run the Game, either by entrusting processing to them or by including their SDK.
| Provider | What they do | Information involved |
|---|---|---|
| Supabase, Inc. (servers in the Seoul region, on Amazon Web Services) | Server, database, anonymous sign-in | Account, leaderboard profile, play records, wallet, purchase records, access logs |
| Google LLC (Google AdMob) | Serving and measuring ads, consent management (UMP) | Advertising ID, IP address, device information, ad interactions, anonymous account ID used to verify rewarded ads |
| Google LLC (Google Play) and Apple Inc. (App Store) | App distribution, payments, refunds | Payment information (collected by the store directly); purchase token or receipt we ask the store to verify |
Google and Apple process information under their own privacy policies: Google, Apple. If our providers change, we will update this policy.
5. International transfers
Game data is stored on servers in Seoul, Korea. Some personal information may be transferred abroad as follows (PIPA Article 28-8).
| Recipient | Country | When and how | Items | Purpose | Retention |
|---|---|---|---|---|---|
| Google LLC contact | United States and other countries where Google operates servers | Over the network each time the app loads an ad | Advertising ID, IP address, device information, ad interactions, anonymous account ID (rewarded ad verification) | Serving and measuring ads; verifying rewarded ads | Per Google's privacy policy |
| Supabase, Inc. privacy@supabase.io | Data stored in Korea (Seoul); may be accessed from abroad for operations and technical support | Over the network while you play | Account, leaderboard, play records, wallet, purchase records, access logs (section 1) | Running our server and database | Same as section 3 |
| Apple Inc., Google LLC | United States | Over the network when we verify a purchase | Purchase token or receipt | Verifying payment | Per each company's policy |
If you do not want your information transferred abroad, you can stop using the Game and ask us to delete your data. Ads and server storage are needed to provide the Game, so it cannot be used without these transfers. To turn off only personalized ads, see section 6.
6. Advertising and advertising IDs
- From stage 16, an interstitial ad may appear when a run ends and a banner ad at the bottom of the screen. Rewarded ads appear only when you choose to watch one. Buying "Remove Ads" removes interstitial and banner ads.
- Google AdMob may use your device's advertising ID to choose and measure ads.
- iOS: on first launch you will see a request to allow tracking. If you do not allow it, IDFA is not used and the Game works the same. You can change this anytime in Settings > Privacy & Security > Tracking.
- Android: you can delete or reset your advertising ID in Settings > Privacy > Ads (or Settings > Google > Ads).
- Where the law requires it (for example the EEA, the UK, and Switzerland), a Google consent form lets you choose whether to allow personalized ads.
- If you turn off personalized ads you will still see ads, but they will be less related to your interests.
- How Google uses ad data: policies.google.com/technologies/ads
7. Cookies and similar technologies
The Game app does not use web cookies. The ad SDK may use the advertising ID described in section 6. This website (game.balf.cloud) does not use cookies, analytics, or tracking tools.
8. Children
The Game is not directed to children under 14, and we do not knowingly collect personal information from children under 14. If we learn that a child under 14 has used the Game without a legal guardian's consent, we will delete that information without delay. A legal guardian can ask to see or delete a child's information using the contact details below. For purchases by minors, see the Terms of Service.
9. Your rights
You (or your legal guardian) can ask us at any time to:
- see the personal information we hold about you;
- correct inaccurate information, including changing your nickname;
- delete it;
- stop processing it or withdraw consent.
Email us at the address below and we will reply with the result within 10 days. Because accounts are anonymous, we may ask for details to confirm the account is yours, such as your nickname, roughly when you last played, and, if you made a purchase, the store order number. Information the law requires us to keep is retained for that period even after a deletion request. We will not treat you differently for exercising these rights.
10. How to request data deletion
You can delete your Yarn Maze (실타래 미로) account and data in either of these ways. You do not need to reinstall the app.
- In the app: Settings > Delete account
- By email: send a message to contact email with the subject "Yarn Maze data deletion request" and include your nickname and roughly when you last played. If you made a purchase, adding the store order number (Google Play: starts with "GPA."; App Store: the order ID on your receipt email) helps us find your account faster.
Deleted: anonymous account, nickname and avatar, leaderboard records, play records, coins and items, owned avatars, ad reward records.
Kept separately for the legal period, then destroyed: payment records (5 years), withdrawal and dispute records (3 to 5 years), access logs (3 months).
- After deletion, remaining coins and items cannot be recovered or refunded.
- Non-consumable purchases such as Remove Ads stay with your store account, so you can get them back with "Restore purchases" after installing again.
- Uninstalling the app only removes data on your device; your data on our server remains until you request deletion.
- We complete requests within 30 days of confirming them.
11. How we protect information
- All communication between the app and our server is encrypted (HTTPS).
- The database uses row-level access control: players can read only their own wallet and purchase records, and records can be written only by server-side verification functions.
- Administrative secret keys are never included in the app and are used only on the server.
- Access to personal information is limited to the operator, and administrative accounts use two-factor authentication.
- Access logs are kept and reviewed regularly.
12. Privacy officer and contact
Privacy officer: Name
Email: contact email
Operator: Operator name
Address: Address
Send any privacy questions, complaints, or requests for help to the contact above.
13. Help with privacy complaints
If you need help with a privacy violation, you can contact these Korean authorities:
- Personal Information Infringement Report Center (KISA): privacy.kisa.or.kr, call 118 in Korea
- Personal Information Dispute Mediation Committee: www.kopico.go.kr, +82-1833-6972
- Supreme Prosecutors' Office: www.spo.go.kr, call 1301 in Korea
- Korean National Police Agency: ecrm.police.go.kr, call 182 in Korea
If you live outside Korea, you may also contact the data protection authority in your country.
14. Changes to this policy
If we change this policy, we will post the update on this page and in the Game at least 7 days before it takes effect, or 30 days before for changes that significantly affect your rights.