Privacy Policy
Greeker Labs LLC ("we", "us") operates the Yunnori (윷놀이) mobile game and the website yunnori.com (the "Service"). We protect your personal information under Korea's Personal Information Protection Act (PIPA), the Network Act and other applicable laws, including the EU/UK GDPR and US state privacy laws where they apply. This policy explains what we process, why, for how long, and how you can exercise your rights.
We are a Wyoming, USA company. Where the Korean and English versions conflict, the Korean version governs. We do not sell personal information.
1. Why we process personal information
We process personal information only for the purposes below. If a purpose changes, we take the steps the law requires, such as asking for new consent.
- Accounts and the Service: creating your anonymous account, optional sign-in linking, managing your username, keeping progress across devices
- Running the game: vs-AI and pass-and-play, online rooms joined by room code, turn handling and server-side move validation, emoji reactions
- Virtual currency and purchases: tracking geon earned and spent, verifying membership purchases, renewals and refunds, applying perks, restoring purchases
- Age-based protection: blocking users under 14, showing only non-personalised ads to users under 18
- Ads: serving banner, interstitial and rewarded ads, with personalised ads only for adults who consent
- Notifications: sending service and event notifications, and marketing notifications only to users who opted in separately
- Safety and security: preventing fraud and abuse, App Check device attestation, handling player reports and blocks
- Improving quality: usage statistics and diagnosing errors and crashes
- Support: answering questions and bug reports, handling rights requests, meeting legal obligations
- Website updates: emailing news to people who signed up on the website
2. What we collect and how
We do not collect your real name, phone number, postal address, precise (GPS) location, contacts, photo library, or microphone or camera data. There is no free-text chat.
| Category | Items | How and when |
|---|---|---|
| Account (required) | Firebase user ID (UID), sign-in method, account creation and last sign-in times | Created automatically on first launch |
| Sign-in linking (optional) | Google, Apple, Game Center (iOS) or Google Play Games (Android) account identifier; the email address and display name the provider sends (Apple lets you hide your email) | When you choose to link |
| Profile (required) | Your unique username (shown to other players in the same room), cosmetics you select | You enter it |
| Age check (required) | Birth year and month and the age band derived from them (stored on your device) | You enter it on first launch |
| Gameplay | Room codes and membership, game state and move history, emoji reactions, online presence, results and daily streaks | Generated as you play |
| Virtual currency and items | Geon balance and earn/spend history, owned cosmetics, mailbox and gifts | Generated as you play |
| Purchases | Subscription product ID, transaction (order) ID, purchase, renewal, expiry and refund times, store receipt verification result. Apple and Google handle card and payment details; we never receive them | Through the app store when you buy |
| Consent records | Accepted Terms and Privacy Policy versions and times; notification consent (service, event, marketing) with opt-in and opt-out times; ad consent status (UMP, ATT) | When you consent or change a choice |
| Notifications | Push token (FCM), app language, device time zone (for night-time sending limits) | When notifications are registered |
| Reports and blocks | User IDs and usernames of the reporting and reported players, report reason, related room and game details, your block list | When you report or block |
| Feedback and bug reports | Your message, an optional screenshot, device model, app version, and your email address if you email us | When you submit |
| Device and security | OS and version, device model, app version, language and region settings, Firebase installation ID, App Check attestation token (App Attest, Play Integrity), IP address of server requests | Automatically while you use the app |
| Analytics and diagnostics | Events such as screen views, game start and end, tutorial progress and ad impressions (Firebase Analytics with consent mode); crash logs and device state (Crashlytics) | Automatically while you use the app |
| Ads | Advertising ID (iOS IDFA only if you allow tracking under ATT; Android advertising ID), ad impressions and clicks, approximate region from IP address | Collected by AdMob (Google) when ads are shown |
| Website updates (optional) | Email address, language, signup source, signup and unsubscribe times | When you sign up on yunnori.com |
3. How long we keep it
We delete personal information without undue delay once its purpose is fulfilled. Retention by category:
| Information | Retention |
|---|---|
| Account, profile, gameplay, virtual currency, consent records and other Service data | Until you delete your account |
| Push tokens | Until the token expires or you delete your account |
| Website update emails | Until you unsubscribe |
| Feedback and bug reports | 1 year after the report is resolved |
When you delete your account, everything is deleted except the items below. Your sign-in account (Firebase Authentication) is deleted too, and if you used Sign in with Apple we revoke its tokens. Games you played with others remain only in a form that no longer identifies you.
| Kept after account deletion | Retention | Reason |
|---|---|---|
| Purchase and transaction records, with personal identifiers removed | 5 years | Korean Act on Consumer Protection in Electronic Commerce, Art. 6 and Enforcement Decree Art. 6 (payment and supply records) |
| A minimal deletion-request log (request and completion times and status only) | 1 year | Proof that the request was handled |
| Player reports (moderation records) | 1 year | Preventing repeat abuse and handling disputes |
| Pseudonymous analytics and crash data held by Google | Expires under Google's retention settings | Service quality |
4. How we destroy personal information
- Process: information whose retention period has ended or whose purpose is fulfilled is destroyed without undue delay. Account deletion requests are completed within 14 days. Information we must keep by law is stored separately and only for that period, then destroyed.
- Method: electronic files are deleted so they cannot be recovered (deleting Firestore documents, Cloud Storage objects and the Firebase Authentication account). Copies in system backups are deleted automatically when the backup retention cycle ends. We keep no personal information on paper.
5. Disclosure to third parties
We do not provide or sell your personal information to third parties, except:
- with your prior consent;
- where a law specifically requires it or it is unavoidable to comply with a legal obligation (for example, a lawful request from law enforcement);
- by the nature of the Service, other players in the same online room see your username, game progress and emoji reactions;
- if you choose to share via KakaoTalk, the room invite link goes to the people you pick.
Apple and Google may process personal information independently, under their own privacy policies, for app store payments and personalised ads.
6. Service providers (processors)
We use the following service providers and require them, by contract, to handle personal information securely.
| Provider | Service |
|---|---|
| Google LLC | Firebase Authentication, Cloud Firestore and Cloud Storage, Cloud Functions and App Hosting servers, Firebase Analytics (GA4), Crashlytics, Cloud Messaging (FCM), App Check, AdMob ad serving and consent management (UMP), Google Play billing and Google Play Games sign-in |
| Apple Inc. | Sign in with Apple, Game Center sign-in, App Store payments and subscription management, App Attest device attestation |
| Cloudflare, Inc. | DNS and network proxy (security and delivery) for yunnori.com |
| Kakao Corp. | KakaoTalk sharing, when you choose to share |
7. International transfers
Cloud Firestore, which stores account and game data, and our game servers (Cloud Functions) are in Seoul, Korea (asia-northeast3). The website server (App Hosting) runs in Taiwan (asia-east1). Personal information is also transferred abroad to the providers below. These transfers are outsourcing and storage needed to perform our contract with you and are disclosed in this policy under PIPA Art. 28-8(1)(iii).
| Recipient (contact) | Country | Items | Purpose | When and how | Retention | How to refuse and what you lose |
|---|---|---|---|---|---|---|
| Google LLC (privacy policy) | USA and other countries with Google data centres | Account identifiers, sign-in data, username, gameplay, virtual currency, purchase and consent records, push tokens, device and app data, analytics and crash data, advertising ID and ad interactions, feedback and reports | Authentication, data storage and servers, analytics and diagnostics, push delivery, abuse prevention, ad serving, Google Play billing and sign-in | Sent over the network whenever you use the app or website | Until the service contract ends or the retention periods in this policy expire | Don’t use the feature, or delete your account. Authentication, storage and servers are essential, so refusing means you cannot use the app. You can refuse personalised ads through Privacy choices or ATT and will see non-personalised ads instead. |
| Apple Inc. (privacy contact) | USA | Apple account identifier, email address if you share it, Game Center player ID, purchase and subscription transactions, App Attest data | Sign in with Apple and Game Center sign-in, App Store payments and subscriptions, device attestation | Sent over the network when you use those features in the iOS app | Until the service contract ends or the retention periods in this policy expire | Nothing is transferred if you don’t use Apple sign-in or Game Center (an anonymous account cannot carry progress across devices). If you don’t buy, you cannot use the membership. |
| Cloudflare, Inc. (privacyquestions@cloudflare.com) | USA and countries in Cloudflare’s network | IP address and request data (URL, browser or app details) when you reach yunnori.com | DNS, network security and delivery | Passes through the network when you reach yunnori.com and our app servers | Deleted under Cloudflare’s retention policy after delivery | Required to reach the website and online features; refusing means you cannot use them (vs-AI and pass-and-play still work offline). |
Kakao Corp. is a Korean company, so KakaoTalk sharing is not an international transfer.
8. Automatic collection tools (cookies and identifiers)
- App: instead of cookies, the app uses on-device storage (settings and progress), the Firebase installation ID and the advertising ID.
- Website: yunnori.com uses no advertising or analytics cookies, only browser features needed for the site to work.
- How to refuse: on iOS, turn off tracking for the app in Settings → Privacy & Security → Tracking; on Android, delete your advertising ID in Settings → Privacy → Ads. In the app, change ad consent in Settings → Privacy choices. You can block cookies in your browser settings.
9. Behavioural information and personalised ads
| Item | Details |
|---|---|
| What is collected | App usage events (screen views, game start and end, etc.), ad impressions and clicks, advertising ID |
| How | Collected automatically by the Firebase Analytics and AdMob SDKs while you use the app |
| Why | Usage statistics, serving and measuring ads, and personalised ads for consenting adults only |
| Retention | Expires under Google's retention settings |
| Recipient | Google LLC (AdMob, Firebase) |
- Personalised ads are shown only to adults who consent. On iOS this requires allowing tracking under App Tracking Transparency; in the EEA, UK and Switzerland it follows your choice in Google’s UMP consent form.
- Users under 18 see only non-personalised ads. We do not collect behavioural information from children under 14.
- How to refuse: Settings → Privacy choices, iOS tracking settings, or deleting your Android advertising ID. The game works the same, with non-personalised ads.
10. Children and minors
- The Service is for players aged 14 and over. On first launch we check age using birth year and month; anyone under 14 cannot enter the game. We do not knowingly collect personal information from children under 14 and delete it without delay if we learn we have.
- Users under 18 see only non-personalised ads.
- Purchases a minor made without a legal guardian’s consent can be cancelled as set out in the Terms of Service.
11. Your rights and how to use them
You can ask at any time to access, correct, delete or suspend processing of your personal information, or to withdraw consent.
| Right | How |
|---|---|
| Access and export | In the app: Profile → Data & Account → Request my data |
| Deletion (delete account) | In the app: Profile → Data & Account → Delete account, or by email as described on the account deletion page (completed within 14 days) |
| Correction | Change your username on the Profile screen; email us for anything else |
| Suspend processing or withdraw consent | Notifications: Settings → Notifications / Ads: Settings → Privacy choices / Website updates: the unsubscribe link in any email or the unsubscribe page |
| Anything else | Email contact@greekerlabs.com |
- A legal guardian or someone you authorise can make requests for you; we may ask for proof of authority, such as a signed authorisation.
- We reply within 10 days of receiving a request (account deletion is completed within 14 days). If the law lets or requires us to refuse or limit a request, we tell you why.
- To confirm it is your account, we may ask for details such as your username and sign-in method.
12. How we keep it secure
- Administrative: access to personal information is limited to the minimum people who need it, and we oversee our service providers and follow internal handling rules.
- Technical: encryption in transit (HTTPS/TLS), encryption at rest in Google Cloud, Firestore security rules that allow server-only writes and restrict reads to you and your room members, App Check device attestation, server-side move validation, strong authentication and access logging for admin accounts.
- Physical: data is stored in physically secured Google Cloud data centres.
13. Marketing messages
- Notifications come in three buckets: service, event and marketing. Marketing push is off by default and is sent only if you opt in separately.
- We never send marketing notifications between 21:00 and 08:00 (your local time).
- Marketing notifications start with (광고) ("Ad") and explain how to opt out.
- We ask you to reconfirm marketing consent every 2 years.
- Withdraw consent anytime in Settings → Notifications; we confirm the date and result when you opt in or out.
- Every website update email includes an unsubscribe link.
14. Privacy officer and domestic agent
| Role | Details |
|---|---|
| Privacy officer | PDO, Greeker Labs LLC |
| Contact | contact@greekerlabs.com |
| Korean domestic agent | Not designated. We are below the thresholds (revenue, number of users in Korea, etc.) that require one under PIPA Art. 31-2. |
Send privacy questions, complaints and requests for redress to the contact above. We will answer and act without undue delay.
15. Remedies
In Korea you can also ask these bodies for dispute mediation or advice:
- Personal Information Dispute Mediation Committee: 1833-6972, www.kopico.go.kr
- KISA Privacy Infringement Report Center: 118, privacy.kisa.or.kr
- Supreme Prosecutors’ Office: 1301, www.spo.go.kr
- Korean National Police Agency: 182, ecrm.police.go.kr
16. Users in the EEA, UK and Switzerland
The controller is Greeker Labs LLC. Our legal bases are:
| Legal basis (GDPR Art. 6) | Processing |
|---|---|
| Contract (b) | Accounts, running the game, virtual currency, subscriptions, support |
| Legitimate interests (f) | Security and abuse prevention (App Check), crash diagnostics, handling reports and blocks |
| Consent (a) | Personalised ads, analytics where consent is required, marketing notifications, website updates |
| Legal obligation (c) | Keeping transaction records and other legal duties |
- You have the right to access, rectify, erase, restrict, port and object, and to withdraw consent, using the in-app tools or contact@greekerlabs.com. Withdrawing consent does not affect processing before you withdrew.
- You can complain to the supervisory authority where you live.
- We have not designated an EU or UK representative under GDPR Art. 27; please contact us by email.
- International transfers rely on lawful mechanisms our providers offer, such as the EU adequacy decision for Korea, the EU-US Data Privacy Framework, or Standard Contractual Clauses.
- In the EEA, UK and Switzerland the app shows Google’s UMP consent form; change your choice anytime in Settings → Privacy choices.
17. Notice for US state residents
- Categories collected: identifiers (account ID, username, email and advertising IDs), commercial information (subscription transactions), internet or network activity (app usage events, IP address), and approximate region from IP address. We do not collect sensitive personal information. Sources, purposes and retention are described in sections 2, 1 and 3.
- Sale and sharing: we do not sell personal information for money. Personalised ads shown to consenting adults may count as "sharing" or "targeted advertising" under some state laws. We do not sell or share personal information of consumers under 16 (users under 18 see only non-personalised ads).
- Your rights: to know and access, delete, correct, and port your data, and to opt out of sale, sharing and targeted advertising, without discrimination. Opt out of targeted ads through Settings → Privacy choices, iOS tracking settings or deleting your Android advertising ID; send other requests to contact@greekerlabs.com. We respond within 45 days. To appeal a decision, reply to the same address with "Appeal" in the subject.
18. Changes to this policy
If we change this policy, we announce the changes and the effective date in the app and on this page at least 7 days in advance, or 30 days in advance for changes that materially affect your rights. Earlier versions are available by email.
This policy is effective from 2026-09-15.