Airony Company Inc. (the “Company”, “we”) provides the BLOCROWN service and complies with the Korean Personal Information Protection Act (PIPA). This policy is based on the items our server actually stores. The Service does not collect your device's contacts, whole photo library or phone number. It reads the device's location only when you turn on a GPS feature (Start from my location, GPS Trial), and only while the Service is on screen. Real coordinates (latitude/longitude) never leave the device and are not stored (item 5). The Service does not give or show your location to other people. Items marked “(where offered)” are processed only after that feature has been opened in the Service.
| Category | Items | Purpose | Legal basis |
|---|---|---|---|
| Sign-up (required) | Email, display name (nickname · picked automatically when you sign up with an email code, and you can change it), country (pre-filled from your device’s language and time zone settings and confirmed by you), language, confirmation of eligible sign-up age, the versions of the Terms and Policy you agreed to and when (including when you agreed again) | Identifying members, login, notices, confirming consent to changes in the Terms | Performance of contract (PIPA Art. 15(1)(4)) |
| Brand account (where offered) | Business email, brand name, official domain, confirmation that you are 19 or older and authorized to represent the brand, and when, the DNS value for domain verification, the administrator's review result | Verifying the brand and its official domain, preparing a virtual brand storefront | Performance of contract |
| Password (optional) | Password — only if you create one, stored only as an irreversible hash (required if you sign up with a password until 2026-10-08) | Signing in with a password instead of an email code | Performance of contract |
| Email verification · sign-in codes · creating and recovering a password · confirming account deletion | Email, verification code (kept as a hash for 10 minutes, then deleted), sign-up check value (only for a new email whose code was entered correctly · kept as a hash for 30 minutes · deleted as soon as sign-up is complete), sign-up device check value (kept as a hash for 24 hours · deleted as soon as verification is complete) | Verifying your identity | Performance of contract |
| Sign-in alerts (from 2026-10-09) | Email, sign-in time, device type (app or web browser and operating system name — read from the connection at that moment only, not stored) | Telling you about new sign-ins so you can quickly notice misuse of your account (up to 5 a day · no IP address or location · a security alert you cannot turn off, separate from marketing email consent) | Performance of contract · legitimate interest (account protection) |
| Phone verification (where required) | Mobile phone number — only a pseudonymized value (HMAC) is stored on the server. The key used for the calculation is kept separately from the database. The number itself is used only to send the verification text and is not kept. | One account per number (preventing duplicate accounts) | Performance of contract · fraud prevention |
| Find email (where offered) | The nickname (ID) you enter — not stored; a hashed value of the requesting network's IP address and the number of requests that day | Showing a member who forgot their sign-up email a partly hidden version of it (only the first two and last one characters, and the first two characters of the domain), preventing abuse | Performance of contract · legitimate interest (preventing abuse of the service) |
| Staying logged in | Session token (hash), expiry time, whether “Keep me logged in” was chosen, time of last use (extension), time of first login | Keeping you logged in (an essential cookie on the web; a token stored on the device in the apps). With “Keep me logged in” on, you do not need to log in again for 90 days from your last use (up to 1 year after first login); with it off, the session ends when you close the browser or app (after 1 day on the server). | Performance of contract |
| Phone QR login (where offered) | QR number, a check value only the web page knows (irreversible hash), 6-character code, the type of web browser and operating system (e.g. “Chrome · macOS” — read on the spot from the connection; no version, IP or location), the scanning member’s ID, the “Keep me logged in” choice, created/expiry time — kept only in server memory, not stored (QR valid 2 minutes; deleted within 1 minute after use or expiry) | Log in on a computer by approving in the already-logged-in app; prevent wrong approvals (first scanning account only, single use, app-only approval); show which browser is asking so members can spot a QR shown by someone else | Performance of contract · legitimate interest (account protection) |
| Friend referrals (where offered) | Referral link number and when it was created and expires (referring member); the link between a member who signed up with that link and the referring member, when it was made and its result; the dates (dates only, no times) on which the new member used the service | Deciding referral rewards (new account · not a self-referral · 48 hours after sign-up · 2 different days of use), the monthly reward limit, preventing fraudulent referrals | Performance of contract · legitimate interest (preventing misuse) |
| Sign-up event Points (where offered) | Grant time and amount (points ledger), a hash of the normalized email and a hash of a random mark created on the device | One grant per person; preventing repeat grants by re-registering after leaving | Performance of contract · legitimate interest (preventing misuse) |
| Game records (members) | Titles, emblems, name colors and purchased outfits, level and experience, ranking records, earlier climb records and badges (no longer added to), block list, reports you filed (type, reason, outcome) | Providing the game, rankings, handling reports | Performance of contract |
| Building operation (members) | Operating records: building, how it was acquired (arriving at the entrance · first hideout chosen on the map), the entrance spot confirmed by the server (in-game coordinates), the Owner's last visit time, the Owner's last update time, end of the operating period and end of the grace period, status, release and reopening times, reasons for a return or an operational action Also: records confirming Owner visits (how long the building was kept open), records of choosing and moving the first hideout, records of scheduled and sent operating notices, Points ledger (changes, reason, time), takeover listing applications (order number, result), upkeep bills and payment records under the previous policy (kept only), stage progress Building renames: the new name and the original name, who changed it and when, records of the name ending with the operating period or being changed back to the original name by our operations team (previous and new name, time, reason), and the number of attempts per day (to prevent abuse) | Calculating the operating period (visits and updates), deadline and grace period notices, release and reopening, the first hideout's 1 year, fair order for takeover listings, renaming a building (once per operating period) and changing impersonating or offensive names back | Performance of contract · fraud prevention |
| Decoration archive (members) | One set of decorations kept when a first hideout ends: building, end time and reason, a copy of the facade decoration settings, the IDs of content that was public at the time, a copy of the building settings (category, subtopic, tags, visibility, guestbook open or closed, featured content), the result of bringing them over (building applied to, time, summary) and request ID | Bringing decorations over to a new first hideout | Performance of contract |
| Rooftop decorating (members) | Rooftop prop layout (type, position, direction, color), personal sign text (up to 12 characters), prop storage records, blueprints, archived layouts from past operating periods | Saving and loading decorations, returning props and providing blueprints after operation ends | Performance of contract |
| Visits · one-line guestbook · stickers (members) | Your building visibility setting (Public / Block Meeting only / Only me · accept new entries), one-line guestbook entries you left (text up to 80 characters, created and edited times, edit count, estimated language of the text, and for a follow-up greeting, which entry it follows) and stickers, the Owner's replies, reports you filed (reason, note, a copy at the time of the report), entries you hid, visit records (building visited, date, path · once a day), request IDs | Providing visits and the guestbook, one more greeting on an entry the Owner replied to (follow-up · within 7 days of the reply · once per entry · where offered), preventing spam and the exchange of contact details, reports, blocking and operational actions, visit metrics (no rewards) | Performance of contract · legitimate interests (preventing abuse) |
| Post comments · likes (members · where offered) | Comments you write (text up to 300 characters, created and edited times, edit count, estimated language, which post the comment is on), the post owner's replies, posts you liked and when you liked them, comment reports you filed (reason, note, a copy of the text at the time of the report) | Showing, editing and deleting comments, collecting the posts you liked (visible only to you), in-app notifications to the post owner (comments, replies, likes — like notifications do not say who liked or how many), handling reports and preventing spam | Performance of contract · legitimate interests (running a safe community) |
| Open plazas (members · where offered) | Plaza posts you left (which plaza, text up to 200 characters, up to 1 photo (the photo ID from your photo library), time posted, estimated language, whether replies are turned off), plaza replies you wrote (text up to 80 characters, time, estimated language), replies you hid on your posts, posts you tapped a heart on and when, posts and replies you hid for yourself, plaza reports you filed (reason, a copy of the text at the time of the report, a hashed value of the IP address of the network you reported from), a fingerprint (hash) of the text to prevent the same post being repeated, request IDs · when non-members read plazas we collect no new personal information, and only count IP addresses briefly in server memory to prevent excessive requests (not stored) Plaza post categories: the category chosen for each post · for member-made categories, the name, the creator’s member number and creation time · category reports (reason and a hash of the reporting network’s IP). On account deletion the creator’s member number is replaced with an anonymous number and the category name stays as a plaza label. Handled category reports are deleted after 3 years. | Showing and deleting plaza posts and replies, showing the posts you hearted (only to you), in-app notifications about replies to your posts, checking limits and preventing spam, repeated posts and the exchange of contact details, handling reports (checking that reports come from different people) and operational actions, “This week's plaza” notices | Performance of contract · legitimate interests (running a safe community · preventing abuse) |
| Plaza Hall position (members · where offered) | The plaza entered; in-game coordinates, facing and emote within that space; time of last update — not a real-world location · kept only in server memory and not stored | Showing your character to people in the same Plaza Hall, managing capacity | Performance of contract |
| Plaza Chat (members · where offered) | Message text (100 characters), time sent, display name — kept only in server memory and not stored | Talking with people in the Plaza Hall, preventing spam and the exchange of contact details (rate limits · blocking repeated messages) | Performance of contract · legitimate interests (running a safe community) |
| Plaza Chat reports | Reporter’s member number, reason, copy of the reported message, sender’s member number, outcome | Handling reports (a message is hidden from everyone once three different people report it) and operational actions | Legitimate interests (running a safe community) |
| Plaza Hall moderation | Member number, entry block or chat mute, period, reason, handling operator | Restricting the Plaza Hall use of members who violate the Terms, and recording it | Legitimate interests (running a safe community) |
| Random Pen Pal (members · optional · where offered) | Random Pen Pal on/off, “pen pal city” (an in-game city ID, not a real location; defaults to the city of the first building you held), the “receive new letters” setting / letters (text up to 500 characters, estimated language, sender and recipient member IDs, origin and destination cities, delivery item, price, sent/arrival/read times, status) / letter threads (the two member IDs, ended time) / reports (reason, note, copy of the letter, the translation the reporter was viewing) / moderation records (reasons) / age-group result (whether you are 18 or older — only the result calculated from birth year/month: 14–17 or 18+) and when it was checked (the same record as the age check for GPS features; birth year/month are not stored) / delivery item counts (per item) · delivery item packs (item, size, remaining, points spent, purchase time, cancellation time, points returned) · purchase, use, cancellation and operator adjustment records (item, count, points, pack number, letter ID used on, time, adjustment reason) / Throw to the sky (direction, angle, power · distance set by the server · start-point type (character position/pen-pal city) — the start-point coordinates are not stored) · in-game spot of street letters (game city, game coordinates, wandering route — not a real location), landing and pick-up times · the list of street letters you hid · street letter reports (copy of the letter) | Delivering letters (random recipient selection, counting recent letters so one person is not flooded), connecting only members of the same age group (protecting minors), preventing abuse (daily limits, repeated text), handling reports and restrictions, dispute handling, showing arrival times before sending, crediting and using paid delivery item packs, cancelling a pack within 7 days (returning points) and handling inquiries. Recipient selection: chosen among members in the same age group as the sender (14–17, or 18+) who set that city as their pen pal city and accept new letters, excluding members who have blocked each other or already exchanged letters, preferring those who received fewer letters in the last 7 days, then at random (an automated decision with no legal or similarly significant effect). Notifications: Letter arrived, reply arrived and returned notices go only to the in-app inbox (no phone push or e-mail). Throw to the sky: letters are placed on the street so that only members of the same age group as the sender can see and pick them up, and the first member to pick one up becomes the recipient. The pick-up check uses only the in-game character position known to the server (game coordinates · from the last 2 minutes) and does not store it. Landed and picked-up notices also go only to the in-app inbox. | Performance of contract (when you turn it on) · legitimate interests (protecting minors · preventing abuse) |
| Faith buildings (members · where offered) | Lanterns/candles: member ID, wish text (60 characters), colour, visibility, building, date and time, whether free, distress-word flag, hidden flag, reports (reporting member ID, reason) / Recorded messages (Owners): audio file (device, location and other metadata removed), length, title, building, upload time, status, reports (reporting member ID, reason) / Faith building verification requests (Owners): organization name, official list URL, note, decision and reason / Owner settings: mood, centerpiece style, colours, decorations, number of seats, interior style, background music (ID of a track from the Company's list (open-source recordings and tracks provided by the Company) or YouTube video ID and title), service times / Game coordinates, seat, gestures and one-line chat inside the Faith Space (server memory only · not stored) | Hanging wishes, checking the daily free allowance, applying visibility and handling reports; showing members who write about distress where to get help; providing recorded messages and handling reports; verifying faith buildings; showing who is there together. Religious information (sensitive information): the Company does not record or analyse which faith buildings a member enters or how often (not even in operating logs), and does not use this for recommendations, feeds, profiles or advertising (Personal Information Protection Act, Article 23). Wishes are shown without names by default; the display name is shown only if the member chooses “public”. Holding operating rights for a faith building is handled like operating any other building; the Company does not classify or use it separately as religious information. | Performance of contract (when members use it themselves) · legitimate interests (handling reports, preventing abuse) |
| School buildings (members · where offered) | Classroom settings (Owners): member ID, building, decoration values, number of seats, timetable (day, period, times, subject, YouTube video ID, live flag), time of change / Lecture and timetable reports: reporting member ID, building, video ID or timetable slot, reason, time / Operator action log (target, action, reason) / In-classroom game coordinates, seat, gestures and one-line chat (server memory only · not stored) | Providing classroom decoration, timetables and blackboard lectures; handling reports and operator actions; showing who is there together. We do not record which Classrooms anyone entered. | Performance of contract · legitimate interests (protecting young people, handling reports) |
| Cinema buildings (members · where offered) | Cinema programme (Owners): member ID, building, number of halls, each hall's seats and screening mode, playlist (title, YouTube video ID, length, taken-down flag), screening timetable (title, video ID, live flag, time, length, weekdays or date), chat on/off, loop clock start, time of change / Video reports: reporting member ID, building, video ID, reason, time / Operator action log (target, action, reason) / In-hall game coordinates, seat, gestures, popcorn throws and one-line chat (server memory only · not stored) | Providing the Cinema programme and screenings; handling reports and operator actions; showing who is there together. We do not record which Cinema or hall anyone entered or which seat they took. | Performance of contract · legitimate interests (protecting young people, handling reports) |
| Campgrounds and the campfire (members · where offered) | Log additions (member ID, campground, time, 3-minute window) / Fire item use (member ID, campground, item, price, effect time, request number · the item ID is also written to the operating log) / Audio files uploaded by operators (uploader ID) / Position, gestures, carrying a log, sitting or lying on the ground, presence and chat in the campfire (server memory only · not stored) / Sound off and track choice (on the user's device only) | Enforcing up to three logs per person per 3 minutes (pick-up and adding) and computing the fire size; showing fire effects, applying daily limits, preventing double charging and handling inquiries; playing campground music; showing who is there together (adding a log or using a fire item is announced in the campfire with the display name). We do not record which campground you entered in operating logs and do not use it for recommendations or profiles. | Performance of contract · legitimate interests (preventing abuse) |
| Ranking Room (members · where offered) | Name, one-line description, period and first entries of boards members create and the creating member’s identifier; entry names and one-line reasons members suggest; ranking request board names and one-liners; time of posting; the posting member’s identifier; time a suggested entry first reached the top 3 (discovery badge) / Hearts: entry number, member identifier, time (to compute rankings and tie order) / Ranking records: board and entry numbers with hourly ranks (to show rank changes · no personal data) / Reports: reporter identifier, reason, copy of the content at the time | Showing ranking boards and requests, computing heart rankings and rank changes, showing finders and board makers (display names), handling reports | Performance of contract |
| PC café member works links (members · where offered) | The title, short description, category and external link address a member enters, the thumbnail photo the member chooses, time submitted and approved, approval status and reason for rejection, the writing member's identifier / Open records: work number, member identifier, time (to calculate popularity rankings · counts are not shown) / Reports: the reporter's identifier, reason, a copy of the content at that time | Reviewing submissions and notifying approval results, showing works on PC café monitors and lists, popularity rankings, handling reports | Performance of contract |
| Data Center member links (members · where offered) | The name, one-line description, category and external link address a member enters, time added, the writing member's identifier / Likes: item number, member identifier, time (to calculate popularity rankings · counts are not shown) / Reports: the reporter's identifier, reason, a copy of the content at that time | Showing the Data Center lists, likes and popularity rankings, handling reports | Performance of contract |
| Member memorial links in the Memorial hall (members · where offered) | The name, one-line message and external link address a member enters, time registered, the writing member's identifier / Reports: the reporter's identifier, reason, a copy of the content at that time | Showing the “Remembered by members” list in the Memorial hall, handling reports | Performance of contract |
| Expo meeting alert emails (members · where offered · can be turned off) | Email, booth name and slot (link to open it), number of emails sent for the same booth that day (not linked to members · deleted after two days) | service notifications (Expo meeting requests and replies; members can turn them off) — only to members with no device that receives app notifications · up to 5 emails per booth per day · the requesting member's name and note are never included · turn off “Also email expo alerts” in Settings › Notifications | Performance of contract |
| Same Sunset stamps (members · where offered) | “Today's sunset stamp” records (member ID · type (sunset) · date · the in-game city where you watched the sunset · time received · not your real location (GPS)) | Checking one stamp per day, showing your sunset calendar (last 60 days) (no Points · not shown to other members) | Performance of contract |
| Tonight's line (members · where offered) | Tonight's line (a post of up to 40 characters · the city it was written in (an in-game city) · time written · language) · 🫶 taps by other members (who tapped is not shown, not even to the writer) / The in-game position of tonight's line (blurred) — the «in-game character position» the server remembered when the line was written (in-game city + in-game coordinates · not real GPS or a real address), rounded to a 75 m cell and shifted by up to ±15 m before storage / Reports on tonight's lines (report reason · copy of the reported post) | Sharing short posts within a city at night · showing them as lanterns in the sky of the 3D street view of members within 1 km of that position (the server picks only lines within 1 km of the viewer's in-game position · no list of posts from other neighborhoods is provided) · user protection and operations (handling reports) | Performance of contract · legitimate interests (user protection, handling reports) |
| Fan club halls (members · where offered) | Running a hall (Owners): member ID, building, hall name, intro, theme colour, cover photo ID, settings for capacity, seats, walls, floor, screen layout, chat, dancing, screen, music (YouTube video ID) and publishing mode, times turned on/changed / Photo wall: member ID, photo ID (photo library), hall, rights confirmation, automatic check result, status (live, pending, hidden, removed) and who set it, upload date / Photo reports: reporting member ID, photo, reason, time / Hall blocks: blocked member ID, hall, block reason (written by the Owner), who blocked, time / Moderation log: who acted (Owner/operator), target (photo ID, masked member key), action, reason, time / Position, gestures, one-line chat and today's visitor count in the hall (server memory only · not stored) | Running Fan club halls; publishing, checking and handling reports on photo-wall photos; blocks; moderation; showing who is there together. We do not record which Fan club halls a member entered or how often, and do not use this for recommendations or ads. Owners never see other members' IDs. | Performance of contract · legitimate interests (responding to rights infringement, handling reports) |
| Custom outfits (members · paid · where offered) | Garment images front/back (photo IDs in your photo library · reduced on the device to a 1600px-long-side JPEG and uploaded without location tags), the character to wear it, outfit name (20 characters) and notes (200 characters), request status and processing history (submitted, in review, in production, done, rejected, cancelled · operator and reason), Points ledger references for payment and refunds, the resulting 3D file and preview, rights reports (reporting member ID, outfit, reason, time) | Reviewing, producing and delivering Custom outfits (so that only that member's character can wear them), returning points on rejection, failure or cancellation, handling rights reports and inquiries — processing abroad for production is described in section 4 | Performance of contract (a paid item the member requested) |
| Meetup places and place chat rooms (members · verified 18 and over · where offered) | Meetups (creator · place: city, building ID, one point in game coordinates and radius · name · description · start and end times · capacity · pinned notice · status) · participation records (joined or not, time · chat notifications off) · place chat messages (text, time, hidden flag) · notification interval records (meetup, member, last notification time) · copies for meetup chat reports (the chosen message and the 3 before it) — real locations and members' game-coordinate history are not collected (whether someone is at the place is calculated in server memory at the time) | Creating, joining and counting meetups · place chat rooms · notifying members at that place of new messages (in-app and, if allowed, device notifications) · checking age 18 and over (the same check result as the GPS features) · preventing harassment and spam · handling reports | Performance of contract · legitimate interests (protecting minors, handling reports) |
| Building finder (schools, cinemas, campgrounds, Fan club halls, faith buildings) | Map-centre coordinates (3 decimals) and search text (used only for the response · not stored) / Popularity: only the number of people who visited each building that day (Korea time) (who visited is not stored; same-day duplicates are checked only with single-use keys in server memory) | Lists sorted by distance or popularity (people inside now → visitors this week → distance) | Legitimate interests (providing the service) |
| Featured content (members) | Your building's category, subtopic and tags, content (title, text, photos, video IDs, etc.) and its estimated language, photos (re-created in the app as JPEGs of up to 1600px with location and device information (EXIF) removed, and stripped once more by the server · whether you confirmed your rights), draft/public/archived status and times, archive, saved buildings, reports you filed | Creating and publishing content and showing it to visitors, automatic checks of photos for explicit content (on our server · nothing sent outside), the discovery list, reports and operational actions | Performance of contract · legitimate interests (preventing abuse) |
| Account photo library · photo albums (members · where offered) | Photos you upload (resized in the app to a long side of up to 2048px or 3072px depending on the quality you choose, then re-created by the server as three JPEGs — large, screen size (1024px) and small (384px) — with location and device information (EXIF) removed), each photo's dimensions, size, quality choice, upload time and rights confirmation, an input fingerprint used to avoid storing the same photo twice (compared only within your own account), upload batch and job status and request IDs, upload attempt records (for rate limits), trash status and time, where the photo is used, and album titles, text, tags, photo captions, order and cover | Keeping photos and reusing them in several posts, creating and publishing multi-photo albums, album search, managing account storage (200 photos · 200MB), avoiding duplicate copies, automatic explicit-image checks (on our servers · nothing sent outside), preventing excessive uploads | Performance of contract · legitimate interests (preventing abuse) |
| Profile photo (members · optional) | One photo you choose from your own photo library (cropped square and reduced to 256px or smaller; location and device data (EXIF) removed), and the time you set it | Showing your photo on your profile (shown to other members if your profile is public · not shown if it is private, blocked or restricted), automatic explicit-image check (on our servers · nothing sent outside) | Consent (you choose it yourself) · performance of contract |
| AI office (members · optional) | Office designation (building, office name, project name, goal, attending staff, teams, chosen characters), task text (deleted as soon as the task ends · 7 days at most), progress step, assigned staff and a one-line note (120 characters), a one-line completion summary (120 characters) and completion time, a hash of the runner token and the runner’s last contact time, connected-device information (the device name you choose · OS type · runner version · readiness check results (true/false values such as installed, logged in and work folder writable, and the Node.js major version) · connect and last-contact times · a hash of each device’s token), in-progress connection information (hashes of the connection code and the device secret · confirmation phrase · request time · number of attempts · the encrypted token envelope), the number of attempts at confirming the last four characters of the connection code (the code is valid for 10 minutes · discarded after 5 wrong tries), the “Agree and connect” consent record (version of the runner consent text you agreed to in the app · time of consent), trusted-device information (a hash of the runner secret · time trust began · time trust ends · time and reason trust ended · device name, OS type, runner version and last contact time are the connected-device information above), and office–device binding records (office · device · method · time) · the computer name, user name, file paths and task results are not received, and the IP address is used only in server memory to limit connection attempts and is not stored · results (files and text) stay only in the runner’s work folder on the Member’s device and are not stored by the Company · the runner runs on the Member’s own device with the Member’s own Claude (Anthropic) subscription | Providing the AI office feature (making the building private, staff, teams, progress display, completion notice) · connecting your computer and managing connected devices (new-device notice · disconnect) · a check that prevents connecting to the wrong account or device (consent in the app · entering the last four characters of the code on the computer · an in-app notice as soon as a device connects · no confirmation code is emailed) · one-click connection of trusted devices · preventing unauthorized connections (rate limits · notices · audit records) | Performance of contract (designated by the Member) |
| Block Meeting (members) | Circle name and tag, members and roles (chair), visibility settings, join requests (request time · expire after 7 days), announcements (text, author, time), Block Meeting summons (venue building, entrance spot, start and end, each member's attendance and response time, in-game position just before the summon (city, in-game coordinates), time moved, result of and reason for the return) | Running the Circle, delivering announcements, moving members to the summoned building and returning them to their original spot after 24 hours | Performance of contract |
| Friends · regulars · profile (where offered) | Public profile (public ID, intro up to 80 characters, 3 interests, featured building, public or not · public by default for members who sign up from 2026-10-05, and you can switch it to private at any time in settings · members who signed up earlier keep their existing setting), friend relationships (who added which member as a friend, status), channel subscriptions (subscribed buildings and time · visible only to you), wished buildings (building number, name and time wished · visible only to you · to provide the service (getting it later in one tap) · deleted when you remove the wish, get that building, or withdraw), likes, bookmarks, update notification settings, read markers, your device's time zone name (e.g. Asia/Seoul — sent by a logged-in member's app when it loads friends, regulars and profile) · when non-members read the World Rooftop feed we collect no new personal information, and only count IP addresses in server memory for 10 minutes to prevent excessive requests (not stored) | Delivering updates from friends' buildings and subscribed channels, viewing profiles, World Rooftop feed, grouping a day's updates and working out quiet hours for device notifications in your time zone | Performance of contract |
| Chat (where offered) | Chat requests (sending and receiving accounts, time, status), chat messages (text, time, read, estimated language), chat settings (accept requests, show read status), chat reports (a copy of the reported message and the messages around it). No real location is stored in chats. | One-to-one chat between members, preventing harassment and spam, handling reports | Performance of contract · legitimate interests |
| External account connection (where offered) | The connected service (YouTube, Instagram, Threads, etc.) and your account ID there, access token (AES-256-GCM encrypted), the address of the connected original post and permitted information (title, thumbnail, etc.) | Showing your original posts from other social networks in your building | Consent (when connecting) |
| Starting city | The starting city ID you chose and the in-game starting point within it (in-game coordinates · not your real location), how it was set (from device settings · chosen with “Find start location” · invitation link), when it was first recorded and changed · replaced by your first hideout's spot once you choose one — your device's language and time zone settings and your “Find start location” search text are used only on your device (item 5) | Choosing the city where you start the game, continuing from the same place on another device | Performance of contract |
| In-game location (virtual) | The in-game city where your character is (with the reason and time it changed · including the first hideout, returns home and Block Meeting summons), records of moves between cities (type, departure and arrival city, Points spent, status, time) — this is a virtual location in the game, not your device's real location (GPS), and is a record of your use of the Service. While GPS Trial is on, the in-game location follows your real location, and your character is hidden from everyone, friends included (item 5). | Keeping and moving your character (region borders, flights, domestic travel), continuing on another device, confirming arrival for acquiring or taking over buildings | Performance of contract |
| Auto travel (in-game trips) | In-game city IDs of departure and arrival, the mode, in-game times, fare and refund of each leg, and the in-game position where a trip stopped (city ID · in-game coordinates) — not your real location (GPS) In-game coordinates of the arrival point you picked with the pin · the route shape drawn on the map (in-game coordinates · not your real location (GPS)) | Settling travel fares and finalizing your character's position | Legitimate interests |
| GPS features (optional · 18 and over) | Age check result (18 or over) and time · records of consent to and withdrawal from location information collection and use (version, time) · the last in-app position just before GPS Trial is turned on (game area number and game coordinates — not real coordinates — kept on the server until the trial ends) · records confirming collection and use of location information (member ID, time, path (iOS, Android, web), on/off — no coordinates or area numbers) — year and month of birth and real coordinates (latitude, longitude, accuracy, time) are not collected | Start from my location · make your character walk in the game as you really walk so that buildings can be acquired · return your character to the last in-app position when the trial ends · restricting use under 18 · age limit for creating and joining meetups and for place chat rooms (using the same check result) · keeping the records required by the Location Information Act | Consent (Location Information Act · PIPA Art. 15(1)1) · legal obligation (Location Information Act Art. 16(2)) |
| In-app notifications | Notification type, related building or plaza, read status, time, notification settings by category (including how often you get plaza notices) | Operating deadline and grace period notices, guestbook, Block Meeting and chat updates, and post comment, reply and like updates (where offered · comment notifications do not include who wrote the comment, and like notifications are grouped into one line a day without saying who liked or how many), plaza reply updates and “This week's plaza” notices (where offered · notices go once a week by default to members who have logged in within the last 7 days · you can reduce them to once every 2 weeks or turn them off in settings). Notifications are delivered through the in-app notification inbox and notices shown when you log in. Operating deadline and grace period notices are not sent by email or device notification (push). Plaza notifications are not sent by email or device notification (push) either. Replies and comments, friends' and regulars' updates, chat and the like summary are also sent as device notifications only if you allow device notifications in the app (see “Device notifications” below). However, “new sign-in” alerts that protect your account are sent by email (from 2026-10-09). Expo meeting requests and replies are also sent by email to members with no device that receives app notifications (from 2026-11-08 · can be turned off in Settings › Notifications). | Performance of contract |
| Device notifications (push · apps · where offered · only if you allow them) | Device notification token (a value Google Firebase issues for each device), device type (iOS, Android), registration and last-checked times, a check value for the login session that registered it (hash), notification settings by category (replies and comments · friends' and regulars' updates · chat · like summary), records of notifications sent (type, decision, time — no message text) | Notifying your device of replies, one-line entries and comments on your posts and guestbook, friends' and regulars' updates, chat requests and messages, and a once-a-day like summary. Notification text never includes other members' names, profiles, posts or chat content, and like notifications do not say who liked or how many. Between 10 p.m. and 8 a.m. only chat notifications are sent. Operating deadline and grace period notices are not sent as device notifications. | Consent (allowing the device permission) · can be withdrawn at any time |
| Server translation (optional · only when tapped · where we have set up a translation service) | The text of the one entry you tapped “Translate” on and the target language (the author's name and account information are not sent), the translation result (cached for the same entry and language) | Reading entries written in another language · reading Random Pen Pal letters you received (only the one letter the recipient taps “Translate” on · the sender’s name and account details are not sent · the result is cached while the letter remains) | Performance of contract (only on request) |
| On-device translation (apps · where offered) | We do not receive the text being translated or the translation (only entries you tap “Translate with Google” on are translated, on the user's device; translation models are downloaded to the device once per language, and settings, models and translations are stored only on the device — section 7). However, if you were viewing a translation of an entry when you report it, that translation (up to 1,200 characters) is stored with the report copy. | For reference when handling reports (decisions are based on the original text) | Legitimate interests (running a safe community) |
| Paid purchases (where offered) | Store transaction ID, product, amount, purchase time, payment environment (production/test), status (delivered/refunded), Points ledger (free, bonus and paid portions and their validity), former Credit ledger, passes | Delivering Points, handling withdrawals, refunds and disputes | Performance of contract, record-keeping obligation under the E-Commerce Act |
| Fortune house (Myeongridang) paid readings and gift building (members) | Paid-reading purchase records (item · amount (P) · purchase time · request ID · Points-ledger reason “saju_reading”), gift-building records (wealth tier (1–4) · country code · the building received (city, building ID, name, height, height band · whether it was picked from one band lower) · operating record ID · time received · request ID) · your date of birth, time of birth, place of birth and name are calculated only on your device and are not sent to the server (the same applies to the saju result, reading text and compatibility partner’s details · they are stored on that device only if you turn on “Remember on this device”, and deleted when you turn it off) · the server keeps only paid-reading purchase records (item, amount, time) and gift-building records (tier, country, building) | Providing paid readings and preventing duplicate purchases of the same item · checking eligibility for and granting the gift (at least one paid reading · once per account) · checking for misuse (audit records) | Performance of contract |
| Facade ad orders (Republic of Korea members) | Advertiser: order details (building, wall, period), payment amount and VAT, payment method, deposit confirmation code, time you confirmed you are 19 or older and authorized to pay, ad photo, video, text and notes, order status and times, operations notes. For refunds, the refund bank account received by email. Owner of the building carrying the ad: ad share settlement records | Taking ad orders, confirming deposits, reviewing, posting and settling; withdrawals and refunds; handling disputes | Performance of contract, record-keeping obligation under the E-Commerce Act |
| Online presence display | Display name, in-game (virtual) position and direction, character look — kept only in server memory, not stored | Showing your character to players nearby | Performance of contract |
| Members on the full map (where offered) | Display name, in-game character spot (a point on the game map rounded to about 10 m · not your real location · kept only in server memory, not stored), the “Show my character on the full map” setting (on/off, time changed) | Showing your character spot to other members who open the full map, choosing whether to be shown | Performance of contract |
| Operational logs | Member ID, activity type (sign-up, verification, purchase, agreeing again to the Terms, etc.), time, administrator action logs | Security, fraud prevention, handling inquiries | Legitimate interests, legal obligation to ensure security |
| Brand storefront entries and returns (where offered) | Storefront ID, entry and return times, how it was opened, visitor (member ID · for non-members, a value pseudonymized with a secret key created fresh each day) | Counting each visit once, giving brands entry and return counts (numbers only) | Performance of contract, legitimate interests |
| Facade ad views | Ad ID, date and time, member ID (for non-members, a value that pseudonymizes the IP address and device information with a secret key created fresh each day), reward status | Deciding the once-a-day reward, providing click counts (totals only) | Performance of contract, legitimate interests |
| Usage statistics (can be turned off in Settings) | A random install ID and session ID created on the device, app version, platform, in-game city and building ID, referral tag, game step records and time taken, and, when logged in, member ID and sign-up country. GPS, real location, photos, text and IP addresses are not stored. | Improving the first experience and return visits, finding errors (not used for ad tracking) | Legitimate interests (you can refuse in Settings) |
| App integrity check (automatic) | Check result (genuine, failed, no attestation, web, check error), reason code, time of the check, app type (Android or iOS), the kind of request checked (route name for sign-up, login, payment confirmation, GPS Trial, building acquisition), your member ID if you are logged in, and a value made from your IP address in a way that cannot be reversed (the original IP address is not stored). We do not store the Google Play Integrity token or the Apple App Attest attestation themselves, or any unique device identifier (advertising ID, IMEI, serial number, etc.). There is no separate consent screen; the app checks automatically. An app that was not installed from an official source (an unofficial build or a modified copy) may have some features (sign-up, login, payment, GPS Trial, building acquisition) restricted; we will announce this before any restriction starts. | Preventing unfair use through copied or modified apps, automation programs and imitated requests (sign-up abuse, payment fraud, location manipulation, acquisition abuse) and keeping the Service secure (Terms Article 11-2) | Legitimate interest |
| Unauthorized scraping monitoring (automatic) | Time of detection, type of detection (mass collection, automation tool, access to a path that must not be collected), the requested path (one representative path) and its path group (content, map, images/3D assets), reason code, the type of access tool (browser, search robot, automation tool, etc. — the original access information is not stored), your member ID if you are logged in, a value made from your IP address in a way that cannot be reversed (the original IP address is not stored), and the build number of the Service at that time. We do not store the original IP address, the original access information (User-Agent), request or response bodies, or device identifiers. | Detecting and blocking the mass taking or copying of content, maps, images, 3D models or app code by automated programs, preserving evidence to respond to infringements of rights (Terms Articles 11 to 11-4), and keeping the Service secure | Legitimate interest (service security, protection of rights) |
| Marketing (optional) | Whether you agreed to receive news | Telling you about news | Consent (PIPA Art. 15(1)(1)) |
Service visits by members and guests are counted by Korean calendar day. To deduplicate visits within a day, the server pseudonymizes the connection IP and browser information using a daily secret key. Raw IP addresses, browser information, account IDs and visited URLs are not stored. The deduplication values and secret key are deleted the next day; only daily visitor and visit totals are retained. Requests within 30 minutes of the same connection count as one visit. Identified signed-in administrators and known search bots are excluded. Separate installation-ID and gameplay analytics continue to follow the existing usage-statistics setting.
Guest play records, Guest Points, the wardrobe and facade decoration photos kept on the device are not sent to the server and are stored only on the device. We briefly use IP addresses in server memory for rate limiting but do not store them; the hosting provider's access logs may briefly keep IP addresses and access times. A brand homepage opened with “Enter” in the game is a separate site run by that brand and follows that site's own policy.
What “Same Sunset”, “Lit windows” and “Tonight's line” do not process: we do not receive your real location (GPS). We do not trust coordinates sent by the app; only the in-game character position known to the server is kept with the post, blurred (75 m cell + random shift). The writer's name is not shown to other members. “People awake now” and “people who watched the sunset together” show only city-level totals rounded to the nearest 10 (“a few” under 10), and no list of who is there is made. The counting record (account → in-game city, last time) is kept only in server memory for 5 minutes and is not stored. If a post contains words suggesting self-harm or suicide, places to get help are shown only on the writer's screen, with no automatic report, notification or separate storage.
Items processed for Hood Music and its Hall (where offered): codes and titles of saved or published songs, member identifiers, selected map areas (cells and ranges), neighborhood names, countries, save and publication times, play counts, hearts, one-line notes, song and note report copies, reported chat copies, and chat restrictions. These are used to save, play and share songs and handle reports. Audio files are generated on the device and are not stored on the server.
| Item | Period |
|---|---|
| Account information | Until you delete your account → deleted immediately on deletion (member IDs in operational logs are replaced with irreversible values) |
| Friend referral records | Until you delete your account → deleted immediately on deletion. A referral link can no longer be used 7 days after it is created. |
| Sign-up event Points (where offered) | Grant record: same as the points ledger (deleted immediately on account deletion) · hashes used to block re-registration (hashes of the email and the device mark): not linked to the account, deleted 1 year after the grant (kept for that period even after account deletion) |
| Sign-up requests whose email verification was not completed | 7 days from the request → deleted |
| Verification codes | Deleted immediately once used · if unused, deleted within 10 minutes after they expire (10 minutes) |
| Phone verification pseudonymized value (HMAC) | Until you delete your account → deleted 30 days after deletion (to prevent signing up again with the same number to multiply accounts) |
| Building operating records, Points ledger, acquisition applications, stage progress | Until you delete your account → on deletion, Points and stage progress are deleted immediately and pending acquisition applications are cancelled. Buildings you were running go to an takeover listing, and operating records and old bills are kept in a form that no longer identifies the member. |
| Decoration archive | Until you delete it or your account → deleted immediately on account deletion |
| Rooftop decoration layouts, sign text, storage, blueprints | While you have an account → deleted immediately on account deletion. Layouts from ended operation remain as read-only archives, and an automatic blueprint is kept for each operating period (deleted when you delete it or your account). |
| Featured content, photos, saves | Drafts, published content and the archive: until you delete them or your account · deleted content: text and photos deleted immediately, the record row deleted after 30 days · photos not used anywhere: deleted after 1 day · text of content made private under our policies and copies made at the time of a report: 90 days · handled report records (without copies): 3 years. Deleted immediately when you delete your account |
| Account photo library · photo albums (where offered) | Until you delete them or your account · deleted photos stay in the trash for 72 hours and then all three sizes are deleted (if a post or slot still uses the photo, you need to remove it there first) · temporary files from unfinished uploads are deleted when the job ends or after 1 hour · upload attempt records 2 days · upload job records until account deletion · deleting an album (post) deletes its title, text, tags and captions while the photos stay in your library. Deleted immediately on account deletion |
| Wished buildings | Until you remove the wish, get that building, or withdraw · deleted immediately when removed, and from the list when you get the building · deleted immediately on withdrawal · included in your data download |
| AI office | Task text: deleted as soon as the task ends (7 days at most even if unfinished) · office designation, staff, teams, completion summaries, runner contact time and token hash: until the office is released or you withdraw (deleted immediately on withdrawal) · connected-device information: the token is revoked at once when you disconnect the device (app · runner unpair), change your password or withdraw, and a device is disconnected automatically after 90 days without contact · records of disconnected devices (name, OS, version, times) until you withdraw (deleted immediately on withdrawal) · in-progress connection information: invalid once the connection finishes or after 10 minutes (the encrypted envelope is deleted as soon as the first contact is confirmed), and the record is deleted after one day · trusted-device information: trust ends 90 days after last use (180 days at most from when trust began), or when you disconnect (app · runner), reset your password or an administrator revokes it (ended trust is never revived — you connect again from the start), and it is deleted immediately with the device record on account deletion · “Agree and connect” consent records and binding records: deleted immediately on account deletion · attempts at confirming the last four characters: same as in-progress connection information · the Company holds no results |
| Profile photo | Until you delete it or your account · pressing "Remove photo" takes it off your profile immediately, and the photo in your library follows the library rules (72 hours in trash) · deleted immediately on account deletion |
| One-line guestbook, stickers, visits | Entries deleted by the author: text deleted immediately, the record row deleted after 30 days · text of entries hidden under our policies and copies made at the time of a report: 90 days · guestbooks of buildings whose operation ended (the read-only archive kept for the previous Owner): not deleted based on time · visit records: 180 days · translation cache: 30 days · follow-up greetings follow the same periods. When you delete your account, the text of your entries is deleted immediately and replaced with “Former explorer”, and the entries are deleted after 30 days |
| Post comments · likes (where offered) | Comments deleted by the author: text deleted immediately, the record row deleted after 30 days · when a post is deleted, the text of its comments and its likes are deleted with it · when a post is made private (archived) or the building's operation ends, its comments are no longer shown · copies of reported text under review by our operators are kept until the report is handled. When you delete your account, the text of your comments is deleted and the author is shown as anonymous, and your likes are deleted |
| Open plazas (where offered) | Until you delete them or your account · posts and replies deleted by the author: text deleted immediately (photos follow the photo library rules), the record row deleted after 30 days · text of posts hidden under our policies and copies made at the time of a report: 90 days · hearts and hide-for-me records: deleted when you undo them or the post is deleted · request IDs: 7 days. When you delete your account, the text of your plaza posts and replies is deleted immediately and the record rows after 30 days, and your hearts and hide-for-me records are deleted immediately. Plaza post categories: the names of member-made categories stay as plaza labels, and the creator’s member number is replaced with an anonymous number on account deletion · handled category reports are deleted after 3 years |
| Plaza Hall position (where offered) | Server memory only · deleted as soon as you leave or after 30 seconds without an update · not stored |
| Plaza Chat (where offered) | Server memory only, last 100 lines per room · deleted after 30 minutes · not stored · on account deletion your messages in room memory are deleted immediately |
| Plaza Chat reports | Deleted after 7 days · on account deletion, reports you made are deleted immediately and the text is removed from report copies of your messages |
| Plaza Hall moderation | Deleted when the period ends (the action history is kept without message text, together with plaza moderation records) · deleted immediately on account deletion |
| Random Pen Pal (where offered) | Kept while the thread continues; ended threads are deleted with their letters 90 days after ending; threads with no letters for one year are ended; returned letter text 30 days; letter text hidden by moderation 90 days; copies in handled reports 90 days (report records 3 years); on account deletion the text of letters you wrote is deleted immediately and your member ID is replaced with an anonymous ID. Translation results are kept while the letter text remains, and the age-group result is the same record as the GPS features age check (until account deletion). Delivery item counts, packs and purchase, use, cancellation and adjustment records are kept while the account exists and deleted immediately on account deletion (the lines for points spent and returned follow the Points ledger row). Letters thrown to the sky are kept at their spot until someone picks them up, the sender deletes their account or operators remove them (on account deletion the text is deleted immediately); the list of hidden street letters is deleted when the letter is picked up or on account deletion. |
| Faith buildings (where offered) | Lanterns/candles: deleted automatically after 30 days (with their reports · immediately on account deletion) · Recorded messages: until the Owner deletes them or they are replaced by newer recordings (latest 5 per building) · the audio file is deleted immediately on deletion or account deletion (the title, length and upload time remain with a deleted mark) · message reports 90 days · Verification requests: kept while the building's verification result is maintained · on account deletion the official list URL and note are deleted immediately (the organization name and decision remain) · Owner settings: not passed to a new Owner when the operating rights end · Position, gestures and chat in the Faith Space: server memory only (removed after 30 s without contact · chat 30 min) |
| School buildings (where offered) | Timetable and decoration: until the Owner changes them or the Owner changes · deleted immediately on account deletion · Reports: 90 days (immediately on account deletion) · Operator action log: kept as an operating action record · Position, gestures and chat in the Classroom: server memory only (30 s · chat 30 min) |
| Cinema buildings (where offered) | Programme: until the Owner changes it or the Owner changes · deleted immediately on account deletion · Reports: 90 days (immediately on account deletion) · Operator action log: kept as an operating action record · Position, gestures, popcorn and chat in halls: server memory only (30 s · chat 30 min) |
| Campgrounds and the campfire (where offered) | Log additions: deleted after 1 day (immediately on account deletion) · Fire item use: while the account exists → deleted immediately on account deletion (point spending follows the Points ledger row · operating logs follow the operating-log period) · Audio uploaded by operators: until an operator removes it (mp3, m4a and wav metadata stripped on upload · only the uploader ID is erased if that operator leaves) · Position, gestures and chat: server memory only (30 s · chat 30 min) |
| Members on the full map (where offered) | In-game character spot: kept only in server memory and erased when you leave or have not moved for 5 minutes (not stored) · “Show my character on the full map” setting: while your account exists → deleted immediately on account deletion |
| Ranking Room (where offered) | Ranking Room: boards a member created, entries they suggested and ranking requests are destroyed without delay when the member deletes them or their account (hearts other members gave to them and entries other members suggested to that board are destroyed too). Heart records are destroyed when the member cancels the heart, when the entry is deleted or when the member deletes their account. Hourly ranking records are deleted after 24 hours, and final rankings of finished battles (entry number, rank, heart count) are kept as aggregates that cannot identify individuals. Report records (reporter identifier, reason, copy of the content at the time) are kept for 180 days to handle disputes, and the reporter identifier is removed when the reporting member deletes their account. Result share cards are made only on the user’s device and are not stored on the server. |
| PC café member works links (where offered) | PC café member works links: destroyed without delay when the member deletes them or deletes the account. Rejected submissions are kept for 30 days so the member can check the result, then destroyed. Open records are destroyed together when the work is deleted or that member deletes the account. Report records (the reporter's identifier, reason and a copy of the content at that time) are kept for 180 days to handle disputes, and the reporter's identifier is erased when the reporting member deletes the account. |
| Data Center member links (where offered) | Data Center member links: we keep the name, one-line description, category and external link address that a member enters, together with the time added and the writing member's identifier, to show the list and to handle reports, and destroy them without delay when the member deletes them or deletes the account. Like records are destroyed together when the member removes the like, the link is deleted, or that member deletes the account. Report records (the reporter's identifier, reason and a copy of the content at that time) are kept for 180 days to handle disputes, and the reporter's identifier is erased when the reporting member deletes the account. |
| Member memorial links in the Memorial hall (where offered) | Member memorial links in the Memorial hall: we keep the name, one-line message and external link address that a member enters, together with the time registered and the writing member's identifier, to show the list and to handle reports, and destroy them without delay when the member deletes them or deletes the account. When a link is reported, we keep the reporter's identifier, the reason and a copy of the content at that time to handle the report. Report records are destroyed together when the memorial link is deleted or the reporting member deletes the account. |
| Same Sunset stamps (where offered) | The last 60 days shown in the calendar → older records are deleted automatically · deleted immediately on account deletion |
| Tonight's line (where offered) | Posts, 🫶 taps and the blurred in-game position: deleted automatically at 06:00 the next day (local time in that city) · deleted immediately on account deletion · reports (report reason, copy of the reported post): deleted after 180 days like other report records (report records remain for this period even after the post is deleted at 06:00) |
| Fan club halls (where offered) | Hall settings: until the hall is deleted or the account is deleted (settings remain while the hall is off) · Photo wall: until removed by the uploader, Owner or operator · hidden photos are marked removed after 90 days · removed-photo rows deleted after 30 days · on account deletion your photos are taken down immediately (the photo link is erased) and their rows deleted after 30 days · Photo reports: 90 days (deleted with the photo row) · Blocks: until lifted (deleted if the hall changes Owner or on account deletion) · Moderation log: 180 days · Today's visitor count: server memory, cleared when the day changes |
| Custom outfits (where offered) | Requests, image references, result files and processing history: while the account exists → deleted immediately on account deletion (photos in the photo library follow the photo library row) · Rights reports: until the reporting or requesting member deletes their account · the working folder on the production computer is deleted after publishing · data sent to the generation service abroad: see section 4 · payment and point rows follow the Points ledger row |
| Meetup places and place chat rooms (where offered) | Chat messages: meetup end (or cancellation) + 24 hours → deleted · Meetups, participation and notification records: meetup end + 7 days → deleted (notification interval records 1 day) · Report copies: 180 days · On account deletion your meetups, participation and messages are deleted immediately (report copies are unlinked from the account and kept for the period · general report-handling records follow their period) |
| Building finder popularity | Daily visitor count per building: deleted after 8 days (no per-member records) |
| Block Meeting | Membership, settings and announcements: while the Circle exists · join requests expire after 7 days · summon records (attendance, position just before the summon, result of the return) are kept as Circle operating records. When you delete your account, your join requests and summon attendance records are deleted immediately; announcements written by the chair remain in the Circle. |
| Friends · regulars · profile (where offered) | Until you delete them or your account → deleted immediately on account deletion |
| Chat (where offered) | 30 days after the last message → deleted · chat report copies: 180 days · when an account is deleted, chats involving that member (both people's messages) are deleted immediately, and report copies are only unlinked from the account |
| External account connection (where offered) | Until you disconnect or delete your account → when you disconnect, access is revoked and the token is deleted immediately · original post information is cleared and re-checked every 30 days |
| Starting city | Until you delete your account → deleted immediately on account deletion · before you choose your first hideout you can delete it right away with Settings “Reset start location choice” |
| In-game location (virtual) | While your account exists → deleted immediately on account deletion |
| Auto travel (in-game trips) | Kept for 7 days after the trip ends |
| GPS features | Real coordinates = not stored (processed once in device memory, then discarded) · age check result = until account deletion · consent records = for the consent-record retention period · last in-app position = until GPS Trial ends (deleted when it ends) · records confirming collection and use of location information (member ID, time, path (iOS, Android, web), on/off · no coordinates or area numbers) = deleted automatically 190 days after each record (6 months or more · Location Information Act Art. 16(2)) — kept for this period even after account deletion, as required by law, and then deleted |
| In-app notifications | 90 days → deleted · deleted immediately on account deletion |
| Device notification tokens | Logging out deletes that device's token immediately · “Log out of all devices” or account deletion deletes the tokens of all devices immediately · devices whose session ended through a password reset or login expiry stop receiving notifications from then, and their tokens are deleted within 1 hour · tokens of devices that have not opened the app for 270 days, and tokens the notification server reports as invalid, are deleted (invalid tokens within 30 days) |
| Device notification settings | Until you delete your account → deleted immediately on account deletion |
| Records of notifications sent | 30 days → deleted · deleted immediately on account deletion |
| Payment, Point (including former Credit) and pass records, facade ad order and settlement records | Kept while the account exists · after account deletion, kept for 5 years from the deletion date (E-Commerce Act, Article 6), then deleted |
| Fortune house paid-reading purchase and gift-building records | While the account exists → deleted immediately on account deletion · Points-ledger lines for the purchase follow the “Payment, Point” records · operating records for the building received follow “Building operating records” |
| Facade ad photos, videos, text and notes | 90 days from the day posting ends or the order is cancelled, rejected or refunded → deleted |
| Refund bank account | Deleted without delay once the refund is complete |
| Translations stored with a report (on-device translation) | Same period as that report copy (e.g. guestbook and plazas: 90 days · chat: 180 days) |
| Records of consumer complaints, disputes and report handling | 3 years from receipt → deleted |
| Operational logs (member activity type and time) | 3 months → deleted · administrator action logs: 2 years → deleted |
| Facade ad view records | 90 days → deleted · a member's records are deleted immediately on account deletion |
| Usage statistics | 180 days from receipt → deleted (after that, only daily totals) · on account deletion, the link to the member ID is removed immediately |
| Login sessions | “Keep me logged in”: 90 days from your last use (up to 1 year after first login) · not kept: 1 day · deleted immediately when you log out; resetting your password or tapping “Log out of all devices” immediately deletes the sessions on all devices |
| Phone QR logins in progress | Deleted from server memory within the QR validity (2 minutes) plus 1 minute of clean-up · not stored in the database · approval, rejection and login events are kept as “Operational logs” (3 months) |
| App integrity check records | 90 days from creation → deleted · the link to your member ID is cut when you withdraw · the public value of the iOS app attestation key is kept up to 400 days after last use to keep attestation working (it does not identify you) |
| Unauthorized scraping monitoring records | Automatically deleted 90 days after creation · however, records involved in an investigation, lawsuit or dispute over an infringement of rights that is still in progress may be kept separately until that process ends (exported evidence bundles) |
| Security counters such as failed login and find-email counts (IP addresses only as hashed values) | Deleted the next day (overwritten) |
When a period ends, the server deletes the data automatically every hour in a way that cannot be recovered (verification codes every 10 minutes). The hosting provider's access logs are kept briefly under that provider's policy.
Retention for Hood Music and its Hall (where offered): saved songs, hearts and one-line notes are retained until deleted by the member or on account deletion. Song and note reports are kept for up to 180 days; deleting a note also deletes its reports. On account deletion, the reporter identifier in song reports is anonymized. Daily save, share and heart counts are cleaned up after 2 days. Hall chat stays only in server memory for at most 30 minutes (100 lines per room), not in the database. Reported chat copies: up to 7 days. Chat restrictions: until they end.
We do not sell or provide personal information to third parties, except when there is a request under the law. We do not provide your personal location information to third parties, and the Service has no feature for sharing your location with other people. The following information is visible to other users because of game features. Your email, phone number, payment history, internal member ID and real location are not visible (your email only in the hidden form shown by “Find email” below).
| Where | Who can see it | What is shown |
|---|---|---|
| Rankings | Anyone | Display name, sign-up country, level and title, emblem and name color, number of buildings you run and other values shown on the ranking screen (the Block Meeting name tag only if the chair turned it on) |
| Owner labels | Anyone | Display name of the member running the building and when they started operating it (the name is hidden while use is restricted) · for released buildings, only “Reopening soon” (the grace period and last visit are not shown) A building run by a member is shown with the name chosen by the Owner, or a name made from the display name such as “(display name)'s church”, instead of its original (map or official) name (the original name returns when the building becomes vacant). |
| Building visits, guestbook, featured content | The visibility the Owner chose (Public · Block Meeting only · Only me) | Building name, the Owner's display name, guestbook entries (author's display name, time, text), the public rooftop layout and sign text, published content. Visitor counts are shown only to the Owner, as totals. |
| Post comments · likes (where offered) | People who can see that post (the building's visibility: Public · Block Meeting only · Only me) | The comment author's display name, text and time. Members who have blocked each other cannot see each other's comments, and if you and the post owner have blocked each other you can neither see the post nor comment on it. Likes have no public count — only the person who liked a post sees it in their own “Liked posts”, and the post owner sees only the total likes on their own posts (not who liked them). |
| Open plazas (where offered) | Anyone (including non-members and web share links) | Which plaza (country or region) the post is in, the display name, avatar and operator badge of the author of each post and reply, the text, photo and time posted, the number of replies, and whether a post has replies turned off. Hearts have no public count for anyone, including the author, and who tapped them is not shown. Members who have blocked each other cannot see each other's plaza posts. Plaza posts do not appear on the author's profile, in the discovery feed or in search. |
| Plaza Hall (where offered) | People viewing that Plaza Hall (including non-members, who can only look around and read the chat) | For members who have entered: display name, public profile number (only for public profiles), character appearance, operator badge, in-game position, facing and emote within that space (not a real-world location), and Plaza Chat (display name, text, time). Account IDs are not sent; a temporary number that changes for each room is used instead. Members who have blocked each other cannot see each other’s characters or messages. |
| Random Pen Pal (where offered) | The member you exchange letters with | Display name, avatar, country, pen pal city, and letter text (to the recipient only) — never your real location. The sender is not told who received a new letter until the recipient replies. A letter thrown to the sky and lying on the street shows only the delivery item and a letter mark to members of the sender's age group; its text and sender are shown only to the member who picks it up. |
| Faith buildings (where offered) | People inside that Faith Space | Lanterns/candles according to the visibility the member chose (public = display name and text · public, name hidden = text only · only me = the member only) · title and length of recorded messages · display names, character appearance, game position inside, seat, gestures and one-line chat of members inside (not real locations) |
| Inside Classrooms, cinema halls, the campfire and Fan club halls (where offered) | People in the same place (non-members can only view and read chat) | Display name, character appearance, game position inside, seat, gestures and one-line chat (not real locations). The number of people watching in each cinema hall is visible to anyone. Adding a log or using a fire item (including “Just for me” items) at the campfire is announced with the display name, and others can also see you using a “Just for me” item. |
| Fan club hall photo walls (where offered) | People who can enter that hall (blocked members excluded) | Published photos and the uploader's display name · Owners see uploaders and blocked members only by display name, never by member ID |
| Meetups (where offered) | Members (chat messages only to members verified as 18 and over who are at that place) | Meetup name, description, place, time and capacity · the creator's display name · display names of participants (participant list) · counts (members at the place now · participants · participants at the place — members who are only present are shown as numbers, without names) |
| Custom outfits (where offered) | Other members on the same screen | How the outfit looks on the requesting member's character — the uploaded images, outfit name and notes are not shown |
| Block Meeting | Members of that Circle (the member list within the range set by the chair) | Circle name and tag, members' display names, announcements, summon venue, time and attendance |
| Photo albums · album search (where offered) | The visibility of the building the album is in (Public · Block Meeting only · Only me) | Album photos (small, screen and large sizes), title, text, tags, photo captions and number of photos. Search results, photo counts and tag groups only include albums visible to the viewer. Photos that are only in your library and not used in a post are not shown to anyone else. |
| Friends · regulars · profile (where offered) | Anyone, if the profile is public (new members are public by default · only you once you switch it to private) | Public ID, intro, interests, featured building, number of friends, and the collection of albums that member has published and you are allowed to see (photo gallery) |
| Chat (where offered) | The two people in the chat | Display names, chat messages, read status (if both people turned it on) |
| Online presence | Members logged in to the same city | Display name, title and emblem, character look, in-game position, direction and action (not real location) |
| Members on the full map (where offered) | Members who open the full map | Display name, in-game character spot (a point on the game map rounded to about 10 m · not real location) — only members who are online and moved in the last 5 minutes · not shown while GPS features are on, between members who have blocked each other, or if the member turned off “Show my character on the full map” |
| Ranking Room (where offered) | Users who view the Ranking Room (including non-members) | Heart count per entry (members who gave hearts are not shown), entry names, one-line reasons, ranking requests and board names and descriptions written by members, display names of members whose suggested entries reached the top 3, who wrote ranking requests or who created boards |
| Takeover listings | Anyone | Building, height, area, required stage, acquisition fee, closing time, number of applicants (the names of applicants and of the previous Owner are not shown) |
| Live facade ads | Anyone | Ad photo and video, building and wall, end time of posting (the advertiser's name and the price are not shown) |
| Find email (where offered) | Anyone who enters a nickname (ID) · up to 5 times per 10 minutes and 20 times a day per network | The hidden email of the account that signed up with that nickname and completed email verification (only the first two and last one characters and the first two characters of the domain · e.g. sh****p@gm***.com). Because nicknames (IDs) are visible to other members, anyone can see this form. The full email is never shown. |
| Friend referrals | The referring member only | Only the number of referrals confirmed this month and the number being checked (the friend's name, email and usage are not shown) |
| AI office buildings | Everyone (including non-members) | Only the office name and status (working/resting) · the inside of the building, its content, tasks, progress and results are visible to the Owner only |
| Recipient (country) | Task | Items | When and how | Retention |
|---|---|---|---|---|
| Fly.io, Inc. (headquarters USA · servers in Tokyo, Japan) | Servers and data storage (cloud) | All server-stored items in section 1 (including photos in your account photo library in all three sizes · kept in the storage of our servers) | Sent over HTTPS during use | The retention periods above |
| Resend, Inc. (USA) | Sending verification code emails, account-protection “new sign-in” alerts and service notifications (Expo meeting requests and replies; members can turn them off) (no marketing emails) | Email address, email content (verification code · sign-in time and device type · booth name and link) | Sent over HTTPS when you request a code or sign in, or when an Expo meeting is requested or answered | Resend's policy after sending |
| Twilio Inc. (USA) — where phone verification is required | Sending verification texts | Mobile phone number, verification code | Sent over HTTPS when you request verification | Twilio's policy after sending |
| DeepL SE (Germany) or Google LLC (USA) — where the operator has configured it | Translating text (including Random Pen Pal letters) | The text of the one entry or letter you tapped “Translate” on, the target language | Sent over HTTPS only when you tap | Each company's policy after translation |
| Apple Inc. · Google LLC (USA) — where paid purchases are offered | Processing in-app payments and checking receipts | Transaction ID, product (we do not receive card details) | At payment and verification | Each company's policy |
| Google LLC · Meta Platforms, Inc. (USA) — where external account connection is offered | Checking the YouTube, Instagram and Threads original posts you connected | Access token, original post address | HTTPS when you connect or when the original post is checked | Each company's policy |
| Google LLC (USA) — Firebase Cloud Messaging · where device notifications are offered | Delivering device notifications (on iOS, delivered via Apple Inc. (USA)'s Apple Push Notification service) | Device notification token, notification text (fixed sentences · no other member's information or post content), the in-app address to open when tapped (building, post or chat number) | Sent over HTTPS when a notification is sent | Google's and Apple's policies after delivery |
| Google LLC · Apple Inc. (USA) | App integrity checks (Google Play Integrity API · Apple App Attest) | The check token or attestation the app creates on the device (we do not store the originals). No other personal information of yours is sent | HTTPS transfer when you make a checked request such as sign-up or login | Each company's policy after processing |
| Higgsfield AI, Inc. (United States) and the generation model providers on its platform (VAST (Tripo · 3D generation) · Meshy (rigging) · image-editing model providers — United States, China, etc. depending on the provider) — only if you request a Custom outfit | Generating Custom outfits (garment image → image of the character wearing it → 3D outfit · rigging) | The garment images (front/back) you uploaded, intermediate images and 3D models made from them, and work prompts (which may include notes you wrote) — account information such as e-mail or member ID is not sent | HTTPS transfer when production starts after an operator reviews the request | Each company's policy after processing · Refusal: nothing is sent if you do not request a Custom outfit or cancel the request before review starts (full refund) |
Photo checks for explicit content are done on our own server, and photos are not sent outside. Maps are served directly from our server using OpenStreetMap data. If you do not want your data transferred abroad, you can choose not to sign up, or delete your account (you can still play as a Guest, on your device only).
YouTube embedding: when a YouTube video plays in a faith building, Classroom, Cinema, campground or Fan club hall, your device connects directly to YouTube's (Google LLC, United States) embedded player (the reduced-cookie youtube-nocookie.com address), and information Google processes over that connection (device and access information, etc.) is governed by the Google Privacy Policy. The Company does not send member information to Google and does not store videos on its servers. Garment images for Custom outfits are sent abroad for processing as shown in the table above; other photos are not sent outside.
The Service reads your device's location information (location obtained via GPS, Wi-Fi, cell towers, etc.) only when you turn on a GPS feature: once when you tap “Start from my location”, and, for “GPS Trial”, only while it is on and the Service is on screen — never in the background. Latitude, longitude, accuracy and time are used on your device only to convert them into a game area and game coordinates and are then discarded; they are not sent to or stored on our servers. Only the in-game location normally used to play (game area number and game coordinates) is sent to our servers, and while GPS Trial is on this in-game location follows your real location. When you turn on GPS Trial, your character's last in-app position (game area number and game coordinates, not real coordinates) is kept on the server until the trial ends, and during the trial your character is hidden from everyone, friends included. When the trial ends (turned off, “Continue” tapped, app restarted, or the screen goes to the background and returns), your character returns to the last in-app position and that record is deleted; buildings, Points and visit records obtained during the trial are kept. We do not share your location with other people or provide it to third parties. The GPS features are only for users 18 and over, consent to the collection and use of location information is asked the first time you turn them on, and you can turn them off or withdraw consent at any time in Settings › GPS Trial. If you do not use them, your first city is chosen on your device from its language and time zone settings (those settings are not sent off your device to choose your starting city), and you can change your starting location by searching for an address or place name in “Find start location” (the search text is used only on your device). When the map and place-name data for the chosen city are downloaded, the request contains the country and a broad map tile number, but our server does not store it, as with other map data requests. The only start-related record kept on our server is the one in item 1, “Starting city”. The friends, regulars and profile feature separately receives your time zone name to time updates and notifications (item 1, “Friends · regulars · profile”). The details are governed by the Location-Based Service Terms.
Hood Music and its Hall (where offered) do not collect the device’s actual GPS location. Song codes and map area information can reconstruct the map area selected by a member; publishing a song lets other users identify that area. Country is determined from the map area number, not GPS or IP addresses. “Visit that neighborhood” uses the area information in the song code. Moving directly to a neighborhood in another country changes only the in-game position (city); no separate travel record or record of which song prompted the move is stored.
On the web we use only one essential cookie (HttpOnly) to keep you logged in, and no advertising or analytics tracking cookies. With “Keep me logged in” on, this cookie lasts up to 90 days (extended each time you use the service); with it off, it is deleted when you close the browser. The iOS and Android apps do not include any third-party advertising SDK; they do not read or send the advertising identifier and do not request iOS App Tracking Transparency (ATT) permission. The app sends device notifications only if you allow them, and for this we store a device notification token on our server (section 1, “Device notifications”). On the device we store only the last registered token and whether you have seen the notification prompt. Game progress and settings such as “Remind me later about Terms changes” are saved in device storage and can be cleared in your browser or app settings. With “Remember email” on, the email you last logged in with is saved on this device and filled in at your next login; turning it off deletes it. Your password is never saved on the device. For sign-up event Points (where offered), a random mark used to block re-registration (not an advertising or analytics identifier) is saved on this device, and our server stores only its hash. If you use on-device translation in the app (where offered), your translation settings (stored on this device and not sent to our server), downloaded translation models (about 30 MB per language) and translations (up to 30 days · deleted when you log out or switch accounts) are stored only on this device. You can delete downloaded models in Settings › Language & translation.
Children under 14 cannot sign up. If we learn of such an account, we immediately delete the account and its information. If a country's laws set a higher age, that age applies. The GPS features are only for users 18 and over.
Hood Music Hall (where offered) — members aged 14 or older and under 18: Hall chat can be used under the same conditions as open plazas and does not lead to one-to-one chat.
Dong Yup Shim (CEO) · blocrown@airony.xyz. You can report privacy violations or get advice from the following Korean bodies: Personal Information Dispute Mediation Committee (개인정보분쟁조정위원회, 1833-6972), Personal Information Infringement Report Center (개인정보침해신고센터, 118), Supreme Prosecutors' Office (대검찰청, 1301), Korean National Police Agency (경찰청, 182).
When this policy changes, we announce it through in-app notices 7 days before the change takes effect (30 days before, for important changes). Previous versions are available on request. If the English or Japanese translation differs from the Korean original, whichever is more favorable to the user applies.