Privacy Policy

Personal Data Collected and Purposes of Use

The company collects and uses the minimum personal data necessary to provide the Service as set out below, and destroys it without delay once the purpose of processing has been achieved. However, where relevant laws require retention for a certain period, such data is retained for the applicable period in accordance with “Retention and Use Period of Personal Data” below.

• Account information: email address and authentication credentials. Purpose of use = registration and identification, login and account management, responding to customer inquiries, and retaining transaction records as required by law.
• Game usage information: case play records, interrogation sessions and progress state, and usage history. Purpose of use = providing the Service, saving and restoring progress state, and improving content.
• Payment information: order details, payment status, and payment key. Purpose of use = processing purchases of paid content, granting entitlements, and handling withdrawal of subscription and refunds. The company does not store detailed payment-method information such as credit card numbers; such information is processed by the payment gateway or the Merchant of Record.
• Automatically generated and analytical information: access logs, device and browser information, cookies and similar identifiers, and service usage statistics. Purpose of use = operating and securing the Service, and usage analytics (Google Analytics). Of these, information for analytics is collected only where the user has given consent.
• Referral information: the route by which the user first reached the Service (the referring source, and the source, medium and campaign labels contained in the link the user clicked), together with the browser-stored identifier described below. Purpose of use = statistical analysis of how users came to know of and sign up for the Service. This information is recorded only once, at the time the user first reaches the Service, and is not updated even if the user later arrives through a different route.

In order to tell such referral records apart, the company stores a single randomly generated value in the user’s browser when the user first reaches the Service. This value remains in that browser until the user deletes it, and is used solely to connect a visit made before signing in with the account subsequently registered. The value itself contains no information that identifies the user, such as a name or email address; the company does not use it for advertising or to track the user’s activity outside the Service, and does not provide it to any third party. Users may delete this value at any time by clearing their browser’s stored data, and doing so has no effect on their use of the Service.

The company’s Service is not directed to children under the age of 14, and the company does not collect personal data from children below that age. If the company becomes aware that a child’s personal data has been collected without the consent of a legal guardian, it destroys such data without delay.

Retention and Use Period of Personal Data

As a rule, the company destroys users’ personal data without delay once the purpose of collection and use has been achieved. However, where relevant laws require retention for a certain period, the company retains it for the applicable period as follows.

Records on contracts or withdrawal of subscription, etc.

5 years (Article 6(3) of the Act on Consumer Protection in Electronic Commerce (전자상거래 등에서의 소비자보호에 관한 법률) and its Enforcement Decree)

Records on payment and the supply of goods, etc.

5 years (Article 6(3) of the Act on Consumer Protection in Electronic Commerce and its Enforcement Decree)

Records on consumer complaints or dispute resolution

3 years (Article 6(3) of the Act on Consumer Protection in Electronic Commerce and its Enforcement Decree)

Account information (email, authentication credentials, etc.)

Destroyed without delay upon membership withdrawal. However, the minimum identifying information of a withdrawn member is retained separately for 5 years in accordance with the two items below, and other information subject to the statutory retention obligations above is retained for the applicable retention period.

Minimum identifying information of withdrawn members (email address, member identifier, and withdrawal date and time) — members with a payment history

5 years from the date of membership withdrawal. Retained separately from other personal data in order to identify the parties to the transaction records that the company preserves under Article 6 of the Act on Consumer Protection in Electronic Commerce and its Enforcement Decree.

Minimum identifying information of withdrawn members (email address, member identifier, and withdrawal date and time) — members with no payment history

5 years from the date of membership withdrawal. This period is not a statutory retention period; it is a period set by the company to prepare for disputes that may arise regarding evidence of the consent obtained at sign-up, corresponding to the five-year commercial limitation period under Article 64 of the Commercial Act (상법). Such data is retained separately from other personal data, and users may request its deletion or the suspension of its processing at any time.

Records of consent to the terms of service, this privacy policy, etc.

5 years from the date of membership withdrawal. Retained as evidence of the fact, time and subject document of the consent obtained. The information retained consists of the member identifier, the type and version of the document consented to, whether consent was given, the time of consent, and the channel through which the consent was collected; information by which a user can be directly identified, such as an email address or a name, is not included.

Referral information linked to a member account

Destroyed without delay upon membership withdrawal.

Referral information not linked to a member account

90 days from the date of collection. Once this period has elapsed, the company deletes such records automatically without any separate request.

Provision of Personal Data to Third Parties

The company does not use users’ personal data beyond the scope of the purposes of use set out in this Policy, nor provide it to third parties without the user’s consent. However, pursuant to Articles 17 and 18 of the Personal Information Protection Act (PIPA), the company may provide personal data where: (i) the user has given prior consent; (ii) there are special provisions in law or it is unavoidable in order to comply with a legal obligation; or (iii) there is a lawful request from a competent authority in accordance with the procedures and methods prescribed by law for the purpose of investigation, trial, and the like.

Where the company provides personal data to a third party, it informs the user of the recipient, the purpose of provision, the items provided, and the retention and use period. The entrustment of personal data processing for purposes such as paid-content payment, hosting, and usage analytics is distinct from provision to third parties, and its content is governed by ‘Entrustment of Personal Data Processing’ below.

Entrustment of Personal Data Processing

To provide the Service smoothly, the company entrusts personal data processing tasks as set out below. When entering into an entrustment contract, the company stipulates the matters necessary to ensure that personal data is managed safely and supervises the trustee, in accordance with Article 26 of the Personal Information Protection Act (PIPA). The table below also identifies the recipients that receive information based on the user’s consent, together with their roles.

Toss Payments Corporation (Republic of Korea)

Authorization and capture of domestic payments and processing of payment cancellations and refunds (electronic payment gateway).

Paddle.com Market Ltd (United Kingdom)

Authorization, processing, cancellation and refunds of international (non-Korea) payments as Merchant of Record.

Anthropic PBC (United States)

Processing for the generation of case content.

OpenAI, L.L.C. (United States)

Processing for speech-to-text transcription of voice input.

Supabase Inc. and Railway Corporation (United States, etc.)

Database and server hosting, and infrastructure operation.

Google LLC (United States)

Service usage statistics analysis (Google Analytics). Processed only where the user has given consent.

With respect to the transfer of personal data to any of the trustees or recipients above that are located overseas, see ‘Overseas Transfer of Personal Data’ below.

Overseas Transfer of Personal Data

For the entrustment of processing and the operation of the Service above, the company may transfer users’ personal data overseas, including to the United States. The company carries out overseas transfers in accordance with Article 28-8 of the Personal Information Protection Act (PIPA), and enters into and applies appropriate safeguards such as Standard Contractual Clauses (SCC) with the transferee. Users may refuse the overseas transfer of their personal data, in which case the use of the relevant Service may be restricted.

• Transferee and country of transfer: the trustees and recipients listed in ‘Entrustment of Personal Data Processing’ above and the countries in which they are located (the United States, etc.).
• Purpose and items of transfer: the minimum personal data necessary to perform each entrustment or receipt purpose. In the case of transfers for usage analytics, only identifiers hashed with SHA-256 or the like, which cannot directly identify the user, are transferred.
• Date and method of transfer: transferred over the information and communications network at the time of Service use.
• Personal data protection regime and safeguards in the country of transfer: contractual safeguards such as Standard Contractual Clauses are applied with the transferee, and information on the level of personal data protection in the country of transfer and the safeguards implemented by the transferee is provided upon the user’s request.

Procedures and Methods for Destruction of Personal Data

In accordance with Article 21 of the Personal Information Protection Act (PIPA), the company destroys the relevant personal data without delay once the purpose of collection and use has been achieved or the retention and use period has elapsed, except where it must be retained under relevant laws.

Personal data stored in electronic file form is permanently deleted using technical methods that make recovery impossible, and personal data recorded and stored on paper documents is shredded or incinerated. Personal data retained under law is stored and managed in a database separate from other personal data, is not used for any purpose other than the purpose of retention, and once the retention period has elapsed it is destroyed without delay by the methods described above.

Measures to Ensure the Safety of Personal Data

In accordance with Article 29 of the Personal Information Protection Act (PIPA), the company takes the following measures to ensure safety so that users’ personal data is not lost, stolen, leaked, forged, altered, or damaged.

• Administrative measures: the company limits personal data handlers to the minimum necessary, and establishes and implements an internal management plan and provides regular training to handlers.
• Access control: access rights to the personal data processing system are granted differentially according to business need under the principle of least privilege, and access control devices are installed and operated to block unauthorized external access.
• Encryption: authentication credentials such as passwords and other important information are encrypted for storage and transmission.
• Retention and inspection of access records: access records of the personal data processing system are retained, and measures are taken to prevent their forgery, alteration, theft, or loss.

Cookies and Advertising Identifiers

The company uses cookies and similar advertising identifiers to provide users with customized services and to analyze service use. Except for essential cookies that are strictly necessary to provide the Service, non-essential cookies for analytics and advertising purposes are used only where the user has given prior consent.

Users may withdraw consent at any time, and may withdraw their consent to non-essential cookies via the button below. Users may also refuse the storage of cookies through their web browser settings. Once 180 days have elapsed from the date on which the company confirms the user’s consent, or 30 days from the date on which it confirms the user’s refusal, the company requests consent again regarding the use of non-essential cookies.

The browser-stored identifier for referral information described in “Personal Data Collected and Purposes of Use” above is a value the company stores in the user’s browser to determine, on its own, how users came to sign up, and is distinct from advertising identifiers and third-party tracking mechanisms. It is not provided to third parties and is not used for advertising, and users may delete it by clearing their browser’s stored data.

Rights and Obligations of Data Subjects and How to Exercise Them

Users (data subjects) and their legal guardians may at any time request the company to access, correct, delete, or suspend the processing of their personal data, and to have their personal data ported (transmitted). However, except as otherwise provided by applicable laws — that is, where another statute expressly designates such personal data as subject to collection or imposes an obligation to retain it for a certain period — the company may refuse a request for deletion or suspension of processing, in which case the company notifies the user of the grounds without delay.

Rights may be exercised through the account settings within the Service or through customer inquiry (email); for legitimate requests, the company takes the necessary measures within 10 days of receipt and notifies the user of the result. Users may withdraw their consent to the processing of personal data at any time, and such withdrawal of consent may restrict the use of services provided on the premise of that consent.

Personal Data Protection Officer

In accordance with Article 31 of the Personal Information Protection Act (PIPA), the company designates a Personal Data Protection Officer to protect users’ personal data and to handle users’ inquiries and complaints relating to personal data, as follows.

Name and title

Max Jeong (Representative)

Contact

root@max-soft.kr (customer inquiry)

Remedies for Infringement of Rights

To obtain relief or counseling for damage caused by the infringement of personal data, users may apply to the following organizations. The organizations below are separate from the company; users may contact them if they are not satisfied with the company’s own handling of personal data complaints and damage relief, or if they need more detailed assistance.

• Personal Information Dispute Mediation Committee: 1833-6972 (no area code) / www.kopico.go.kr
• Personal Information Infringement Report Center: 118 (no area code) / privacy.kisa.or.kr
• Supreme Prosecutors’ Office Cyber Investigation Division: 1301 (no area code) / www.spo.go.kr
• National Police Agency Cyber Investigation Bureau: 182 (no area code) / ecrm.police.go.kr

Jurisdiction-Specific Notices

Changes to This Privacy Policy

The company may amend this Privacy Policy in response to changes in law or the Service, or changes in policy for the protection of personal data.

Where this Policy is amended, the company announces the details of the amendment and its effective date through the Service’s initial screen or the notices section from 7 days before the effective date (30 days before, in the case of a material change that is unfavorable to users). The amended Policy takes effect from the announced effective date.

Amendment History

Effective 2026-09-21 (current)

Specified the items retained separately as the minimum identifying information of withdrawn members to include, in addition to the email address, the member identifier and the withdrawal date and time. There is no change to the scope of the information actually retained, to the retention period, or to the user's right to request deletion or the suspension of processing; this amendment brings the existing description into line with what is actually retained.

Effective 2026-09-11

Split the item on the retention of withdrawn members' email addresses according to whether the member has a payment history and stated the basis for each, and newly specified the retention and use period for records of consent to the terms of service, this privacy policy, etc.

Effective 2026-08-22

Added referral information and the browser-stored identifier used to tell such records apart to the categories of data collected, and specified their retention and use period (records linked to a member account are destroyed upon withdrawal; records not so linked are retained for 90 days from the date of collection).

Effective 2026-08-07

Immediately preceding version.