This English version is provided for convenience. If there is any difference, the Korean version prevails unless the law of the country where you live provides otherwise. Korean version (한국어)
Privacy Policy
ItSum (the “Company”) provides the mobile game Pawtheon (the “Game”) and processes users' personal information in accordance with applicable laws and regulations such as the Personal Information Protection Act of the Republic of Korea. This Policy tells you what personal information the Company processes, why, and for how long, and the rights that users have.
1. Purposes of Processing
The Company processes personal information only for the purposes below, and if a purpose changes, it gives notice in advance in accordance with the law and obtains consent where required.
- Creating accounts and signing in: starting with a guest account or a Google account, linking accounts, continuing on several devices (the device that connected later takes over)
- Providing the game service: saving and loading game progress, calculating rewards for the time the game was closed, processing Invite, Fusion, and growth results, mail, coupon and attendance rewards
- Selling and granting paid currency: verifying Store (Google Play, ONE store) purchases, granting Nyam Stick and products, preventing duplicate grants, handling refunds and withdrawals, responding to purchase restore inquiries
- Preventing abuse: checking for progress manipulation, hacking, and automated use; restricting use in response to manipulated requests; preventing the use of another person's receipt; checking that the app and the device are normal
- Advertising: showing rewarded ads that the user chose and confirming that the reward was granted
- Improving the service: finding the causes of errors and crashes, seeing through statistics at which step players find the game difficult
- Notices and responding to inquiries: informational alerts such as maintenance and updates; handling and recording inquiries and complaints
2. Items Processed and How They Are Collected
The Company processes only the minimum information that is essential for the game. Most of it is created or transmitted automatically while you use the app, and coupon codes and inquiry information are sent directly by the user.
2-1. Personal information processed when using the Service
Account, game-progress and payment data are used to provide the Service and process transactions. Usage records support abuse prevention, error analysis and service improvement. Google account linking, inquiries and notification permission involve the corresponding optional features. Advertising identifiers and ad-usage data are described in Sections 2-3 and 9.
| Category | Items | Purpose |
|---|---|---|
| Account (guest) | Account identifier (a randomly created string; not shown on the game screen), time the account was created, time of last sign-in, IP address and device information at sign-in (browser/app identification string) | No. 1 |
| Account (Google sign-in) | The items above + Google account identifier, email address, display name, profile photo URL | No. 1 |
| Terms consent record | Terms version, time of consent | No. 1 |
| Game progress | Currency (Coins and Nyam Stick) and progress (catified areas, upgrades, tutorial, followers owned and their growth, and guarantee progress), save time and number, confirmation information for the last transaction | Nos. 2, 4 |
| Payment records | Store order number (for Google Play it starts with GPA.; for ONE store it is the purchase number), Store of purchase, product name, purchase and refund times, number of Nyam Stick granted or recovered and the amounts before and after, processing status (granted, refunded), record of Nyam Stick added in response to an inquiry, hash of the purchase token, hash of the account identifier (pseudonymized information) | No. 3 |
| Payment tool (Unity IAP) | Identifiers created by the payment tool (player and installation identifiers), device information, session identifier, country, purchase progress information | No. 3 |
| Game currency records | Current Nyam Stick balance, purchases, followers owned, reward claim status (including mail, coupons and attendance), and the last transaction result. Refund count, first and last refund times, and the most recent refunded product and Nyam Stick amounts are stored separately from the account | Nos. 2, 3, 4 |
| Rewarded ad usage records | Daily usage count and date for each ad placement, and the last ad reward transaction result (saved in game progress) | No. 5 |
| Restriction records | Hash of the account identifier, suspension stage, time the suspension is lifted, whether the suspension is permanent, and the identifier, reason, and time of requests treated as manipulation | No. 4 |
| Operations alerts | Account number (the first 8 characters of the hash of the account identifier), which refund it is by count, the refunded product, its number of Nyam Stick, and the Nyam Stick held at that time, the dates of the first refund and of this refund — sent to the operator's messenger (Telegram) only when an account is permanently suspended or when a refund on the same account is the 3rd or later | No. 4 |
| Server access records | Account identifier, connection and save times, request type, result (passed or rejected, and the reason), IP address the request was sent from (temporarily) | Nos. 4, 6 |
| App and device verification | Verification information created by Firebase App Check and Google Play Integrity (whether the app is a normally installed copy, device integrity) | No. 4 |
| Crash reports | Crash records; device status such as device model, OS version, app version, and memory; installation identifier; account identifier; location in the game at the time (neighborhood, area) | No. 6 |
| Usage statistics | App instance identifier, in-game actions (tutorial step, catifying areas, upgrades, collecting away rewards, using the shop, ads and invitations, sign-in method, etc.), device, OS, and app version, approximate country and region, first launch and usage time | No. 6 |
| Inquiries | Email address, content of the inquiry, order number and account number that the user wrote, reply records | Nos. 3, 7 |
| Coupon usage records | Coupon code and time of use | Nos. 2, 4 |
| Mail records | Mail identifier and source, claim and deletion status | Nos. 2, 4 |
| Attendance reward records | Claim date, time and quantity | Nos. 2, 4 |
We do not keep a per-user draw history for follower invitations. Current followers and confirmation information for the last transaction remain in game progress. Probability statistics retain only daily (UTC) counts by grade, without linking them to accounts.
2-2. Personal information processed when alerts are allowed
Alert registration tokens and Firebase installation IDs are used to deliver maintenance and update alerts (Section 1, No. 7). Permission can be withdrawn in the game or phone settings (Section 8). Turning alerts off unsubscribes the device without preventing gameplay. Unsubscribing does not mean that the identifiers themselves are immediately deleted. See Section 3 for retention.
2-3. Information processed by ad companies
To show rewarded ads, the ad company (currently only Google AdMob; see the table in Section 6) uses the ad tool inside the app to process the advertising ID (Android advertising identifier), app set ID, device and diagnostics information, the approximate location estimated from the IP address, and records of viewing or tapping ads. Personalized ads and how to turn them off are in Section 9.
2-4. What the Company does not process
- Unique identification information such as phone number, address, or resident registration number; precise location (GPS); contacts and photos on the device. We do not ask for your name (the display name and profile photo URL received when you sign in with a Google account are in Section 2-1).
- Payment-method information such as card numbers and bank accounts — the Store where you buy (Google Play or ONE store) processes it directly, and it is not passed to the Company.
- Device settings such as volume and vibration — they are saved only on the user's device and are not sent to the Company.
- This guide site does not use cookies or visit-analytics tools. However, access records while the site is open (IP address, browser information, access time) are processed by Google (Firebase Hosting), where the site is hosted, for service operation and security.
- Date of birth or exact age — only confirmation that the user is at least 14 is required when starting the game (Section 10).
3. Retention and Use Period
The Company destroys information as soon as its purpose has been achieved. However, records that the law requires to be kept or that are essential for responding to disputes are kept for the periods below.
| Item | Period | If you delete your account | Reason |
|---|---|---|---|
| Account and game progress | Until the account is deleted | Deleted immediately | Providing the service |
| Terms consent record (terms version, time of consent) | Until the account is deleted | Deleted immediately | Confirming consent |
| Payment records (order number, Store, product, time, Nyam Stick granted or recovered, status, record of Nyam Stick added in response to an inquiry, hash of the account identifier) | 5 years from the transaction date | Account hash and transaction details are kept for 5 years without name or email, then deleted | Article 6 of the E-Commerce Act and Article 6 of the Enforcement Decree of the same Act (records on payment and the supply of goods, and records on contracts and withdrawal: 5 years) |
| Game currency state and last transaction result (balance, purchases, followers and reward claim status) | Until account deletion; restricted accounts follow the restriction retention period below | Deleted immediately. Payment, refund and support-grant transaction records are retained separately for 5 years as stated above | Restoring progress and preventing duplicate processing and abuse |
| Records of handling inquiries, complaints, and disputes | 3 years | Kept for 3 years and then deleted | Article 6 of the Enforcement Decree of the E-Commerce Act (records on handling consumer complaints and disputes: 3 years) |
| Refund count record | 5 years from the last refund record | Stored separately under the account identifier hash and automatically deleted after 5 years, regardless of account deletion | Checking for repeated refunds |
| Rewarded ad usage records | Until account deletion (part of game progress) | Deleted immediately | Calculating daily counts and preventing duplicate rewards |
| Server access records (Cloud Logging) | 30 days | Deleted automatically after 30 days | Checking for errors and abuse |
| Crash reports (Crashlytics) | 90 days | Deletion process begins after 90 days | Fixing errors |
| Usage statistics (Google Analytics for Firebase) | Up to 14 months | Deleted automatically after the period | Service improvement |
| Restriction records (hash of the account identifier, suspension stage, time the suspension is lifted, whether the suspension is permanent, and the identifier and time of recent requests counted toward deciding the next suspension stage) | Until account deletion. Accounts still restricted are deleted with their game data by the daily cleanup after a default period of 3 months (90 days); an administrator may extend retention by 90 days by default for review | Deleted with the account | Preventing repeated abuse |
| Requests counted as violations (identifier, reason, time) | When a restriction decision is recorded, only duplicate-count prevention records from within the preceding 1 year are retained | Deleted immediately | Deciding restrictions, preventing duplicate counts and reviewing objections |
| Operations alerts (the account number, etc., sent to Telegram) | Until the Service ends | Not deleted automatically; kept | Checking for abuse |
| Alert registration token and installation ID | Turning alerts off unsubscribes the device. Installation IDs are retained according to Firebase's deletion-request policy. | Not stored on the Company's server or linked to an account. Account deletion or turning alerts off does not immediately delete these identifiers. Send deletion requests to the contact in Section 8. | Delivering alerts and identifying devices |
| Coupon usage records (code and time of use) | Until the account is deleted | Deleted immediately | Coupon redemption and preventing duplicate use |
| Mail records (identifier, source, claim and deletion status) | For the retention period set when sent (30 days by default), then automatically deleted after expiry. Users may delete claimed personal mail. | Personal mail and account-specific claim/deletion status are deleted immediately | Mail delivery and preventing duplicate claims |
| Attendance reward records (claim date, time and quantity) | Until the account is deleted | Deleted immediately | Reward delivery and preventing duplicate claims |
- The hash of the account identifier is a value made by converting the account identifier so that it cannot be reversed. Because it can be calculated again if the original account identifier is known, the law regards it as “pseudonymized information”, and it is protected in exactly the same way as personal information. The account number shown in the game's Settings window is the first 8 characters of this hash.
- Restriction records are also deleted immediately on account deletion. A minimal deletion-complete marker remains to prevent recreation of the same account.
- Account information in Firebase Authentication may take up to 180 days after a deletion request to be fully removed from live and backup systems. Firebase installation IDs are also removed within that period after a separate deletion request (Firebase privacy information).
- Information processed by ad companies is kept for the period under each company's policy (see each company's policy in the table in Section 6).
- The Company does not automatically delete accounts that have not connected for a long time. The account and game progress are deleted immediately on account deletion; accounts still restricted follow the default 3-month (90-day) retention and extension rules above. How to delete a guest account whose app has been deleted is in the Account Deletion guide.
4. Provision to Third Parties
The Company does not use users' personal information outside the purposes in Section 1 or provide it elsewhere. However, the cases below are exceptions.
- Where the user has consented in advance
- Where there is a special provision in law, or where an investigative agency makes a request in accordance with the procedures and methods set by law
Stores process payment-method information under their own terms and policies. The ad SDK may process information during initialization, ad loading and viewing. Preloading can transmit information even if you do not watch an ad. Relevant providers and data are described in Sections 5, 6 and 9.
5. Outsourcing of Processing
The following tasks are outsourced to provide the Service. The Company manages and supervises the processors in accordance with applicable law.
| Processor | Outsourced task |
|---|---|
| Google LLC · Google Asia Pacific Pte. Ltd. (Firebase·Google Cloud) | Account authentication, game servers and storage in the Seoul region, server logs, app checks, crash reports, usage statistics, notifications and hosting of this site |
| Telegram Messenger Inc. | Delivery of operations alerts about permanent suspensions and repeated refunds |
Google AdMob advertising, payment-tool diagnostics and statistics by Unity Technologies S.F., and payments by Google Play and ONE store Co., Ltd. are also subject to those providers' policies. Overseas processing is described in Section 6. Changes to outsourced tasks or processors are published in this Policy.
6. Overseas Transfers
Game progress is stored in the Seoul region of the Republic of Korea. Overseas processing or storage necessary to perform the service contract is subject to Article 28-8(1)(3) of the Personal Information Protection Act. Other transfers are subject to applicable legal requirements, including separate consent where required.
| Recipient and contact | Transfer country | Transferred data | Purpose, timing and method | Retention |
|---|---|---|---|---|
| Google LLC · Google Asia Pacific Pte. Ltd. Google privacy contact | The United States and countries where Google has data centers | Account identifiers and Google sign-in data, IP and device data, server logs, crash reports, usage statistics, notification tokens and installation identifiers, app-check data | Sign-in, server operations, error analysis, statistics and notifications. Transmitted over encrypted internet connections at sign-in, use of the feature or SDK initialization | Periods in Section 3. Authentication IP data: a few weeks. Other authentication data and notification installation identifiers: removed from live and backup systems within 180 days after deletion is requested. Hosting IP data: a few months |
| Google LLC (AdMob) Google privacy contact | The United States and countries where Google has data centers | Advertising ID, app-set ID, IP and approximate location, device and diagnostic data, ad-view and click records | Rewarded ads, performance measurement and ad-fraud prevention. Transmitted over encrypted internet connections during SDK initialization, preloading or ad use | As necessary for the purpose under Google's retention policy. Data needed for legal obligations or security are retained while the relevant reason applies |
| Unity Technologies S.F. (Unity IAP) DPO@unity3d.com | The United States and countries where Unity has data centers | Player and installation identifiers, device and session data, country and purchase-flow data | Payment-tool operation, diagnostics and statistics. Transmitted over encrypted internet connections during tool initialization and purchase processing | As necessary to provide the service and meet legal obligations, resolve disputes or prevent abuse under Unity's policy |
| Telegram Messenger Inc. Telegram support | The United States and countries where Telegram has data centers | First 8 characters of the account hash, refund count, product, Nyam Stick quantity and balance, first and current refund dates | Operations alerts. Transmitted over encrypted internet connections upon permanent suspension or the 3rd or later refund on the same account | Company operations alerts: until service closure. Telegram retains messages as necessary to provide its messaging service under its official policy |
Google global services and Unity may process data in facilities across multiple countries (Firebase processing locations; Unity international transfers). Telegram's public policy does not specify the country in which messages sent from Korea are stored.
Refusal and effects: Transfer refusal may be requested at loves2kill2@gmail.com. Refusing transfers necessary for accounts and server storage may restrict service use or require account deletion. Personalized-ad controls are described in Section 9. Not watching ads or owning the Ad Pass does not stop transfers caused by SDK initialization and preloading.
7. Destruction
- Procedure: Information is destroyed without delay when its retention period ends or its purpose is fulfilled. Information retained by law is separated and used only for that purpose.
- Method: Electronic records are deleted in a manner that prevents recovery. Any paper records are shredded or incinerated.
8. User Rights and How to Exercise Them
Users or their legal representatives may exercise the following rights in accordance with applicable law.
- Requesting access to your personal information, correction of anything wrong, deletion, or suspension of processing
- Withdrawing consent to processing you consented to (alerts, etc.)
- Requesting an explanation or review of automated decisions (Section 11)
How
- Deleting your account and game progress: Settings → Delete Acct in the game (details: Account Deletion guide)
- Turning off alerts: the Alerts row in the game's Settings, or phone Settings → Apps → Pawtheon → Notifications
- Other requests: Send your account number and request to loves2kill2@gmail.com. For access, correction, deletion or suspension requests, the Company provides the result or other required notice within 10 days under applicable law. Any statutory reason for deferral or refusal and the objection procedure are explained. Requests concerning automated decisions follow the applicable statutory procedure and deadline.
- You can also make requests through an agent (a legal representative or a person you have authorized). In that case, we may ask for the minimum material needed to confirm the agency relationship, such as a power of attorney.
Payment records and other information that must be kept by law may not be deleted during the retention period even if you request deletion, and in that case we will tell you the reason.
9. Advertising ID, Personalized Ads, and How to Turn Them Off
The game has rewarded ads only. An ad appears only when the user directly taps a button in the game that says it will play an ad (for example, “Watch Ad · Coins ×2”), and there are no ads that pop up by themselves and no banners. No ads are shown to users who have bought the Ad Pass.
Ad companies may show personalized ads by estimating the user's interests from behavioral information such as the advertising ID and app usage records.
| Behavioral information items | How they are collected | Purpose | Retention period | Processed by |
|---|---|---|---|---|
| Advertising ID, records of viewing and tapping ads, app usage records, approximate location | Automatically, when the ad tool (SDK) inside the app loads an ad | Personalized ads, measuring ad performance | As per each ad company's policy | The ad companies in the table in Section 6 |
Ads are displayed when you choose to watch them, but SDK initialization and preloading may occur earlier. Deleting the advertising ID or withdrawing personalized-ad consent does not automatically delete all ad information already processed.
Turning off personalized ads (Android)
- Open your phone's Settings.
- Go to Privacy → Ads (on some devices, Google → Ads).
- Tap Delete advertising ID. On older versions of Android, turn on Opt out of Ads Personalization.
If you delete the advertising ID or turn off personalization, the number of ads is the same, but ads unrelated to your interests are shown. Users in regions where consent is required, are shown an ad consent window on first launch, and can change it at any time under Settings → Privacy in the game (this button is shown only in regions where consent is required).
10. Children's Personal Information
The game is intended for users aged 14 or older. Children under 14 may not use it. Users must confirm that they are at least 14 when starting the game. Dates of birth and exact ages are not collected. If the Company learns that data of a child under 14 have been processed, it restricts use and deletes the data in accordance with applicable law. Legal representatives may request deletion at loves2kill2@gmail.com.
11. Automated Decisions
To prevent abuse, the game server makes the two decisions below automatically.
- Save check: Each time progress is saved, the server checks whether it is within the possible range. If it goes beyond the range, that save is not accepted and progress is rolled back to the last progress on the server.
- Request check: If manipulated invite requests are confirmed 10 times within 1 hour, use of the account is suspended automatically (4 hours → 24 hours → permanent suspension, Terms of Service, Article 16). When a permanent suspension happens, an alert goes to the operator.
Other suspensions are decided by a person after checking the records. Users may ask at loves2kill2@gmail.com for an explanation of the criteria and result of an automated decision and for a person to review it again, and the Company complies unless there is a justifiable reason not to (objections under Terms of Service, Article 17).
12. Security Measures
- Access controls: The server checks authorization when processing users' game data, and progress is saved through server functions that validate requests.
- Encryption: App-server communications use HTTPS/TLS, and stored data uses Google Cloud encryption.
- Identifier protection: Account identifiers are replaced with hashes in payment and transaction records. These values are also protected as personal information.
- Service protection: Invalid requests and abnormal behavior are checked, and servers operate in Google's data centers.
13. Chief Privacy Officer
Chief Privacy Officer: Kim Minjae (김민재) (Representative)
Business telephone: +82 10-7561-4992 · Email: loves2kill2@gmail.com
Please send inquiries, complaints, and requests for remedy concerning personal information to the email address above. We will reply and handle them without delay.
14. Remedies for Infringement of Rights
If you are not satisfied with how the Company handled a matter, you may apply to the bodies below for dispute resolution or consultation.
- Personal Information Dispute Mediation Committee: (no area code, within Korea) 1833-6972 · www.kopico.go.kr
- Personal Information Infringement Report Center: (no area code, within Korea) 118 · privacy.kisa.or.kr
- Supreme Prosecutors' Office: (no area code, within Korea) 1301 · www.spo.go.kr
- Korean National Police Agency: (no area code, within Korea) 182 · ecrm.police.go.kr
15. Changes to This Policy
Changes and their effective date are published on this page, and previous policies remain available. Changes requiring separate notice or consent follow the procedure required by applicable law.
16. Information for Overseas Users
This Policy does not restrict privacy rights under mandatory laws in the user's country of residence. The Company does not sell personal information for payment. Controls for processing information for personalized ads are described in Section 9.
Addendum
This Policy takes effect on .